formbook | 6b19bf1ec55b55f38c00c74fd66dd45c8d7e12eebebca913c4d21152ed0ced8c

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
12/05/2022, 10:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Variant.Jaik.72878.26519.exe
Size 253KB
Sample220512-l83j9sehbj
SHA256 6b19bf1ec55b55f38c00c74fd66dd45c8d7e12eebebca913c4d21152ed0ced8c
MD5 63024416555335f0668d2450f16fed17
SHA1 aa758a0388cbdea9894cc0527e5fb1b9bafbde6a
SHA512 a21a6a07f626c648ff13523a635dd710833c52496a990e70d7734a6c8d9db16da88bf7c9b2c6c7c3d300e9ade2b2c5221aefd6a252391ab7ae8424d4d7b71175
MD5 SHA1 SHA512

Score

10^/10

formbook xloader pvgu loader persistence rat spyware stealer suricata trojan

Malware Config

Extracted

Family

xloader

Version

Campaign

pvgu

Decoy

superrifa.online
nobodylikesbrettmoist.com
proactiveelectropower.com
tees4drip.com
wokaar.com
martino24.com
webcriative.online
huaen-elec.com
nefitegroup.com
occupant-performance.com
retirement-villagesca.com
kyotojimoto.com
bulahmor.com
89151111.com
fridgepoems.com
hookupify.com
coffeehome.info
nakediet.com
binaspro.com
medxglobal.net
wellcarebuckeyehealthplan.com
palishe.com
fabrikamerkezservisim.site
degrangenico.com
halomura.com
devacross.com
boltom.net
wpsafesite.com
liberatechnologies.com
comtvtv.com
health-for-life.pro
commandefriteskorner.com
virginiafarmersmarket.com
emillyematias.com
slvly.com
tfashion.website
zhonghongoil.com
gamemarketcap.xyz
storycrafterscolorado.com
xn--exchat-9jb.com
macralace.online
plywoodmark.com
ncstss.com
45069.email
supercalcu.com
blazefresh.com
nadalbaby.xyz
agapecarenc.net
reich-bau.com
blilbili.com
infinyhost.com
frvquarterly.com
sexforbreakfastpodcast.com
mattfoxart.com
xvidoes.red
imperfectwomanhood.com
hidirlarkoyu.xyz
themenumate.com
greks33.com
vostfrguru.com
saskfarmrealestateagent.com
fateclothingcompany.com
have33645money.xyz
hellotnclub.com
bigboyd.xyz

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
suricata

Xloader Payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/1704-136-0x0000000000400000-0x000000000042B000-memory.dmp	xloader
behavioral2/memory/1704-139-0x0000000000400000-0x000000000042B000-memory.dmp	xloader
behavioral2/memory/396-145-0x0000000000F30000-0x0000000000F5B000-memory.dmp	xloader

Executes dropped EXE 3 IoCs

pid	Process
3060	iyixeam.exe
1704	iyixeam.exe
3780	1b3duf3fl.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	cmstp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UVHDFTBPZDCL = "C:\\Program Files (x86)\\Qrt1\\1b3duf3fl.exe"	cmstp.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3060 set thread context of 1704	3060	iyixeam.exe	84
PID 1704 set thread context of 2044	1704	iyixeam.exe	61
PID 396 set thread context of 2044	396	cmstp.exe	61

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Qrt1\1b3duf3fl.exe	cmstp.exe
File opened for modification	C:\Program Files (x86)\Qrt1	Explorer.EXE
File created	C:\Program Files (x86)\Qrt1\1b3duf3fl.exe	Explorer.EXE
File opened for modification	C:\Program Files (x86)\Qrt1\1b3duf3fl.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4156	3780	WerFault.exe	110

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	cmstp.exe

Suspicious behavior: EnumeratesProcesses 56 IoCs

pid	Process
1704	iyixeam.exe
1704	iyixeam.exe
1704	iyixeam.exe
1704	iyixeam.exe
396	cmstp.exe
396	cmstp.exe
396	cmstp.exe
396	cmstp.exe
396	cmstp.exe
396	cmstp.exe
396	cmstp.exe
396	cmstp.exe
396	cmstp.exe
396	cmstp.exe
396	cmstp.exe
396	cmstp.exe
396	cmstp.exe
396	cmstp.exe
396	cmstp.exe
396	cmstp.exe
396	cmstp.exe
396	cmstp.exe
396	cmstp.exe
396	cmstp.exe
396	cmstp.exe
396	cmstp.exe
396	cmstp.exe
396	cmstp.exe
396	cmstp.exe
396	cmstp.exe
396	cmstp.exe
396	cmstp.exe
396	cmstp.exe
396	cmstp.exe
396	cmstp.exe
396	cmstp.exe
396	cmstp.exe
396	cmstp.exe
396	cmstp.exe
396	cmstp.exe
396	cmstp.exe
396	cmstp.exe
396	cmstp.exe
396	cmstp.exe
396	cmstp.exe
396	cmstp.exe
396	cmstp.exe
396	cmstp.exe
396	cmstp.exe
396	cmstp.exe
396	cmstp.exe
396	cmstp.exe
396	cmstp.exe
396	cmstp.exe
396	cmstp.exe
396	cmstp.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2044	Explorer.EXE

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
1704	iyixeam.exe
1704	iyixeam.exe
1704	iyixeam.exe
396	cmstp.exe
396	cmstp.exe
396	cmstp.exe
396	cmstp.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	1704	iyixeam.exe
Token: SeDebugPrivilege	396	cmstp.exe
Token: SeShutdownPrivilege	2044	Explorer.EXE
Token: SeCreatePagefilePrivilege	2044	Explorer.EXE
Token: SeShutdownPrivilege	2044	Explorer.EXE
Token: SeCreatePagefilePrivilege	2044	Explorer.EXE
Token: SeShutdownPrivilege	2044	Explorer.EXE
Token: SeCreatePagefilePrivilege	2044	Explorer.EXE
Token: SeShutdownPrivilege	2044	Explorer.EXE
Token: SeCreatePagefilePrivilege	2044	Explorer.EXE
Token: SeShutdownPrivilege	2044	Explorer.EXE
Token: SeCreatePagefilePrivilege	2044	Explorer.EXE
Token: SeShutdownPrivilege	2044	Explorer.EXE
Token: SeCreatePagefilePrivilege	2044	Explorer.EXE
Token: SeShutdownPrivilege	2044	Explorer.EXE
Token: SeCreatePagefilePrivilege	2044	Explorer.EXE
Token: SeShutdownPrivilege	2044	Explorer.EXE
Token: SeCreatePagefilePrivilege	2044	Explorer.EXE
Token: SeShutdownPrivilege	2044	Explorer.EXE
Token: SeCreatePagefilePrivilege	2044	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2044	Explorer.EXE
2044	Explorer.EXE

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 3060	4716	SecuriteInfo.com.Variant.Jaik.72878.26519.exe	83
PID 4716 wrote to memory of 3060	4716	SecuriteInfo.com.Variant.Jaik.72878.26519.exe	83
PID 4716 wrote to memory of 3060	4716	SecuriteInfo.com.Variant.Jaik.72878.26519.exe	83
PID 3060 wrote to memory of 1704	3060	iyixeam.exe	84
PID 3060 wrote to memory of 1704	3060	iyixeam.exe	84
PID 3060 wrote to memory of 1704	3060	iyixeam.exe	84
PID 3060 wrote to memory of 1704	3060	iyixeam.exe	84
PID 3060 wrote to memory of 1704	3060	iyixeam.exe	84
PID 3060 wrote to memory of 1704	3060	iyixeam.exe	84
PID 2044 wrote to memory of 396	2044	Explorer.EXE	86
PID 2044 wrote to memory of 396	2044	Explorer.EXE	86
PID 2044 wrote to memory of 396	2044	Explorer.EXE	86
PID 396 wrote to memory of 1952	396	cmstp.exe	89
PID 396 wrote to memory of 1952	396	cmstp.exe	89
PID 396 wrote to memory of 1952	396	cmstp.exe	89
PID 396 wrote to memory of 1200	396	cmstp.exe	104
PID 396 wrote to memory of 1200	396	cmstp.exe	104
PID 396 wrote to memory of 1200	396	cmstp.exe	104
PID 396 wrote to memory of 1928	396	cmstp.exe	106
PID 396 wrote to memory of 1928	396	cmstp.exe	106
PID 396 wrote to memory of 1928	396	cmstp.exe	106
PID 396 wrote to memory of 3040	396	cmstp.exe	108
PID 396 wrote to memory of 3040	396	cmstp.exe	108
PID 396 wrote to memory of 3040	396	cmstp.exe	108
PID 2044 wrote to memory of 3780	2044	Explorer.EXE	110
PID 2044 wrote to memory of 3780	2044	Explorer.EXE	110
PID 2044 wrote to memory of 3780	2044	Explorer.EXE	110

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Jaik.72878.26519.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Jaik.72878.26519.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4716
- - C:\Users\Admin\AppData\Local\Temp\iyixeam.exe
    C:\Users\Admin\AppData\Local\Temp\iyixeam.exe C:\Users\Admin\AppData\Local\Temp\pdapmm
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3060
  - - C:\Users\Admin\AppData\Local\Temp\iyixeam.exe
      C:\Users\Admin\AppData\Local\Temp\iyixeam.exe C:\Users\Admin\AppData\Local\Temp\pdapmm
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:1704
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:1208
- C:\Windows\SysWOW64\cmstp.exe
  "C:\Windows\SysWOW64\cmstp.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:396
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\iyixeam.exe"
    3⤵
    PID:1952
- - C:\Windows\SysWOW64\cmd.exe
    /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
    3⤵
    PID:1200
- - C:\Windows\SysWOW64\cmd.exe
    /c copy "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
    3⤵
    PID:1928
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:3040
- C:\Program Files (x86)\Qrt1\1b3duf3fl.exe
  "C:\Program Files (x86)\Qrt1\1b3duf3fl.exe"
  2⤵
  - Executes dropped EXE
  PID:3780
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3780 -s 472
    3⤵
    - Program crash
    PID:4156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3780 -ip 3780
1⤵
PID:1564

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1b3duf3fl.exe

Path C:\Program Files (x86)\Qrt1\1b3duf3fl.exe
Size 74KB
SHA256 d0e157c7d0d83e0afcbb69086ee435c0efcc000d0ee6df41c4b74cb8e48b9b4a
MD5 bf0da832da5a1d4a0aef89804c5db12d
SHA1 841f94c77712cea23a9012dcdeca6935840a512b
SHA512 c74b592fedea60e4489c4edd02a3d7e6c21ea51f5c846034f90ed133539e7aaae90600f1eab69c3e9cb6b42a61eafcc0187bbadcc69c0b2da59282c654261205
SSDEEP 1536:eIdjKMEbOlas4R3jZdieFEySgiccfXdasWjcd6A3:njab4zY3PiFPdF6A3
MD5 SHA1 SHA512 SSDEEP

Submit Download

1b3duf3fl.exe

Path C:\Program Files (x86)\Qrt1\1b3duf3fl.exe
Size 74KB
SHA256 d0e157c7d0d83e0afcbb69086ee435c0efcc000d0ee6df41c4b74cb8e48b9b4a
MD5 bf0da832da5a1d4a0aef89804c5db12d
SHA1 841f94c77712cea23a9012dcdeca6935840a512b
SHA512 c74b592fedea60e4489c4edd02a3d7e6c21ea51f5c846034f90ed133539e7aaae90600f1eab69c3e9cb6b42a61eafcc0187bbadcc69c0b2da59282c654261205
SSDEEP 1536:eIdjKMEbOlas4R3jZdieFEySgiccfXdasWjcd6A3:njab4zY3PiFPdF6A3
MD5 SHA1 SHA512 SSDEEP

Submit Download

DB1

Path C:\Users\Admin\AppData\Local\Temp\DB1
Size 40KB
SHA256 b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf
MD5 b608d407fc15adea97c26936bc6f03f6
SHA1 953e7420801c76393902c0d6bb56148947e41571
SHA512 cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4
SSDEEP 48:2j3WBA+IIYICVEq8MX0D0HSFlNUK6lGNxGt7KLk8s8LKvUf9KVyJ7hU:u2FCn8MZyFlulGNxGt7KLyeymw
MD5 SHA1 SHA512 SSDEEP

Submit Download

DB1

Path C:\Users\Admin\AppData\Local\Temp\DB1
Size 48KB
SHA256 c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a
MD5 349e6eb110e34a08924d92f6b334801d
SHA1 bdfb289daff51890cc71697b6322aa4b35ec9169
SHA512 2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574
SSDEEP 96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5 SHA1 SHA512 SSDEEP

Submit Download

iyixeam.exe

Path C:\Users\Admin\AppData\Local\Temp\iyixeam.exe
Size 74KB
SHA256 d0e157c7d0d83e0afcbb69086ee435c0efcc000d0ee6df41c4b74cb8e48b9b4a
MD5 bf0da832da5a1d4a0aef89804c5db12d
SHA1 841f94c77712cea23a9012dcdeca6935840a512b
SHA512 c74b592fedea60e4489c4edd02a3d7e6c21ea51f5c846034f90ed133539e7aaae90600f1eab69c3e9cb6b42a61eafcc0187bbadcc69c0b2da59282c654261205
SSDEEP 1536:eIdjKMEbOlas4R3jZdieFEySgiccfXdasWjcd6A3:njab4zY3PiFPdF6A3
MD5 SHA1 SHA512 SSDEEP

Submit Download

iyixeam.exe

Path C:\Users\Admin\AppData\Local\Temp\iyixeam.exe
Size 74KB
SHA256 d0e157c7d0d83e0afcbb69086ee435c0efcc000d0ee6df41c4b74cb8e48b9b4a
MD5 bf0da832da5a1d4a0aef89804c5db12d
SHA1 841f94c77712cea23a9012dcdeca6935840a512b
SHA512 c74b592fedea60e4489c4edd02a3d7e6c21ea51f5c846034f90ed133539e7aaae90600f1eab69c3e9cb6b42a61eafcc0187bbadcc69c0b2da59282c654261205
SSDEEP 1536:eIdjKMEbOlas4R3jZdieFEySgiccfXdasWjcd6A3:njab4zY3PiFPdF6A3
MD5 SHA1 SHA512 SSDEEP

Submit Download

iyixeam.exe

Path C:\Users\Admin\AppData\Local\Temp\iyixeam.exe
Size 74KB
SHA256 d0e157c7d0d83e0afcbb69086ee435c0efcc000d0ee6df41c4b74cb8e48b9b4a
MD5 bf0da832da5a1d4a0aef89804c5db12d
SHA1 841f94c77712cea23a9012dcdeca6935840a512b
SHA512 c74b592fedea60e4489c4edd02a3d7e6c21ea51f5c846034f90ed133539e7aaae90600f1eab69c3e9cb6b42a61eafcc0187bbadcc69c0b2da59282c654261205
SSDEEP 1536:eIdjKMEbOlas4R3jZdieFEySgiccfXdasWjcd6A3:njab4zY3PiFPdF6A3
MD5 SHA1 SHA512 SSDEEP

Submit Download

mmr2z1yud16om0wj

Path C:\Users\Admin\AppData\Local\Temp\mmr2z1yud16om0wj
Size 171KB
SHA256 72a47a136d7b742ed550b8139659e1d044d8024179ffb254829bbf95ae994915
MD5 cbb88021af3c72930935000ebd7240cc
SHA1 5e93c288026883e5ed2eaa8afd864e3f5a150e80
SHA512 490f5acb6578c6c2a51b2bdd0a4e74bc05e80c0ff4ff0db41b7751fba01347572faa04fb50535351b65d8194481bb6c145b9bad9baad9b6ac174cf7963cd62a9
SSDEEP 3072:azIHafq7lKD9vb7/FG5bSwKeKEPZElCITtTYgQOnU324oAm2A5+Rze58Pb:cwWOKD9vH/FGZSLqZEEITtNQgUm5+leM
MD5 SHA1 SHA512 SSDEEP

Submit Download

pdapmm

Path C:\Users\Admin\AppData\Local\Temp\pdapmm
Size 4KB
SHA256 b56f88aa2d6779a793949a0f8d687756c93b32b2cdfc51fd55da1eeb2f1c5dc3
MD5 0a418a223ef209e454e167a6326f941e
SHA1 83fd0520c7e3096fd4b5a393b12006d22aa7e1f0
SHA512 7c15a990108454cf8a057a884f8e8cb630671fce26537fc1fa69928bc4254e18a4565c96c74c3a0b72961ac7a3aba6b42cb43e9f434b681553da71726780fbbb
SSDEEP 96:HCaaWZ1ggnWqUENsTZ2qTtToZrnnwjRS6OLeWKK1peG0Z5wl56KcmmyOreEm:ixWACXNsTZ2sTunE8n56KcDyOCEm
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/396-147-0x0000000003060000-0x00000000033AA000-memory.dmp

Download

memory/396-148-0x0000000002E80000-0x0000000002F10000-memory.dmp

Download

memory/396-144-0x0000000000940000-0x0000000000956000-memory.dmp

Download

memory/396-145-0x0000000000F30000-0x0000000000F5B000-memory.dmp

Download

memory/1704-136-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1704-141-0x0000000000AC0000-0x0000000000AD1000-memory.dmp

Download

memory/1704-140-0x0000000000BF0000-0x0000000000F3A000-memory.dmp

Download

memory/1704-139-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/2044-142-0x0000000008AE0000-0x0000000008BD1000-memory.dmp

Download

memory/2044-149-0x0000000008820000-0x00000000088C3000-memory.dmp

Download