formbook | f697de2afbf1f8c97d3947ee677e355a9f57576d64f1496e0e4560ccad4efdab

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
03/03/2022, 17:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
522-763524116309-pdf.exe
Size 340KB
Sample220303-whfmxsdffp
SHA256 f697de2afbf1f8c97d3947ee677e355a9f57576d64f1496e0e4560ccad4efdab
MD5 2ac522d691d5196deb9a915b63a3d519
SHA1 a7275a3851d663a45b4b65592778b420cd17f474
SHA512 3c4286abe950e67fc89715a822545047eb5441010cc8c9f6f5026ad1bffa9223192bad50c9e34d0385f65cf633374c4170d560e0a980a80fadcdd5f2544a586f
MD5 SHA1 SHA512

Score

10^/10

formbook xloader nqs9 loader persistence rat spyware stealer suricata trojan

Malware Config

Extracted

Family

xloader

Version

Campaign

nqs9

Decoy

lgingood.com
shopgeti.com
christianuomo.com
sportsxuk.com
markidesignstore.com
tjhuoliao.com
docomobb.xyz
ilrespirodelmare.com
kfconline.rest
paramusrepair.com
w3zand.com
unguamtruppe.quest
bethesdagardensloveland.net
bostonstretchlimousine.com
yycsmj.net
creatorgela.com
bestalcoholfreebeer.com
jorgeforfr.com
dlzxd.com
rajaranicoupon.xyz
marnannyc.com
bettersalud.info
xn----etbdbfqj8aat.xn--p1acf
brandsagency.net
tradequy.net
farmaciacentral.online
portaal140.top
solacebooks.online
theroastercoaster.com
vanityandsanity.store
thediscoverytrail.com
comunidadpatriota.com
simplyall.xyz
db-propertygroup.com
mgav37.xyz
dwight.store
prosperityurgentcare.us
realbrother.net
shineshaft.website
just4beauty.store
zoosmash.com
paneiro.net
splitattherootfilm.com
waytokeiomed.com
allaroundlandscapingllc.com
pageants.xyz
amenosu.com
karamrentacar.com
dfgroup.tech
valdicolor.com
nu9gayde.xyz
bookfling.store
trimcatch.com
serbersa.com
richmondcambiemedicalclinic.com
claritydesignz.com
finlandfive.xyz
hgs777.com
mjfashionnz.com
pragunananda.com
donbicicleta.com
executeonpurpose.com
proteamstaxconsultancy.com
zmduk.com
thietketrantam.art

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2504 created 3792	2504	WerFault.exe	98

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
suricata

Xloader Payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/1916-134-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/2360-142-0x00000000008B0000-0x00000000008D9000-memory.dmp	xloader

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\FHL86TTXGV = "C:\\Program Files (x86)\\Cm4qlur\\4hdr4n.exe"	svchost.exe

Executes dropped EXE 3 IoCs

pid	Process
1600	dtrmmqncv.exe
1916	dtrmmqncv.exe
3792	4hdr4n.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1600 set thread context of 1916	1600	dtrmmqncv.exe	81
PID 1916 set thread context of 3032	1916	dtrmmqncv.exe	59
PID 2360 set thread context of 3032	2360	svchost.exe	59

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Cm4qlur\4hdr4n.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\Cm4qlur	Explorer.EXE
File created	C:\Program Files (x86)\Cm4qlur\4hdr4n.exe	Explorer.EXE
File opened for modification	C:\Program Files (x86)\Cm4qlur\4hdr4n.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2236	3792	WerFault.exe	98

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	svchost.exe

Suspicious behavior: EnumeratesProcesses 60 IoCs

pid	Process
1916	dtrmmqncv.exe
1916	dtrmmqncv.exe
1916	dtrmmqncv.exe
1916	dtrmmqncv.exe
2360	svchost.exe
2360	svchost.exe
2360	svchost.exe
2360	svchost.exe
2360	svchost.exe
2360	svchost.exe
2360	svchost.exe
2360	svchost.exe
2360	svchost.exe
2360	svchost.exe
2360	svchost.exe
2360	svchost.exe
2360	svchost.exe
2360	svchost.exe
2360	svchost.exe
2360	svchost.exe
2360	svchost.exe
2360	svchost.exe
2360	svchost.exe
2360	svchost.exe
2360	svchost.exe
2360	svchost.exe
2360	svchost.exe
2360	svchost.exe
2360	svchost.exe
2360	svchost.exe
2360	svchost.exe
2360	svchost.exe
2360	svchost.exe
2360	svchost.exe
2360	svchost.exe
2360	svchost.exe
2360	svchost.exe
2360	svchost.exe
2360	svchost.exe
2360	svchost.exe
2360	svchost.exe
2360	svchost.exe
2360	svchost.exe
2360	svchost.exe
2360	svchost.exe
2360	svchost.exe
2360	svchost.exe
2360	svchost.exe
2360	svchost.exe
2360	svchost.exe
2236	WerFault.exe
2236	WerFault.exe
2360	svchost.exe
2360	svchost.exe
2360	svchost.exe
2360	svchost.exe
2360	svchost.exe
2360	svchost.exe
2360	svchost.exe
2360	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3032	Explorer.EXE

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
1916	dtrmmqncv.exe
1916	dtrmmqncv.exe
1916	dtrmmqncv.exe
2360	svchost.exe
2360	svchost.exe
2360	svchost.exe
2360	svchost.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1916	dtrmmqncv.exe
Token: SeDebugPrivilege	2360	svchost.exe
Token: SeRestorePrivilege	2236	WerFault.exe
Token: SeBackupPrivilege	2236	WerFault.exe
Token: SeShutdownPrivilege	3032	Explorer.EXE
Token: SeCreatePagefilePrivilege	3032	Explorer.EXE

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 1600	1380	522-763524116309-pdf.exe	80
PID 1380 wrote to memory of 1600	1380	522-763524116309-pdf.exe	80
PID 1380 wrote to memory of 1600	1380	522-763524116309-pdf.exe	80
PID 1600 wrote to memory of 1916	1600	dtrmmqncv.exe	81
PID 1600 wrote to memory of 1916	1600	dtrmmqncv.exe	81
PID 1600 wrote to memory of 1916	1600	dtrmmqncv.exe	81
PID 1600 wrote to memory of 1916	1600	dtrmmqncv.exe	81
PID 1600 wrote to memory of 1916	1600	dtrmmqncv.exe	81
PID 1600 wrote to memory of 1916	1600	dtrmmqncv.exe	81
PID 3032 wrote to memory of 2360	3032	Explorer.EXE	82
PID 3032 wrote to memory of 2360	3032	Explorer.EXE	82
PID 3032 wrote to memory of 2360	3032	Explorer.EXE	82
PID 2360 wrote to memory of 1200	2360	svchost.exe	87
PID 2360 wrote to memory of 1200	2360	svchost.exe	87
PID 2360 wrote to memory of 1200	2360	svchost.exe	87
PID 2360 wrote to memory of 1972	2360	svchost.exe	95
PID 2360 wrote to memory of 1972	2360	svchost.exe	95
PID 2360 wrote to memory of 1972	2360	svchost.exe	95
PID 2360 wrote to memory of 4080	2360	svchost.exe	97
PID 2360 wrote to memory of 4080	2360	svchost.exe	97
PID 3032 wrote to memory of 3792	3032	Explorer.EXE	98
PID 3032 wrote to memory of 3792	3032	Explorer.EXE	98
PID 3032 wrote to memory of 3792	3032	Explorer.EXE	98
PID 2504 wrote to memory of 3792	2504	WerFault.exe	98
PID 2504 wrote to memory of 3792	2504	WerFault.exe	98
PID 2360 wrote to memory of 4080	2360	svchost.exe	97

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Users\Admin\AppData\Local\Temp\522-763524116309-pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\522-763524116309-pdf.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1380
- - C:\Users\Admin\AppData\Local\Temp\dtrmmqncv.exe
    C:\Users\Admin\AppData\Local\Temp\dtrmmqncv.exe C:\Users\Admin\AppData\Local\Temp\uyxdxzxz
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1600
  - - C:\Users\Admin\AppData\Local\Temp\dtrmmqncv.exe
      C:\Users\Admin\AppData\Local\Temp\dtrmmqncv.exe C:\Users\Admin\AppData\Local\Temp\uyxdxzxz
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:1916
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\SysWOW64\svchost.exe"
  2⤵
  - Adds policy Run key to start application
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2360
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\dtrmmqncv.exe"
    3⤵
    PID:1200
- - C:\Windows\SysWOW64\cmd.exe
    /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
    3⤵
    PID:1972
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:4080
- C:\Program Files (x86)\Cm4qlur\4hdr4n.exe
  "C:\Program Files (x86)\Cm4qlur\4hdr4n.exe"
  2⤵
  - Executes dropped EXE
  PID:3792
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3792 -s 460
    3⤵
    - Program crash
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3792 -ip 3792
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:2504

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1916-139-0x0000000000F60000-0x0000000000F71000-memory.dmp

Download

memory/1916-138-0x000000000041D000-0x000000000041E000-memory.dmp

Download

memory/1916-137-0x0000000001370000-0x00000000016BA000-memory.dmp

Download

memory/1916-134-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2360-141-0x0000000000A70000-0x0000000000A7E000-memory.dmp

Download

memory/2360-142-0x00000000008B0000-0x00000000008D9000-memory.dmp

Download

memory/2360-143-0x0000000001400000-0x000000000174A000-memory.dmp

Download

memory/2360-144-0x0000000001200000-0x0000000001290000-memory.dmp

Download

memory/3032-140-0x0000000008440000-0x0000000008593000-memory.dmp

Download

memory/3032-145-0x00000000085A0000-0x00000000086D8000-memory.dmp

Download