formbook | 472fce69055da6dee0ab8f9bfc0fd3979a766aec390cd6bd5bb01483e27cdce5

Analysis

max time kernel
147s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20220331-en
submitted
12/04/2022, 13:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ekstre.exe
Size 235KB
Sample220412-qqpmxabhcn
SHA256 472fce69055da6dee0ab8f9bfc0fd3979a766aec390cd6bd5bb01483e27cdce5
MD5 080aa3660cba5bdd3a80c87755f7c6ab
SHA1 3cfc6a93df82a0d9ef24594cce5ae956ea9016de
SHA512 835b9b26787b30a997d28006aa7b24c3f68c78cc39ac8222311037f4af381f8ffed436c20a47a863dfc662e15246191295037e29c64be5aba102a165f2a130be
MD5 SHA1 SHA512

Score

10^/10

formbook d23n rat spyware stealer suricata trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

d23n

Decoy

keralalotteryresults.com
cosnerreview.com
tilcompanies.com
tokomakmurjaya.xyz
twmarketz.com
spytfyre.com
eyerafitnessapp.com
faswebs.com
hotcinfin.com
modifidecars.com
xn--rhqwesct95oo2g0ro.com
fruitfulgreenhousefacility.com
pomidor.biz
volondamasterclass.com
latexbbs.com
kkh222.com
ratted.xyz
littlejohnsinc.com
vacationdealscorp.website
bitcoinbil3arabi.com
cjhzgxkl.com
myfirstblanket.com
umfjytgtz.com
sanjoseinteriordesign.com
musicalderelict.com
communityrealestates.com
jordsagency.com
fragmentize.xyz
bullmatch.net
demtate.xyz
metakolkata.com
xx3bwzac.xyz
h3dpy.com
smileonimplantsdentalcenter.com
comprasessenciais.com
mamasustainablefortunebots.com
andhrianos.com
em64jxyp.xyz
mohammadshahjalal.com
lldwjs.com
modernhippietherapy.com
americanegles.com
rx10763019.com
earthikan.com
drawfarm.xyz
bghfkk.xyz
adkinsvideo.com
xclunw.com
kutibox.club
troos.online
nothingbutdd.com
alps82.com
inviolablenft.com
i-do-ilas.com
esothereum.com
oxidizer.xyz
thissunshinyday.com
surehulocalsing.com
ruzhoulvyou.com
cleansolarpanels.info
obfexj.com
xn--80ahdz7a0d.online
peoplehrcapital.net
byw9988.com
littlespaceandmore.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Formbook Payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/3444-130-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/3088-139-0x00000000011A0000-0x00000000011CF000-memory.dmp	formbook

Blocklisted process makes network request 1 IoCs

flow	pid	Process
81	3088	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
4820	cxefv.exe
3444	cxefv.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4820 set thread context of 3444	4820	cxefv.exe	83
PID 3444 set thread context of 2844	3444	cxefv.exe	31
PID 3088 set thread context of 2844	3088	cmd.exe	31

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 60 IoCs

pid	Process
3444	cxefv.exe
3444	cxefv.exe
3444	cxefv.exe
3444	cxefv.exe
3088	cmd.exe
3088	cmd.exe
3088	cmd.exe
3088	cmd.exe
3088	cmd.exe
3088	cmd.exe
3088	cmd.exe
3088	cmd.exe
3088	cmd.exe
3088	cmd.exe
3088	cmd.exe
3088	cmd.exe
3088	cmd.exe
3088	cmd.exe
3088	cmd.exe
3088	cmd.exe
3088	cmd.exe
3088	cmd.exe
3088	cmd.exe
3088	cmd.exe
3088	cmd.exe
3088	cmd.exe
3088	cmd.exe
3088	cmd.exe
3088	cmd.exe
3088	cmd.exe
3088	cmd.exe
3088	cmd.exe
3088	cmd.exe
3088	cmd.exe
3088	cmd.exe
3088	cmd.exe
3088	cmd.exe
3088	cmd.exe
3088	cmd.exe
3088	cmd.exe
3088	cmd.exe
3088	cmd.exe
3088	cmd.exe
3088	cmd.exe
3088	cmd.exe
3088	cmd.exe
3088	cmd.exe
3088	cmd.exe
3088	cmd.exe
3088	cmd.exe
3088	cmd.exe
3088	cmd.exe
3088	cmd.exe
3088	cmd.exe
3088	cmd.exe
3088	cmd.exe
3088	cmd.exe
3088	cmd.exe
3088	cmd.exe
3088	cmd.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2844	Explorer.EXE

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
3444	cxefv.exe
3444	cxefv.exe
3444	cxefv.exe
3088	cmd.exe
3088	cmd.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3444	cxefv.exe
Token: SeDebugPrivilege	3088	cmd.exe
Token: SeShutdownPrivilege	2844	Explorer.EXE
Token: SeCreatePagefilePrivilege	2844	Explorer.EXE
Token: SeShutdownPrivilege	2844	Explorer.EXE
Token: SeCreatePagefilePrivilege	2844	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2844	Explorer.EXE
2844	Explorer.EXE

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 4820	4796	ekstre.exe	82
PID 4796 wrote to memory of 4820	4796	ekstre.exe	82
PID 4796 wrote to memory of 4820	4796	ekstre.exe	82
PID 4820 wrote to memory of 3444	4820	cxefv.exe	83
PID 4820 wrote to memory of 3444	4820	cxefv.exe	83
PID 4820 wrote to memory of 3444	4820	cxefv.exe	83
PID 4820 wrote to memory of 3444	4820	cxefv.exe	83
PID 4820 wrote to memory of 3444	4820	cxefv.exe	83
PID 4820 wrote to memory of 3444	4820	cxefv.exe	83
PID 2844 wrote to memory of 3088	2844	Explorer.EXE	84
PID 2844 wrote to memory of 3088	2844	Explorer.EXE	84
PID 2844 wrote to memory of 3088	2844	Explorer.EXE	84
PID 3088 wrote to memory of 4020	3088	cmd.exe	85
PID 3088 wrote to memory of 4020	3088	cmd.exe	85
PID 3088 wrote to memory of 4020	3088	cmd.exe	85

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Users\Admin\AppData\Local\Temp\ekstre.exe
  "C:\Users\Admin\AppData\Local\Temp\ekstre.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4796
- - C:\Users\Admin\AppData\Local\Temp\cxefv.exe
    C:\Users\Admin\AppData\Local\Temp\cxefv.exe C:\Users\Admin\AppData\Local\Temp\infxqgc
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4820
  - - C:\Users\Admin\AppData\Local\Temp\cxefv.exe
      C:\Users\Admin\AppData\Local\Temp\cxefv.exe C:\Users\Admin\AppData\Local\Temp\infxqgc
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:3444
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\SysWOW64\cmd.exe"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3088
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\cxefv.exe"
    3⤵
    PID:4020

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cxefv.exe

Path C:\Users\Admin\AppData\Local\Temp\cxefv.exe
Size 5KB
SHA256 038d9c2e5e9bc9260120ee7f0d0aa8f3136bbf5d72a703a023b06b0c8cd9f8a6
MD5 f1cb8abe8e79430bf71eb50e365f89c4
SHA1 cb64a8a1e4363dbe96f76cc5654a3a1531e6f4c1
SHA512 e605f80b44080e150405e9078c81e312dcb31d42a90ac729ad07d3a539573dc5872a0c6b28a9aa38cca65b7a6b5fd7f3b431e71945efbb532af78eae58ed122d
SSDEEP 96:5Llbss5FBBQbmcIXqSwC+IXq5k69/qiDxvhn:5L1RiSnXPX09x3
MD5 SHA1 SHA512 SSDEEP

Submit Download

cxefv.exe

Path C:\Users\Admin\AppData\Local\Temp\cxefv.exe
Size 5KB
SHA256 038d9c2e5e9bc9260120ee7f0d0aa8f3136bbf5d72a703a023b06b0c8cd9f8a6
MD5 f1cb8abe8e79430bf71eb50e365f89c4
SHA1 cb64a8a1e4363dbe96f76cc5654a3a1531e6f4c1
SHA512 e605f80b44080e150405e9078c81e312dcb31d42a90ac729ad07d3a539573dc5872a0c6b28a9aa38cca65b7a6b5fd7f3b431e71945efbb532af78eae58ed122d
SSDEEP 96:5Llbss5FBBQbmcIXqSwC+IXq5k69/qiDxvhn:5L1RiSnXPX09x3
MD5 SHA1 SHA512 SSDEEP

Submit Download

cxefv.exe

Path C:\Users\Admin\AppData\Local\Temp\cxefv.exe
Size 5KB
SHA256 038d9c2e5e9bc9260120ee7f0d0aa8f3136bbf5d72a703a023b06b0c8cd9f8a6
MD5 f1cb8abe8e79430bf71eb50e365f89c4
SHA1 cb64a8a1e4363dbe96f76cc5654a3a1531e6f4c1
SHA512 e605f80b44080e150405e9078c81e312dcb31d42a90ac729ad07d3a539573dc5872a0c6b28a9aa38cca65b7a6b5fd7f3b431e71945efbb532af78eae58ed122d
SSDEEP 96:5Llbss5FBBQbmcIXqSwC+IXq5k69/qiDxvhn:5L1RiSnXPX09x3
MD5 SHA1 SHA512 SSDEEP

Submit Download

infxqgc

Path C:\Users\Admin\AppData\Local\Temp\infxqgc
Size 5KB
SHA256 e76d15d6b42c09e660e38d2df2acc8d3976fe85158749a6b39ef060f13fc6c6c
MD5 748767ad6e916ab85250c673781d85d6
SHA1 01d08cd5cfd7ee918c7f3d020b2baabe88cb12e4
SHA512 8021daaed04d2c8f448716f4ce602bd9bb878da6a9aae3c99ed38e180d37e2a4e874673c802ed3792e38e9da45c4cc6ffa3f77dbadcc4bbf8ccae3a69cd661ea
SSDEEP 96:+lcWcq+Vx3q82cICywoQT6uOfnOjmI28tGfBRm5kfxWKImfllunLhfCvewU:+iWcqM3a5CtowOfnOjmf8tGfBRm5kfxC
MD5 SHA1 SHA512 SSDEEP

Submit Download

p3wzvvvxx0heljq

Path C:\Users\Admin\AppData\Local\Temp\p3wzvvvxx0heljq
Size 211KB
SHA256 eb846fcb2fcadafd35eec0933dcd97a0860e20da6aadeb8d2de2b0e9915836fd
MD5 b0575003a5f23bf387e82b989f458ff2
SHA1 11a73e6a2f1dfd64b7cfe55717aeea8d21a685ae
SHA512 76423a17ef8123566c0214dc8dabae63d3df80bea597ff5ff653125dc68c332fdcec63ae13953c04d9e99c27a6b61b5609209791fa2bd9cb94a5fbf91f16cf28
SSDEEP 3072:ei3p9PpF1s5pXuAfX833YJHWWMH0JCiJWoW1C0rfU4gcJTM82kC9IFttDO7My:ZdLsfbX8rH0JJhM/rfUNwTrdDiMy
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2844-142-0x0000000002E20000-0x0000000002F05000-memory.dmp

Download

memory/2844-135-0x00000000029C0000-0x0000000002AE2000-memory.dmp

Download

memory/3088-139-0x00000000011A0000-0x00000000011CF000-memory.dmp

Download

memory/3088-141-0x0000000001860000-0x00000000018F3000-memory.dmp

Download

memory/3088-140-0x00000000019D0000-0x0000000001D1A000-memory.dmp

Download

memory/3088-138-0x0000000000D80000-0x0000000000DDA000-memory.dmp

Download

memory/3444-132-0x0000000001220000-0x000000000156A000-memory.dmp

Download

memory/3444-134-0x0000000000CD0000-0x0000000000CE4000-memory.dmp

Download

memory/3444-130-0x0000000000400000-0x000000000042F000-memory.dmp

Download