formbook | 7f9ead41557a685c5f7cd82c6607d7bbe98397bf87cf04be8e7e7e13bea41938

Analysis

max time kernel
148s
max time network
152s
platform
windows7_x64
resource
win7-20220414-en
submitted
20/05/2022, 13:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
588e64f0cecb7be8ffb253782164867b.exe
Size 209KB
Sample220520-qkhbmsgdgr
SHA256 7f9ead41557a685c5f7cd82c6607d7bbe98397bf87cf04be8e7e7e13bea41938
MD5 588e64f0cecb7be8ffb253782164867b
SHA1 07680b353cdc696bece3f891f0a6a73c9087edce
SHA512 db3b3411b080ed1f3cfacb5ae7446499a8250d24551a468d50c0059c614ac2692962d14ac33bec5880278727b396b290bcf519c895a309076119b0e30cdf1eff
MD5 SHA1 SHA512

Score

10^/10

formbook r75h rat spyware stealer suricata trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

r75h

Decoy

prvzz.xyz
jhh9999.com
myshellsnaturals.com
kaminemper.xyz
whatongodsgreedearth.com
xiaoxinyan.com
bruv.media
solarpenels-es-open.site
cymail.ca
viaplan.site
a2700ou.com
klinkai.com
e2ojcduey3b1.xyz
summerfarm.site
justlable.store
burghwallisjubilee.com
kangarooblog2022.com
graficaolimpo.com
hjsdsgtdfg.xyz
keezelevenrsa.xyz
caseynevaeh.xyz
calender.pro
paysoshomozwv.xyz
beccashop.com
b0jpt2.xyz
betscorestips.store
foreignbills4u.com
dignitycareatoasis.com
milktowngoats.com
elijahchairs.com
yhllwyj.xyz
magicalmeta.xyz
elusiveminds.institute
onenight19.com
bestpremiumwordpressthemes.com
brightstonexm.com
southwestfloridamattress.com
wanderlabs.media
idiotideas.com
t4yhofie0.xyz
voice-of-april.com
feelmypayne.com
istanbulhikayeleri.com
navlgatorkcy.website
beijinghongritianchuang.site
phemsoq.xyz
redeemliquor.com
modocinema.com
donutprints.info
malerbetriebbock.com
akimotrade.com
yeavaneu.xyz
digitaliseringsstyrelsen.xyz
ib-moneta-zmrazeny.info
explainedpro.com
xdygu.xyz
ozdemirdtm.com
godhcf.xyz
openerlotion.site
7477a.xyz
penguinmoonwalker.com
matchperfeito.com
fqvsi.xyz
grandudes.com
zy.company

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Formbook Payload 4 IoCs

rat

resource	yara_rule
behavioral1/memory/1524-64-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1524-65-0x000000000041F130-mapping.dmp	formbook
behavioral1/memory/1524-68-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1376-76-0x00000000000C0000-0x00000000000EF000-memory.dmp	formbook

Executes dropped EXE 2 IoCs

pid	Process
1120	hrtmb.exe
1524	hrtmb.exe

Loads dropped DLL 3 IoCs

pid	Process
872	588e64f0cecb7be8ffb253782164867b.exe
872	588e64f0cecb7be8ffb253782164867b.exe
1120	hrtmb.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1120 set thread context of 1524	1120	hrtmb.exe	29
PID 1524 set thread context of 1292	1524	hrtmb.exe	14
PID 1376 set thread context of 1292	1376	ipconfig.exe	14

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command-Line Interface

T1059

pid	Process
1376	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
1524	hrtmb.exe
1524	hrtmb.exe
1376	ipconfig.exe
1376	ipconfig.exe
1376	ipconfig.exe
1376	ipconfig.exe
1376	ipconfig.exe
1376	ipconfig.exe
1376	ipconfig.exe
1376	ipconfig.exe
1376	ipconfig.exe
1376	ipconfig.exe
1376	ipconfig.exe
1376	ipconfig.exe
1376	ipconfig.exe
1376	ipconfig.exe
1376	ipconfig.exe
1376	ipconfig.exe
1376	ipconfig.exe
1376	ipconfig.exe
1376	ipconfig.exe
1376	ipconfig.exe
1376	ipconfig.exe
1376	ipconfig.exe
1376	ipconfig.exe
1376	ipconfig.exe
1376	ipconfig.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
1524	hrtmb.exe
1524	hrtmb.exe
1524	hrtmb.exe
1376	ipconfig.exe
1376	ipconfig.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1524	hrtmb.exe
Token: SeDebugPrivilege	1376	ipconfig.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1292	Explorer.EXE
1292	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1292	Explorer.EXE
1292	Explorer.EXE

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 872 wrote to memory of 1120	872	588e64f0cecb7be8ffb253782164867b.exe	28
PID 872 wrote to memory of 1120	872	588e64f0cecb7be8ffb253782164867b.exe	28
PID 872 wrote to memory of 1120	872	588e64f0cecb7be8ffb253782164867b.exe	28
PID 872 wrote to memory of 1120	872	588e64f0cecb7be8ffb253782164867b.exe	28
PID 1120 wrote to memory of 1524	1120	hrtmb.exe	29
PID 1120 wrote to memory of 1524	1120	hrtmb.exe	29
PID 1120 wrote to memory of 1524	1120	hrtmb.exe	29
PID 1120 wrote to memory of 1524	1120	hrtmb.exe	29
PID 1120 wrote to memory of 1524	1120	hrtmb.exe	29
PID 1120 wrote to memory of 1524	1120	hrtmb.exe	29
PID 1120 wrote to memory of 1524	1120	hrtmb.exe	29
PID 1292 wrote to memory of 1376	1292	Explorer.EXE	30
PID 1292 wrote to memory of 1376	1292	Explorer.EXE	30
PID 1292 wrote to memory of 1376	1292	Explorer.EXE	30
PID 1292 wrote to memory of 1376	1292	Explorer.EXE	30
PID 1376 wrote to memory of 948	1376	ipconfig.exe	31
PID 1376 wrote to memory of 948	1376	ipconfig.exe	31
PID 1376 wrote to memory of 948	1376	ipconfig.exe	31
PID 1376 wrote to memory of 948	1376	ipconfig.exe	31

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Users\Admin\AppData\Local\Temp\588e64f0cecb7be8ffb253782164867b.exe
  "C:\Users\Admin\AppData\Local\Temp\588e64f0cecb7be8ffb253782164867b.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:872
- - C:\Users\Admin\AppData\Local\Temp\hrtmb.exe
    C:\Users\Admin\AppData\Local\Temp\hrtmb.exe C:\Users\Admin\AppData\Local\Temp\bxhfn
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1120
  - - C:\Users\Admin\AppData\Local\Temp\hrtmb.exe
      C:\Users\Admin\AppData\Local\Temp\hrtmb.exe C:\Users\Admin\AppData\Local\Temp\bxhfn
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:1524
- C:\Windows\SysWOW64\ipconfig.exe
  "C:\Windows\SysWOW64\ipconfig.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Gathers network information
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1376
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\hrtmb.exe"
    3⤵
    PID:948

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

afy7cbsqdzzlq5ud0

Path C:\Users\Admin\AppData\Local\Temp\afy7cbsqdzzlq5ud0
Size 184KB
SHA256 d3d766a35f0d10ab029b4e978851f6e2ed2e08c59feaca21f4a8fe60ab8cedab
MD5 8dc56b738db64fe02a247daefec0466d
SHA1 23b4e93772e29035852b5c5eb2235107c3b3d2e7
SHA512 7ed451f8d0c97965c39a1c57ba761fededb7ad19c135ecb3beb7478b4b14b71010174e5a87858fae7daf719b51e04047a8346d5f3d7c39cef434a7f3e591af99
SSDEEP 3072:/nZPWv1OExLtMPWdQgP7UIoaaZZyK6Yp6IhAznMQpfeKEjqCq5I706pWCV:huoatMPWdhP7UIQ6YpoM6eK8Dt7fpT
MD5 SHA1 SHA512 SSDEEP

Submit Download

bxhfn

Path C:\Users\Admin\AppData\Local\Temp\bxhfn
Size 5KB
SHA256 6d7f790627a73fc30aa77d515ab674c0b444910974826a403a4c978d8cede3a4
MD5 8d939c4619a1b93a91ec769e50865a30
SHA1 59d29ae2f85c67e397b45fa353b517b16b65b584
SHA512 442c41a424fb8344cada31f25e552b1a74f2c3822dfca2259540ffc574827f9834e0ac226bc27f04b76b7b541d93a1f4b10ae824b1a3c02b0945b55fe216a304
SSDEEP 96:3IxNNzIfa/fVYEktFzloupKTqvxeo9uaDqMbVJeFIMdxIFsu0iB9BiJ:aNN3/fKPOoKTqvxeo9uaDqMbVJ7D93o
MD5 SHA1 SHA512 SSDEEP

Submit Download

hrtmb.exe

Path C:\Users\Admin\AppData\Local\Temp\hrtmb.exe
Size 3KB
SHA256 4982aaf13a3dc1c128975a9fffc5636280ab0acfe390574164edaa019c1b3b9c
MD5 d8d7186a46fb0078e44ed89c64aa3881
SHA1 58d3a7922ff841665dbb5341701d37e01b272186
SHA512 75b761fbe1f635544fb5a693780742ef74ac51ec9c4d44c0ccd0816d3fe47109f5f2c3f2e03a6db61f2b1e560f46c9ad6ed0a1d6cfb7cab35cca633adb205505
MD5 SHA1 SHA512

Submit Download

hrtmb.exe

Path C:\Users\Admin\AppData\Local\Temp\hrtmb.exe
Size 3KB
SHA256 4982aaf13a3dc1c128975a9fffc5636280ab0acfe390574164edaa019c1b3b9c
MD5 d8d7186a46fb0078e44ed89c64aa3881
SHA1 58d3a7922ff841665dbb5341701d37e01b272186
SHA512 75b761fbe1f635544fb5a693780742ef74ac51ec9c4d44c0ccd0816d3fe47109f5f2c3f2e03a6db61f2b1e560f46c9ad6ed0a1d6cfb7cab35cca633adb205505
MD5 SHA1 SHA512

Submit Download

hrtmb.exe

Path C:\Users\Admin\AppData\Local\Temp\hrtmb.exe
Size 3KB
SHA256 4982aaf13a3dc1c128975a9fffc5636280ab0acfe390574164edaa019c1b3b9c
MD5 d8d7186a46fb0078e44ed89c64aa3881
SHA1 58d3a7922ff841665dbb5341701d37e01b272186
SHA512 75b761fbe1f635544fb5a693780742ef74ac51ec9c4d44c0ccd0816d3fe47109f5f2c3f2e03a6db61f2b1e560f46c9ad6ed0a1d6cfb7cab35cca633adb205505
MD5 SHA1 SHA512

Submit Download

hrtmb.exe

Path \Users\Admin\AppData\Local\Temp\hrtmb.exe
Size 3KB
SHA256 4982aaf13a3dc1c128975a9fffc5636280ab0acfe390574164edaa019c1b3b9c
MD5 d8d7186a46fb0078e44ed89c64aa3881
SHA1 58d3a7922ff841665dbb5341701d37e01b272186
SHA512 75b761fbe1f635544fb5a693780742ef74ac51ec9c4d44c0ccd0816d3fe47109f5f2c3f2e03a6db61f2b1e560f46c9ad6ed0a1d6cfb7cab35cca633adb205505
MD5 SHA1 SHA512

Submit Download

hrtmb.exe

Path \Users\Admin\AppData\Local\Temp\hrtmb.exe
Size 3KB
SHA256 4982aaf13a3dc1c128975a9fffc5636280ab0acfe390574164edaa019c1b3b9c
MD5 d8d7186a46fb0078e44ed89c64aa3881
SHA1 58d3a7922ff841665dbb5341701d37e01b272186
SHA512 75b761fbe1f635544fb5a693780742ef74ac51ec9c4d44c0ccd0816d3fe47109f5f2c3f2e03a6db61f2b1e560f46c9ad6ed0a1d6cfb7cab35cca633adb205505
MD5 SHA1 SHA512

Submit Download

hrtmb.exe

Path \Users\Admin\AppData\Local\Temp\hrtmb.exe
Size 3KB
SHA256 4982aaf13a3dc1c128975a9fffc5636280ab0acfe390574164edaa019c1b3b9c
MD5 d8d7186a46fb0078e44ed89c64aa3881
SHA1 58d3a7922ff841665dbb5341701d37e01b272186
SHA512 75b761fbe1f635544fb5a693780742ef74ac51ec9c4d44c0ccd0816d3fe47109f5f2c3f2e03a6db61f2b1e560f46c9ad6ed0a1d6cfb7cab35cca633adb205505
MD5 SHA1 SHA512

Submit Download

memory/872-54-0x0000000076721000-0x0000000076723000-memory.dmp

Download

memory/1292-79-0x0000000006990000-0x0000000006AEA000-memory.dmp

Download

memory/1292-71-0x0000000006E40000-0x0000000006FE7000-memory.dmp

Download

memory/1376-78-0x0000000001EE0000-0x0000000001F73000-memory.dmp

Download

memory/1376-77-0x00000000021B0000-0x00000000024B3000-memory.dmp

Download

memory/1376-76-0x00000000000C0000-0x00000000000EF000-memory.dmp

Download

memory/1376-75-0x0000000000AD0000-0x0000000000ADA000-memory.dmp

Download

memory/1524-64-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1524-70-0x00000000003D0000-0x00000000003E4000-memory.dmp

Download

memory/1524-69-0x0000000000770000-0x0000000000A73000-memory.dmp

Download

memory/1524-68-0x0000000000400000-0x000000000042F000-memory.dmp

Download