formbook | c73ddd4b47e7691c3655bb1aa5ac034368f865fbc40c22b20c6ab774cb23dd31

Analysis

max time kernel
44s
max time network
109s
platform
windows7_x64
resource
win7-20220331-en
submitted
12/04/2022, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DHL_April 2022 at 12.N_9B7290_PDF.exe
Size 688KB
Sample220412-phra4abdam
SHA256 c73ddd4b47e7691c3655bb1aa5ac034368f865fbc40c22b20c6ab774cb23dd31
MD5 42f2c63ef48f61b667742768a66f32aa
SHA1 e5e96aa9ecea654c89980538be63f07b070682db
SHA512 6362e50267fb755fd6464aa77e1307ad59ef080acb8fc585a68b71847a99e6058cd3263d8283deb4e78fd265c74abf3bdbc647380a9a2fc8df69d611ea6548ef
MD5 SHA1 SHA512

Score

10^/10

formbook modiloader g3db persistence rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

g3db

Decoy

rodrigoortigosa.com
gotechraise.com
evens.technology
savemyitcareer.com
liquorsmith.com
netmixtv-ddns.net
julialogoped.online
meja21.com
lifuinc.com
relxworld.com
fdgfhghj520.xyz
knight.xn--6qq986b3xl
vrmetavirtuel.com
keytocoins.com
poiu0167.com
usaservicedogreistration.com
badassmofoleague.com
millionairetravelnvacation.com
deibaabogados.com
io69.one
cnboffshore.com
hotline-maintenance.xyz
phrendlu.com
mintgreen-initiative.com
mgpower.one
bcptsb.club
changlitm.xyz
tnjgt.com
buildwithukraine.com
5368240842.site
nmteknoloji.com
crex.store
ukrainebreaknews.com
harristravelservices.com
obchodprodum.online
usaservicedogregitsration.com
j5mall.com
caipiao605.com
bushlips.com
cursosconfernando.com
pyugsa.site
globalrantyco.xyz
ezclinicworks.com
nataliacasephotography.com
propkarta.com
toporlandocashoffers.com
queryip.info
truflexen.info
remplastics.com
evgey.net
bitcoinnoticias.info
ukrainechildsupport.co
tapinbox.site
24-h-servicio-informacion.site
universitysupplydepot.com
fjyccloud.com
andreslv.com
ullysssignanddecal.com
procrastinationsports.com
hair-gg.com
commonswitchingplatform.com
fqwypq.biz
deny12ctz.com
daboobles.com
greatwallinstitutes.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

Formbook Payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/1092-80-0x0000000000000000-mapping.dmp	formbook

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ghdjfku = "C:\\Users\\Public\\Libraries\\ukfjdhG.url"	DHL_April 2022 at 12.N_9B7290_PDF.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1652	1092	WerFault.exe	38

Runs net.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1352	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1352	powershell.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 1156	1400	DHL_April 2022 at 12.N_9B7290_PDF.exe	30
PID 1400 wrote to memory of 1156	1400	DHL_April 2022 at 12.N_9B7290_PDF.exe	30
PID 1400 wrote to memory of 1156	1400	DHL_April 2022 at 12.N_9B7290_PDF.exe	30
PID 1400 wrote to memory of 1156	1400	DHL_April 2022 at 12.N_9B7290_PDF.exe	30
PID 1156 wrote to memory of 1548	1156	cmd.exe	32
PID 1156 wrote to memory of 1548	1156	cmd.exe	32
PID 1156 wrote to memory of 1548	1156	cmd.exe	32
PID 1156 wrote to memory of 1548	1156	cmd.exe	32
PID 1548 wrote to memory of 1276	1548	cmd.exe	34
PID 1548 wrote to memory of 1276	1548	cmd.exe	34
PID 1548 wrote to memory of 1276	1548	cmd.exe	34
PID 1548 wrote to memory of 1276	1548	cmd.exe	34
PID 1276 wrote to memory of 1540	1276	net.exe	35
PID 1276 wrote to memory of 1540	1276	net.exe	35
PID 1276 wrote to memory of 1540	1276	net.exe	35
PID 1276 wrote to memory of 1540	1276	net.exe	35
PID 1548 wrote to memory of 1352	1548	cmd.exe	36
PID 1548 wrote to memory of 1352	1548	cmd.exe	36
PID 1548 wrote to memory of 1352	1548	cmd.exe	36
PID 1548 wrote to memory of 1352	1548	cmd.exe	36
PID 1400 wrote to memory of 1092	1400	DHL_April 2022 at 12.N_9B7290_PDF.exe	38
PID 1400 wrote to memory of 1092	1400	DHL_April 2022 at 12.N_9B7290_PDF.exe	38
PID 1400 wrote to memory of 1092	1400	DHL_April 2022 at 12.N_9B7290_PDF.exe	38
PID 1400 wrote to memory of 1092	1400	DHL_April 2022 at 12.N_9B7290_PDF.exe	38
PID 1400 wrote to memory of 1092	1400	DHL_April 2022 at 12.N_9B7290_PDF.exe	38
PID 1400 wrote to memory of 1092	1400	DHL_April 2022 at 12.N_9B7290_PDF.exe	38
PID 1400 wrote to memory of 1092	1400	DHL_April 2022 at 12.N_9B7290_PDF.exe	38
PID 1092 wrote to memory of 1652	1092	logagent.exe	39
PID 1092 wrote to memory of 1652	1092	logagent.exe	39
PID 1092 wrote to memory of 1652	1092	logagent.exe	39
PID 1092 wrote to memory of 1652	1092	logagent.exe	39

C:\Users\Admin\AppData\Local\Temp\DHL_April 2022 at 12.N_9B7290_PDF.exe
"C:\Users\Admin\AppData\Local\Temp\DHL_April 2022 at 12.N_9B7290_PDF.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Public\Libraries\Ghdjfkut.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1156
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Public\Libraries\GhdjfkuO.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1548
  - - C:\Windows\SysWOW64\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1276
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:1540
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1352
- C:\Windows\SysWOW64\logagent.exe
  C:\Windows\System32\logagent.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1092
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 140
    3⤵
    - Program crash
    PID:1652

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Cdex.bat

Path C:\Users\Public\Libraries\Cdex.bat
Size 155B
SHA256 37c59c8398279916cfce45f8c5e3431058248f5e3bef4d9f5c0f44a7d564f82e
MD5 213c60adf1c9ef88dc3c9b2d579959d2
SHA1 e4d2ad7b22b1a8b5b1f7a702b303c7364b0ee021
SHA512 fe897d9caa306b0e761b2fd61bb5dc32a53bfaad1ce767c6860af4e3ad59c8f3257228a6e1072dab0f990cb51c59c648084ba419ac6bc5c0a99bdffa569217b7
MD5 SHA1 SHA512

Submit Download

GhdjfkuO.bat

Path C:\Users\Public\Libraries\GhdjfkuO.bat
Size 1KB
SHA256 4ef9821678da07138c19405387f3fb95e409fbd461c7b8d847c05075facd63ca
MD5 df48c09f243ebcc8a165f77a1c2bf889
SHA1 455f7db0adcc2a58d006f1630fb0bd55cd868c07
SHA512 735838c7cca953697ded48adfcd037b7f198072a8962f5940ce12e1bb1c7dd8c1f257a829276f5f5456f776f5bd13342222dd6e0dfc8f18a23f464f2c8d8f1cc
MD5 SHA1 SHA512

Submit Download

Ghdjfkut.bat

Path C:\Users\Public\Libraries\Ghdjfkut.bat
Size 56B
SHA256 f2079e33096a61d48df2581afedf21913847ed262bbe7273499ab1a2cf801543
MD5 d213fc79ba66ee475a4b212e72c70cff
SHA1 ad510164ca740a50b33d76b40652662fe23f5b66
SHA512 756760bb3d7427bec7ec00c7f698db7def045888951de5554bdd9764d7b5fa2bfb6bc1a3c575f14131df7fbd97f8cb60197c6892f409b394634f7b78c0121d50
MD5 SHA1 SHA512

Submit Download

memory/1092-76-0x0000000000080000-0x0000000000081000-memory.dmp

Download

memory/1092-74-0x0000000010410000-0x000000001043F000-memory.dmp

Download

memory/1352-72-0x00000000730D0000-0x000000007367B000-memory.dmp

Download

memory/1352-73-0x0000000002520000-0x0000000002563000-memory.dmp

Download

memory/1400-54-0x0000000075331000-0x0000000075333000-memory.dmp

Download