formbook | 9afa5a53a2f68b1eb6dcc22a14b1b23e03b02da4a5501d7e7cbcb0a4d694f55d

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
23/04/2022, 06:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
914134bcfe78473c6647d785ceea3235.exe
Size 562KB
Sample220423-g7rddsage4
SHA256 9afa5a53a2f68b1eb6dcc22a14b1b23e03b02da4a5501d7e7cbcb0a4d694f55d
MD5 914134bcfe78473c6647d785ceea3235
SHA1 791ea911e79bf1768916ca599ca4cc5a9f2a8817
SHA512 8c01141c408aee459452c1d30dd4d5e2b2ced2552f35076a3213d632fe9ce253fdae4584f395ce69f29b772c1c25c4972d8a802aa6328baff4e79baf2d935b6d
MD5 SHA1 SHA512

Score

10^/10

formbook xloader c0a7 loader persistence rat spyware stealer trojan

Malware Config

Extracted

Family

xloader

Version

Campaign

c0a7

Decoy

nielsqanalytics.net
mmgaleria.com
rejection.xyz
lehome.store
dijaminoriginal.online
matthewwickersham.com
maanetv.com
instantsave.net
888dj8v.com
behere.xyz
deeperthanmotivation.com
shoponly7seconds.com
bohemiabougies.com
cyrusthegreatbarber.com
liftizy.com
kcarats.com
egremlinart.com
karbonkorea.com
syedaakanwal.xyz
campikitai.today
fansoflambsanfrancisco.com
carpesntertechnology.com
platnumcafelounge.com
pulseoftheworld.net
raubdruck.city
omamori-doing.com
cfepublishing.com
delaware-remodeling.com
beautybomb20.com
tzc.vin
afrimultitrade.com
mialhicandles.com
briskiance.com
housederoyale.com
eazlabor.net
gutimautpribuinrop.com
likesubfb567.xyz
cbdmedicinal.lat
msnkcp.biz
the-called.com
rugisdh.com
fototorcal.com
shellthatsells.com
sweetdreamscattery.com
leumj-loqin.com
uzqexport.com
gukuiwuzi.com
skinnails.com
homeveta.com
sathapornstainlesssteel.com
finikeapartotel.com
space-force.biz
akoya-kyoto.com
klubbio.online
teasebrink.agency
markamagency.com
christensen-physiotherapie.com
skinoilcapsules.com
percentrostered.net
uloveclub.com
evbrandaid.com
primojavera.quest
bigceme5.com
abedbashir.tech
gsttxx.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/2756-136-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/2360-145-0x0000000000710000-0x0000000000739000-memory.dmp	xloader

Executes dropped EXE 3 IoCs

pid	Process
1236	kgqres.exe
2756	kgqres.exe
344	hp0l_rzpadj8qd5h.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UV1HFX6P1P = "C:\\Program Files (x86)\\M-zjd\\hp0l_rzpadj8qd5h.exe"	chkdsk.exe
Key created	\Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	chkdsk.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1236 set thread context of 2756	1236	kgqres.exe	82
PID 2756 set thread context of 3144	2756	kgqres.exe	55
PID 2360 set thread context of 3144	2360	chkdsk.exe	55

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\M-zjd\hp0l_rzpadj8qd5h.exe	chkdsk.exe
File opened for modification	C:\Program Files (x86)\M-zjd	Explorer.EXE
File created	C:\Program Files (x86)\M-zjd\hp0l_rzpadj8qd5h.exe	Explorer.EXE
File opened for modification	C:\Program Files (x86)\M-zjd\hp0l_rzpadj8qd5h.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2404	344	WerFault.exe	96

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	chkdsk.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	chkdsk.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
2756	kgqres.exe
2756	kgqres.exe
2756	kgqres.exe
2756	kgqres.exe
2360	chkdsk.exe
2360	chkdsk.exe
2360	chkdsk.exe
2360	chkdsk.exe
2360	chkdsk.exe
2360	chkdsk.exe
2360	chkdsk.exe
2360	chkdsk.exe
2360	chkdsk.exe
2360	chkdsk.exe
2360	chkdsk.exe
2360	chkdsk.exe
2360	chkdsk.exe
2360	chkdsk.exe
2360	chkdsk.exe
2360	chkdsk.exe
2360	chkdsk.exe
2360	chkdsk.exe
2360	chkdsk.exe
2360	chkdsk.exe
2360	chkdsk.exe
2360	chkdsk.exe
2360	chkdsk.exe
2360	chkdsk.exe
2360	chkdsk.exe
2360	chkdsk.exe
2360	chkdsk.exe
2360	chkdsk.exe
2360	chkdsk.exe
2360	chkdsk.exe
2360	chkdsk.exe
2360	chkdsk.exe
2360	chkdsk.exe
2360	chkdsk.exe
2360	chkdsk.exe
2360	chkdsk.exe
2360	chkdsk.exe
2360	chkdsk.exe
2360	chkdsk.exe
2360	chkdsk.exe
2360	chkdsk.exe
2360	chkdsk.exe
2360	chkdsk.exe
2360	chkdsk.exe
2360	chkdsk.exe
2360	chkdsk.exe
2360	chkdsk.exe
2360	chkdsk.exe
2360	chkdsk.exe
2360	chkdsk.exe
2360	chkdsk.exe
2360	chkdsk.exe
2360	chkdsk.exe
2360	chkdsk.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3144	Explorer.EXE

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
2756	kgqres.exe
2756	kgqres.exe
2756	kgqres.exe
2360	chkdsk.exe
2360	chkdsk.exe
2360	chkdsk.exe
2360	chkdsk.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2756	kgqres.exe
Token: SeDebugPrivilege	2360	chkdsk.exe
Token: SeShutdownPrivilege	3144	Explorer.EXE
Token: SeCreatePagefilePrivilege	3144	Explorer.EXE

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 1236	4748	914134bcfe78473c6647d785ceea3235.exe	81
PID 4748 wrote to memory of 1236	4748	914134bcfe78473c6647d785ceea3235.exe	81
PID 4748 wrote to memory of 1236	4748	914134bcfe78473c6647d785ceea3235.exe	81
PID 1236 wrote to memory of 2756	1236	kgqres.exe	82
PID 1236 wrote to memory of 2756	1236	kgqres.exe	82
PID 1236 wrote to memory of 2756	1236	kgqres.exe	82
PID 1236 wrote to memory of 2756	1236	kgqres.exe	82
PID 1236 wrote to memory of 2756	1236	kgqres.exe	82
PID 1236 wrote to memory of 2756	1236	kgqres.exe	82
PID 3144 wrote to memory of 2360	3144	Explorer.EXE	83
PID 3144 wrote to memory of 2360	3144	Explorer.EXE	83
PID 3144 wrote to memory of 2360	3144	Explorer.EXE	83
PID 2360 wrote to memory of 2872	2360	chkdsk.exe	87
PID 2360 wrote to memory of 2872	2360	chkdsk.exe	87
PID 2360 wrote to memory of 2872	2360	chkdsk.exe	87
PID 2360 wrote to memory of 1704	2360	chkdsk.exe	93
PID 2360 wrote to memory of 1704	2360	chkdsk.exe	93
PID 2360 wrote to memory of 1704	2360	chkdsk.exe	93
PID 2360 wrote to memory of 220	2360	chkdsk.exe	95
PID 2360 wrote to memory of 220	2360	chkdsk.exe	95
PID 3144 wrote to memory of 344	3144	Explorer.EXE	96
PID 3144 wrote to memory of 344	3144	Explorer.EXE	96
PID 3144 wrote to memory of 344	3144	Explorer.EXE	96
PID 2360 wrote to memory of 220	2360	chkdsk.exe	95

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3144
- C:\Users\Admin\AppData\Local\Temp\914134bcfe78473c6647d785ceea3235.exe
  "C:\Users\Admin\AppData\Local\Temp\914134bcfe78473c6647d785ceea3235.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4748
- - C:\Users\Admin\AppData\Local\Temp\kgqres.exe
    C:\Users\Admin\AppData\Local\Temp\kgqres.exe C:\Users\Admin\AppData\Local\Temp\vvbpeobi
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1236
  - - C:\Users\Admin\AppData\Local\Temp\kgqres.exe
      C:\Users\Admin\AppData\Local\Temp\kgqres.exe C:\Users\Admin\AppData\Local\Temp\vvbpeobi
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:2756
- C:\Windows\SysWOW64\chkdsk.exe
  "C:\Windows\SysWOW64\chkdsk.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2360
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\kgqres.exe"
    3⤵
    PID:2872
- - C:\Windows\SysWOW64\cmd.exe
    /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
    3⤵
    PID:1704
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:220
- C:\Program Files (x86)\M-zjd\hp0l_rzpadj8qd5h.exe
  "C:\Program Files (x86)\M-zjd\hp0l_rzpadj8qd5h.exe"
  2⤵
  - Executes dropped EXE
  PID:344
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 344 -s 452
    3⤵
    - Program crash
    PID:2404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 344 -ip 344
1⤵
PID:3952

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hp0l_rzpadj8qd5h.exe

Path C:\Program Files (x86)\M-zjd\hp0l_rzpadj8qd5h.exe
Size 65KB
SHA256 d108dc0094a0c49cf2029bf294a91bff7ea3792f6e773c011e32fb602192f387
MD5 6f75a2f757e1c70b73f2a0a9bceac055
SHA1 94828432567c81eac44be9b479b6041a43f3affa
SHA512 edfc9fe587ee6ed7ecfb0643c261d97880892b0499ee02de929d841f0cfdc6443721d11ea224de4d49e0d4f3ee887b6bb845b2320ca3367d549b938a323091ef
SSDEEP 768:pQXCBhu5b4o2Tl/qSo8w+bSZ7OnuvQ7n0bnb9iBKaDNKtc8WTsWjcd6aXk+9t:LzFqSxvblwQ7S+Kagc8qsWjcd6al
MD5 SHA1 SHA512 SSDEEP

Submit Download

hp0l_rzpadj8qd5h.exe

Path C:\Program Files (x86)\M-zjd\hp0l_rzpadj8qd5h.exe
Size 65KB
SHA256 d108dc0094a0c49cf2029bf294a91bff7ea3792f6e773c011e32fb602192f387
MD5 6f75a2f757e1c70b73f2a0a9bceac055
SHA1 94828432567c81eac44be9b479b6041a43f3affa
SHA512 edfc9fe587ee6ed7ecfb0643c261d97880892b0499ee02de929d841f0cfdc6443721d11ea224de4d49e0d4f3ee887b6bb845b2320ca3367d549b938a323091ef
SSDEEP 768:pQXCBhu5b4o2Tl/qSo8w+bSZ7OnuvQ7n0bnb9iBKaDNKtc8WTsWjcd6aXk+9t:LzFqSxvblwQ7S+Kagc8qsWjcd6al
MD5 SHA1 SHA512 SSDEEP

Submit Download

DB1

Path C:\Users\Admin\AppData\Local\Temp\DB1
Size 40KB
SHA256 b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf
MD5 b608d407fc15adea97c26936bc6f03f6
SHA1 953e7420801c76393902c0d6bb56148947e41571
SHA512 cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4
SSDEEP 48:2j3WBA+IIYICVEq8MX0D0HSFlNUK6lGNxGt7KLk8s8LKvUf9KVyJ7hU:u2FCn8MZyFlulGNxGt7KLyeymw
MD5 SHA1 SHA512 SSDEEP

Submit Download

kgqres.exe

Path C:\Users\Admin\AppData\Local\Temp\kgqres.exe
Size 65KB
SHA256 d108dc0094a0c49cf2029bf294a91bff7ea3792f6e773c011e32fb602192f387
MD5 6f75a2f757e1c70b73f2a0a9bceac055
SHA1 94828432567c81eac44be9b479b6041a43f3affa
SHA512 edfc9fe587ee6ed7ecfb0643c261d97880892b0499ee02de929d841f0cfdc6443721d11ea224de4d49e0d4f3ee887b6bb845b2320ca3367d549b938a323091ef
SSDEEP 768:pQXCBhu5b4o2Tl/qSo8w+bSZ7OnuvQ7n0bnb9iBKaDNKtc8WTsWjcd6aXk+9t:LzFqSxvblwQ7S+Kagc8qsWjcd6al
MD5 SHA1 SHA512 SSDEEP

Submit Download

kgqres.exe

Path C:\Users\Admin\AppData\Local\Temp\kgqres.exe
Size 65KB
SHA256 d108dc0094a0c49cf2029bf294a91bff7ea3792f6e773c011e32fb602192f387
MD5 6f75a2f757e1c70b73f2a0a9bceac055
SHA1 94828432567c81eac44be9b479b6041a43f3affa
SHA512 edfc9fe587ee6ed7ecfb0643c261d97880892b0499ee02de929d841f0cfdc6443721d11ea224de4d49e0d4f3ee887b6bb845b2320ca3367d549b938a323091ef
SSDEEP 768:pQXCBhu5b4o2Tl/qSo8w+bSZ7OnuvQ7n0bnb9iBKaDNKtc8WTsWjcd6aXk+9t:LzFqSxvblwQ7S+Kagc8qsWjcd6al
MD5 SHA1 SHA512 SSDEEP

Submit Download

kgqres.exe

Path C:\Users\Admin\AppData\Local\Temp\kgqres.exe
Size 65KB
SHA256 d108dc0094a0c49cf2029bf294a91bff7ea3792f6e773c011e32fb602192f387
MD5 6f75a2f757e1c70b73f2a0a9bceac055
SHA1 94828432567c81eac44be9b479b6041a43f3affa
SHA512 edfc9fe587ee6ed7ecfb0643c261d97880892b0499ee02de929d841f0cfdc6443721d11ea224de4d49e0d4f3ee887b6bb845b2320ca3367d549b938a323091ef
SSDEEP 768:pQXCBhu5b4o2Tl/qSo8w+bSZ7OnuvQ7n0bnb9iBKaDNKtc8WTsWjcd6aXk+9t:LzFqSxvblwQ7S+Kagc8qsWjcd6al
MD5 SHA1 SHA512 SSDEEP

Submit Download

tr89gs5nux

Path C:\Users\Admin\AppData\Local\Temp\tr89gs5nux
Size 163KB
SHA256 123f91969248cde69248a315263882acf6de4d32ead6dc26022fd784c9629cf8
MD5 3ae847a18d30c84e54058bfaa0b07d51
SHA1 be2959d15214aa7d6e683d55132d8f7de66970e7
SHA512 18f848a1ac7b9a29a857888bf94f20fbad36c5bfad7edf3fb4dcc8420354b1e6f9c8e86ea08be83e4369587f89c66cae65002ea555d1775250c2cc8fc773f097
SSDEEP 3072:XxOT8e2+Yv+G09dX/Mire35IoZWfbmTa9Sg7v/GVZM0Xh3cLD/WaxDwt:XxZeb99dE8ep/w2g7mVu+atwt
MD5 SHA1 SHA512 SSDEEP

Submit Download

vvbpeobi

Path C:\Users\Admin\AppData\Local\Temp\vvbpeobi
Size 4KB
SHA256 af0ef0f85516e62f818aebf213cb449f605595c73bb28a513405d281346c7eeb
MD5 b791bf8d7de6f1c66a7283108962ee7b
SHA1 779b6bd20790a7da0a508068d3a2302bd2f3a593
SHA512 ca26b94743d77920e0c5654a7fca64af016229854532e27a7ea7a3f3fbd7bce664772b2c7a3ed97f5623a49b67ecc18c4bbf6520e9923c17ecefd95c9e7c633b
SSDEEP 48:FBUF6NgnWmalDpqs4iLdOUiX0x3EMZwnM/tyQh2VB8nSJxoWX8amrSYuajTJrhNL:PUFFL4dZwnM/tyQqBMSJfiJrJrbV7bWs
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2360-147-0x0000000000E50000-0x0000000000EE0000-memory.dmp

Download

memory/2360-145-0x0000000000710000-0x0000000000739000-memory.dmp

Download

memory/2360-144-0x00000000001A0000-0x00000000001AA000-memory.dmp

Download

memory/2360-146-0x0000000001000000-0x000000000134A000-memory.dmp

Download

memory/2756-140-0x0000000000E00000-0x0000000000E11000-memory.dmp

Download

memory/2756-139-0x00000000009A0000-0x0000000000CEA000-memory.dmp

Download

memory/2756-136-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3144-148-0x0000000002990000-0x0000000002AEE000-memory.dmp

Download

memory/3144-141-0x00000000028A0000-0x0000000002987000-memory.dmp

Download