formbook | 434655800ff8d745df2462881f0fe044f2af72512217dd531beffbfea0e2b1a6

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
21/04/2022, 08:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1be8992516510c76e9fde44f9ee1ea75.exe
Size 219KB
Sample220421-kpv6eaeab8
SHA256 434655800ff8d745df2462881f0fe044f2af72512217dd531beffbfea0e2b1a6
MD5 1be8992516510c76e9fde44f9ee1ea75
SHA1 4e82d22440063a440415496e8b34af6330c57312
SHA512 0b6b16e8c3106df063be53f0468849f395c59ddfb87f121900bd34fb4c6406d5b5e9af2aebeb6ea3197671b66ee67fbef0c50013035afc559cb3acf35c5863ba
MD5 SHA1 SHA512

Score

10^/10

formbook xloader ud5f loader persistence rat spyware stealer trojan

Malware Config

Extracted

Family

xloader

Version

Campaign

ud5f

Decoy

qy818.store
my-paypal.online
smartlegalandidprotection.com
powellpromo.com
versatilegems.com
engelskapiste.com
thelocksmithexpo.com
aixiaoka.top
induququyui.com
cheyannejewels.com
mfkplatinum.info
albutrusgips.com
delfinyevent.com
mgbuilldingmaterials.com
ozhomefurniture.com
manifiestoccs.com
theblackbarnfields.com
dazzleside.com
kobaygym.com
xn--evdenifikirleri-e6c.com
csliuxue.com
alwayspositivemood.com
bespokeneedlework.com
apfasteners.com
shyridrel.space
thongcongnghetsaigon24h.com
heartwork.ink
dfyh168.com
empregosbr1.online
12pgslot321.online
linkmainsta.com
buyjoellemonet.com
tsdsbjt.com
accom2012.com
miaglam.com
southwesthuntingadventures.com
liquidationone.com
onlineloanforbadcredit.com
lacimaeventos.com
palisadesskipatrol.com
kushrushmia.com
1upgeekmania.com
xn--2e0br59a7ucquav02b.com
keukentafelrestaurant.store
flossent.com
cleaningservicesearchcan.com
clients-panel.club
ameliastore.online
onetone-design.com
unlimitedsea.com
essaysparlor.com
lokisolutions.biz
trendrelation.com
cxhdflfx.online
arloconstruction.net
lostdevice.xyz
healingyourbodynaturally.com
physiocare-ye.com
realhindisexkahani.com
doyleloghomes.info
rugisdh.com
devnetsecops.com
degengains.com
healthcarerevamped.com
deirdremoncy.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/4472-136-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/4472-139-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/1612-146-0x0000000001080000-0x00000000010A9000-memory.dmp	xloader

Executes dropped EXE 3 IoCs

pid	Process
4716	zogoai.exe
4472	zogoai.exe
4860	spz9rf0lv5.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\L2RTI2EXXVE = "C:\\Program Files (x86)\\Tobmd\\spz9rf0lv5.exe"	svchost.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4716 set thread context of 4472	4716	zogoai.exe	82
PID 4472 set thread context of 3004	4472	zogoai.exe	48
PID 1612 set thread context of 3004	1612	svchost.exe	48

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Tobmd	Explorer.EXE
File created	C:\Program Files (x86)\Tobmd\spz9rf0lv5.exe	Explorer.EXE
File opened for modification	C:\Program Files (x86)\Tobmd\spz9rf0lv5.exe	Explorer.EXE
File opened for modification	C:\Program Files (x86)\Tobmd\spz9rf0lv5.exe	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3472	4860	WerFault.exe	92

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	svchost.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
4472	zogoai.exe
4472	zogoai.exe
4472	zogoai.exe
4472	zogoai.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3004	Explorer.EXE

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
4472	zogoai.exe
4472	zogoai.exe
4472	zogoai.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4472	zogoai.exe
Token: SeDebugPrivilege	1612	svchost.exe
Token: SeShutdownPrivilege	3004	Explorer.EXE
Token: SeCreatePagefilePrivilege	3004	Explorer.EXE

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4304 wrote to memory of 4716	4304	1be8992516510c76e9fde44f9ee1ea75.exe	81
PID 4304 wrote to memory of 4716	4304	1be8992516510c76e9fde44f9ee1ea75.exe	81
PID 4304 wrote to memory of 4716	4304	1be8992516510c76e9fde44f9ee1ea75.exe	81
PID 4716 wrote to memory of 4472	4716	zogoai.exe	82
PID 4716 wrote to memory of 4472	4716	zogoai.exe	82
PID 4716 wrote to memory of 4472	4716	zogoai.exe	82
PID 4716 wrote to memory of 4472	4716	zogoai.exe	82
PID 4716 wrote to memory of 4472	4716	zogoai.exe	82
PID 4716 wrote to memory of 4472	4716	zogoai.exe	82
PID 3004 wrote to memory of 1612	3004	Explorer.EXE	83
PID 3004 wrote to memory of 1612	3004	Explorer.EXE	83
PID 3004 wrote to memory of 1612	3004	Explorer.EXE	83
PID 1612 wrote to memory of 2488	1612	svchost.exe	84
PID 1612 wrote to memory of 2488	1612	svchost.exe	84
PID 1612 wrote to memory of 2488	1612	svchost.exe	84
PID 1612 wrote to memory of 228	1612	svchost.exe	89
PID 1612 wrote to memory of 228	1612	svchost.exe	89
PID 1612 wrote to memory of 228	1612	svchost.exe	89
PID 1612 wrote to memory of 4808	1612	svchost.exe	91
PID 1612 wrote to memory of 4808	1612	svchost.exe	91
PID 3004 wrote to memory of 4860	3004	Explorer.EXE	92
PID 3004 wrote to memory of 4860	3004	Explorer.EXE	92
PID 3004 wrote to memory of 4860	3004	Explorer.EXE	92
PID 1612 wrote to memory of 4808	1612	svchost.exe	91

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Users\Admin\AppData\Local\Temp\1be8992516510c76e9fde44f9ee1ea75.exe
  "C:\Users\Admin\AppData\Local\Temp\1be8992516510c76e9fde44f9ee1ea75.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4304
- - C:\Users\Admin\AppData\Local\Temp\zogoai.exe
    C:\Users\Admin\AppData\Local\Temp\zogoai.exe C:\Users\Admin\AppData\Local\Temp\hbcmtki
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4716
  - - C:\Users\Admin\AppData\Local\Temp\zogoai.exe
      C:\Users\Admin\AppData\Local\Temp\zogoai.exe C:\Users\Admin\AppData\Local\Temp\hbcmtki
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:4472
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\SysWOW64\svchost.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1612
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\zogoai.exe"
    3⤵
    PID:2488
- - C:\Windows\SysWOW64\cmd.exe
    /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
    3⤵
    PID:228
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:4808
- C:\Program Files (x86)\Tobmd\spz9rf0lv5.exe
  "C:\Program Files (x86)\Tobmd\spz9rf0lv5.exe"
  2⤵
  - Executes dropped EXE
  PID:4860
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4860 -s 452
    3⤵
    - Program crash
    PID:3472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4860 -ip 4860
1⤵
PID:2128

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

spz9rf0lv5.exe

Path C:\Program Files (x86)\Tobmd\spz9rf0lv5.exe
Size 64KB
SHA256 d0976266bc8ecea457880dd408a41febf842e6142de40e11514350a7ac23b9bf
MD5 530778446a3131074ac2243502e09a3a
SHA1 004ae9d78d78da287fed352e8231e18ee5f62612
SHA512 0b339780c2a109e4c46692dcce07388ce4039ba1d7b7921f3f94b5260e3152eb3596f4a013de7e2ee7cbb155ee8d579f0d6b1e30d96114cb005d3f728785dd23
SSDEEP 768:ZnIazzX/zQVUzIU3qbow0b61rbnuvle0jQbawiBoNKtc8WhsWjcdqjC+9Vr:9Dcgq0Zb+wlceZc8EsWjcdqz
MD5 SHA1 SHA512 SSDEEP

Submit Download

spz9rf0lv5.exe

Path C:\Program Files (x86)\Tobmd\spz9rf0lv5.exe
Size 64KB
SHA256 d0976266bc8ecea457880dd408a41febf842e6142de40e11514350a7ac23b9bf
MD5 530778446a3131074ac2243502e09a3a
SHA1 004ae9d78d78da287fed352e8231e18ee5f62612
SHA512 0b339780c2a109e4c46692dcce07388ce4039ba1d7b7921f3f94b5260e3152eb3596f4a013de7e2ee7cbb155ee8d579f0d6b1e30d96114cb005d3f728785dd23
SSDEEP 768:ZnIazzX/zQVUzIU3qbow0b61rbnuvle0jQbawiBoNKtc8WhsWjcdqjC+9Vr:9Dcgq0Zb+wlceZc8EsWjcdqz
MD5 SHA1 SHA512 SSDEEP

Submit Download

DB1

Path C:\Users\Admin\AppData\Local\Temp\DB1
Size 40KB
SHA256 b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf
MD5 b608d407fc15adea97c26936bc6f03f6
SHA1 953e7420801c76393902c0d6bb56148947e41571
SHA512 cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4
SSDEEP 48:2j3WBA+IIYICVEq8MX0D0HSFlNUK6lGNxGt7KLk8s8LKvUf9KVyJ7hU:u2FCn8MZyFlulGNxGt7KLyeymw
MD5 SHA1 SHA512 SSDEEP

Submit Download

ahe92lnp47617jl8y0w8

Path C:\Users\Admin\AppData\Local\Temp\ahe92lnp47617jl8y0w8
Size 163KB
SHA256 e2a5bb3397f7c9d2bf25afe7aa29a3c6b0892badeb834a964f6c7544926eedbd
MD5 154c3aa446a0fa6b79636a0872705905
SHA1 03578c085f93dc48d5b6b55bee06b81bd557ada7
SHA512 01f341b56e3e86b09a33f34c4df21fcd7edb9971b03c1a96edcae662b1d43b442ab615ff555b42d960c4272bbdfdddffb3548111197d1d9c4466a09eae6cf8fe
SSDEEP 3072:S+ZOC2qW7UXqVdDZj9dk7HP8ZLWqviofhpONRL:TO3KXuDndk7HUZiqF3ON1
MD5 SHA1 SHA512 SSDEEP

Submit Download

hbcmtki

Path C:\Users\Admin\AppData\Local\Temp\hbcmtki
Size 5KB
SHA256 68ed484763638541799b619192da1adfb52059e3671b502ee32da1572683d7b7
MD5 cd784baf2d6a8d34e59e8f2e7e1e3c81
SHA1 81963d9f6c66f6120cda7c3f7ecc3cb2c9fa2c96
SHA512 f845e9f862ee7e1722f4415197758508ce7311a43f3c4d71a2125a91577354882c09804086614a5f28471e3c6f8257108a28a80cda6d4ca2c5da7bc5d2fc2c48
SSDEEP 96:bG/+/HK5CJgzQTi8xXXgZVEzrqAqDvDPqCGpXknzKnSughTQ1LR84CkgpH27:a+9esTTxXXqVa+zsXDS54CkeU
MD5 SHA1 SHA512 SSDEEP

Submit Download

zogoai.exe

Path C:\Users\Admin\AppData\Local\Temp\zogoai.exe
Size 64KB
SHA256 d0976266bc8ecea457880dd408a41febf842e6142de40e11514350a7ac23b9bf
MD5 530778446a3131074ac2243502e09a3a
SHA1 004ae9d78d78da287fed352e8231e18ee5f62612
SHA512 0b339780c2a109e4c46692dcce07388ce4039ba1d7b7921f3f94b5260e3152eb3596f4a013de7e2ee7cbb155ee8d579f0d6b1e30d96114cb005d3f728785dd23
SSDEEP 768:ZnIazzX/zQVUzIU3qbow0b61rbnuvle0jQbawiBoNKtc8WhsWjcdqjC+9Vr:9Dcgq0Zb+wlceZc8EsWjcdqz
MD5 SHA1 SHA512 SSDEEP

Submit Download

zogoai.exe

Path C:\Users\Admin\AppData\Local\Temp\zogoai.exe
Size 64KB
SHA256 d0976266bc8ecea457880dd408a41febf842e6142de40e11514350a7ac23b9bf
MD5 530778446a3131074ac2243502e09a3a
SHA1 004ae9d78d78da287fed352e8231e18ee5f62612
SHA512 0b339780c2a109e4c46692dcce07388ce4039ba1d7b7921f3f94b5260e3152eb3596f4a013de7e2ee7cbb155ee8d579f0d6b1e30d96114cb005d3f728785dd23
SSDEEP 768:ZnIazzX/zQVUzIU3qbow0b61rbnuvle0jQbawiBoNKtc8WhsWjcdqjC+9Vr:9Dcgq0Zb+wlceZc8EsWjcdqz
MD5 SHA1 SHA512 SSDEEP

Submit Download

zogoai.exe

Path C:\Users\Admin\AppData\Local\Temp\zogoai.exe
Size 64KB
SHA256 d0976266bc8ecea457880dd408a41febf842e6142de40e11514350a7ac23b9bf
MD5 530778446a3131074ac2243502e09a3a
SHA1 004ae9d78d78da287fed352e8231e18ee5f62612
SHA512 0b339780c2a109e4c46692dcce07388ce4039ba1d7b7921f3f94b5260e3152eb3596f4a013de7e2ee7cbb155ee8d579f0d6b1e30d96114cb005d3f728785dd23
SSDEEP 768:ZnIazzX/zQVUzIU3qbow0b61rbnuvle0jQbawiBoNKtc8WhsWjcdqjC+9Vr:9Dcgq0Zb+wlceZc8EsWjcdqz
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1612-146-0x0000000001080000-0x00000000010A9000-memory.dmp

Download

memory/1612-148-0x0000000001A00000-0x0000000001A90000-memory.dmp

Download

memory/1612-145-0x0000000001B00000-0x0000000001E4A000-memory.dmp

Download

memory/1612-144-0x00000000000B0000-0x00000000000BE000-memory.dmp

Download

memory/3004-149-0x00000000029C0000-0x0000000002A54000-memory.dmp

Download

memory/3004-142-0x0000000002900000-0x00000000029BB000-memory.dmp

Download

memory/4472-141-0x00000000005C0000-0x00000000005D1000-memory.dmp

Download

memory/4472-140-0x0000000000AE0000-0x0000000000E2A000-memory.dmp

Download

memory/4472-139-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4472-136-0x0000000000400000-0x0000000000429000-memory.dmp

Download