formbook | 2388aba5e29792fc92af726882eb073d8d896640df9926d0dcd7565e2ee41cce

Analysis

max time kernel
167s
max time network
169s
platform
windows7_x64
resource
win7-20220331-en
submitted
01/04/2022, 14:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ORDER INQUIRY_pdf.exe
Size 391KB
Sample220401-rgn6fsggek
SHA256 2388aba5e29792fc92af726882eb073d8d896640df9926d0dcd7565e2ee41cce
MD5 8be97a587d0f0da89cb30586ce07ff54
SHA1 08b8c506fdb5e882de20e88366aaa2a21522c874
SHA512 d4b9bb1be0b2d79ccd23fc111c070dba11a46d75eed28dc520d81e7a184b92797c9005229b54cfa6112c10b67e58b0141624aa8b518c8b070bd9c744dcca8f86
MD5 SHA1 SHA512

Score

10^/10

formbook e0l9 rat spyware stealer suricata trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

e0l9

Decoy

packingfairturkiye.com
khenonline.com
mydactil.online
coriliechty.com
canadazk.com
freeloanseva.com
successvideo.today
infinitelifetransformations.com
unicryptdoge.com
ecolifeco.com
luxefashionaire.com
lqctqtal.xyz
liveexim.com
happyhempbakery.com
paypalverifie.com
wingonvacations.com
flawdogs.com
shalomsingapore.com
ruscc.xyz
yaxi868.com
hizika.com
joansbestshop.xyz
xfcad20.icu
kosaz.online
noticejcb.xyz
njpropertyrecors.com
positionme.site
rommyarf.com
vacumeet.xyz
societalsystemic.com
securitenovo.com
kingstreetlife.com
ridgwayracing.com
ndcqchc.com
rever-age.com
green-stone.solutions
idyijr28j.xyz
dailyjointhealth.com
computevault.com
thetimewheel.com
hilutv.xyz
shanaesbeauty.com
cryptwo.xyz
andro.finance
steady.store
gangsha2001.com
wodev.biz
affinitybuzz.com
nfhotel.net
westfieldswetlands.com
fatflorida.com
room4rent.net
madamebet.com
ceonsolutions.info
non-transferabletokens.com
rsvip13cvx.xyz
sveshtivosak.com
budunkafunk.com
nginspection.com
newdealny.com
uc-usa.com
tuvanvaytien24h.site
5okx.com
menzelengineering.com
unityassetstock.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Formbook Payload 4 IoCs

rat

resource	yara_rule
behavioral1/memory/2040-64-0x000000000041F110-mapping.dmp	formbook
behavioral1/memory/2040-63-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/2040-67-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1232-75-0x0000000000080000-0x00000000000AF000-memory.dmp	formbook

Executes dropped EXE 2 IoCs

pid	Process
1384	wgsmt.exe
2040	wgsmt.exe

Loads dropped DLL 2 IoCs

pid	Process
1940	ORDER INQUIRY_pdf.exe
1384	wgsmt.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1384 set thread context of 2040	1384	wgsmt.exe	29
PID 2040 set thread context of 1268	2040	wgsmt.exe	16
PID 1232 set thread context of 1268	1232	colorcpl.exe	16

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
2040	wgsmt.exe
2040	wgsmt.exe
1232	colorcpl.exe
1232	colorcpl.exe
1232	colorcpl.exe
1232	colorcpl.exe
1232	colorcpl.exe
1232	colorcpl.exe
1232	colorcpl.exe
1232	colorcpl.exe
1232	colorcpl.exe
1232	colorcpl.exe
1232	colorcpl.exe
1232	colorcpl.exe
1232	colorcpl.exe
1232	colorcpl.exe
1232	colorcpl.exe
1232	colorcpl.exe
1232	colorcpl.exe
1232	colorcpl.exe
1232	colorcpl.exe
1232	colorcpl.exe
1232	colorcpl.exe
1232	colorcpl.exe
1232	colorcpl.exe
1232	colorcpl.exe
1232	colorcpl.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
2040	wgsmt.exe
2040	wgsmt.exe
2040	wgsmt.exe
1232	colorcpl.exe
1232	colorcpl.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2040	wgsmt.exe
Token: SeDebugPrivilege	1232	colorcpl.exe
Token: SeShutdownPrivilege	1268	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1268	Explorer.EXE
1268	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1268	Explorer.EXE
1268	Explorer.EXE

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 1384	1940	ORDER INQUIRY_pdf.exe	28
PID 1940 wrote to memory of 1384	1940	ORDER INQUIRY_pdf.exe	28
PID 1940 wrote to memory of 1384	1940	ORDER INQUIRY_pdf.exe	28
PID 1940 wrote to memory of 1384	1940	ORDER INQUIRY_pdf.exe	28
PID 1384 wrote to memory of 2040	1384	wgsmt.exe	29
PID 1384 wrote to memory of 2040	1384	wgsmt.exe	29
PID 1384 wrote to memory of 2040	1384	wgsmt.exe	29
PID 1384 wrote to memory of 2040	1384	wgsmt.exe	29
PID 1384 wrote to memory of 2040	1384	wgsmt.exe	29
PID 1384 wrote to memory of 2040	1384	wgsmt.exe	29
PID 1384 wrote to memory of 2040	1384	wgsmt.exe	29
PID 1268 wrote to memory of 1232	1268	Explorer.EXE	30
PID 1268 wrote to memory of 1232	1268	Explorer.EXE	30
PID 1268 wrote to memory of 1232	1268	Explorer.EXE	30
PID 1268 wrote to memory of 1232	1268	Explorer.EXE	30
PID 1232 wrote to memory of 1352	1232	colorcpl.exe	31
PID 1232 wrote to memory of 1352	1232	colorcpl.exe	31
PID 1232 wrote to memory of 1352	1232	colorcpl.exe	31
PID 1232 wrote to memory of 1352	1232	colorcpl.exe	31

C:\Users\Admin\AppData\Local\Temp\ORDER INQUIRY_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\ORDER INQUIRY_pdf.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Users\Admin\AppData\Local\Temp\wgsmt.exe
  C:\Users\Admin\AppData\Local\Temp\wgsmt.exe C:\Users\Admin\AppData\Local\Temp\vriqwsgvqc
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1384
- - C:\Users\Admin\AppData\Local\Temp\wgsmt.exe
    C:\Users\Admin\AppData\Local\Temp\wgsmt.exe C:\Users\Admin\AppData\Local\Temp\vriqwsgvqc
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:2040

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Windows\SysWOW64\colorcpl.exe
  "C:\Windows\SysWOW64\colorcpl.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1232
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\wgsmt.exe"
    3⤵
    PID:1352

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6i6wg0wtvgb9noks5j

Path C:\Users\Admin\AppData\Local\Temp\6i6wg0wtvgb9noks5j
Size 212KB
SHA256 f51f3318a773af23b0296ee1c976cf495832c734dd3fe177523d518184156f10
MD5 e51de72de9d6823a4b0cb74525ddc6d4
SHA1 0d36878ddff717afbb0f8b8910a62ff73bf0e4f4
SHA512 9d518778efe297b52967681ff872347bfe69d26629e45815b83bc923513e3330ae84ba0d8671373431f2a94d4b5b3d2093560daac6c9d060d77d110bd9fb8c2d
SSDEEP 6144:QxcNGaByA1xGalBwuiSfz3rTfFnR+drgjZBG+O:Y4MqxFlBwtSfz3Ddtk+O
MD5 SHA1 SHA512 SSDEEP

Submit Download

vriqwsgvqc

Path C:\Users\Admin\AppData\Local\Temp\vriqwsgvqc
Size 4KB
SHA256 6815bd1f3ccbc54c504f19b2d6f4fbeda6276ed9873610a76b6a71eb3ac408cd
MD5 227f33f86fe39fc88a7c7a10532b482c
SHA1 8ae3ed119859edd9ec6e629452825361f73efe4a
SHA512 dc712a0359acbcc994fed344e8e2543e3795dbf5d7b6f79b615f101e0f63a3d408a3069854cfd53659581da1640d7de5f0768c77e80d8bb3fb2556dd0d98f310
SSDEEP 96:lX9/dOrMglXwDJYWUl9UedDLBfXwkBXKw2ClApxYUtuIV+36hHas:V6LdwDJYWUl9UedDLpwkoFJwI7h6s
MD5 SHA1 SHA512 SSDEEP

Submit Download

wgsmt.exe

Path C:\Users\Admin\AppData\Local\Temp\wgsmt.exe
Size 4KB
SHA256 60b26f585feedf4b2d5be43543c48bfe6724dcad79a49466e669d0b7f93e00db
MD5 942d40ca5a8979ef9c5d63618cb35e09
SHA1 d02d57ca6afaa7545a347b2cc4ba771cf5836968
SHA512 12a6a27885afb5d767f32a75db7d0f3540a0b0f9f2819aae5c3d7c2a371552c7ecfb3dace8ffb10cb17e3ea057aa05f02d279d587b9eaef5688d98cad7d09b53
MD5 SHA1 SHA512

Submit Download

wgsmt.exe

Path C:\Users\Admin\AppData\Local\Temp\wgsmt.exe
Size 4KB
SHA256 60b26f585feedf4b2d5be43543c48bfe6724dcad79a49466e669d0b7f93e00db
MD5 942d40ca5a8979ef9c5d63618cb35e09
SHA1 d02d57ca6afaa7545a347b2cc4ba771cf5836968
SHA512 12a6a27885afb5d767f32a75db7d0f3540a0b0f9f2819aae5c3d7c2a371552c7ecfb3dace8ffb10cb17e3ea057aa05f02d279d587b9eaef5688d98cad7d09b53
MD5 SHA1 SHA512

Submit Download

wgsmt.exe

Path C:\Users\Admin\AppData\Local\Temp\wgsmt.exe
Size 4KB
SHA256 60b26f585feedf4b2d5be43543c48bfe6724dcad79a49466e669d0b7f93e00db
MD5 942d40ca5a8979ef9c5d63618cb35e09
SHA1 d02d57ca6afaa7545a347b2cc4ba771cf5836968
SHA512 12a6a27885afb5d767f32a75db7d0f3540a0b0f9f2819aae5c3d7c2a371552c7ecfb3dace8ffb10cb17e3ea057aa05f02d279d587b9eaef5688d98cad7d09b53
MD5 SHA1 SHA512

Submit Download

wgsmt.exe

Path \Users\Admin\AppData\Local\Temp\wgsmt.exe
Size 4KB
SHA256 60b26f585feedf4b2d5be43543c48bfe6724dcad79a49466e669d0b7f93e00db
MD5 942d40ca5a8979ef9c5d63618cb35e09
SHA1 d02d57ca6afaa7545a347b2cc4ba771cf5836968
SHA512 12a6a27885afb5d767f32a75db7d0f3540a0b0f9f2819aae5c3d7c2a371552c7ecfb3dace8ffb10cb17e3ea057aa05f02d279d587b9eaef5688d98cad7d09b53
MD5 SHA1 SHA512

Submit Download

wgsmt.exe

Path \Users\Admin\AppData\Local\Temp\wgsmt.exe
Size 4KB
SHA256 60b26f585feedf4b2d5be43543c48bfe6724dcad79a49466e669d0b7f93e00db
MD5 942d40ca5a8979ef9c5d63618cb35e09
SHA1 d02d57ca6afaa7545a347b2cc4ba771cf5836968
SHA512 12a6a27885afb5d767f32a75db7d0f3540a0b0f9f2819aae5c3d7c2a371552c7ecfb3dace8ffb10cb17e3ea057aa05f02d279d587b9eaef5688d98cad7d09b53
MD5 SHA1 SHA512

Submit Download

memory/1232-74-0x0000000000260000-0x0000000000278000-memory.dmp

Download

memory/1232-77-0x00000000003B0000-0x0000000000443000-memory.dmp

Download

memory/1232-76-0x0000000002030000-0x0000000002333000-memory.dmp

Download

memory/1232-75-0x0000000000080000-0x00000000000AF000-memory.dmp

Download

memory/1268-70-0x0000000005E10000-0x0000000005EE8000-memory.dmp

Download

memory/1268-78-0x00000000062B0000-0x00000000063E7000-memory.dmp

Download

memory/1940-54-0x0000000075111000-0x0000000075113000-memory.dmp

Download

memory/2040-69-0x0000000000370000-0x0000000000384000-memory.dmp

Download

memory/2040-68-0x00000000008F0000-0x0000000000BF3000-memory.dmp

Download

memory/2040-67-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2040-63-0x0000000000400000-0x000000000042F000-memory.dmp

Download