formbook | 48556d0392a4d83d45fb033f8deab48ebc85ebfef95616191b43512d6250cc01

Analysis

max time kernel
94s
max time network
91s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
24/05/2022, 12:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ORDER LIST 011405.exe
Size 269KB
Sample220524-psby6aaea3
SHA256 48556d0392a4d83d45fb033f8deab48ebc85ebfef95616191b43512d6250cc01
MD5 a6cdc84551455132ecc5db9a7101a674
SHA1 7edce32aae9ffaf610abf903ad223bc48f23ef92
SHA512 242d8e89bd74904b156c01c2247bd92fca99d9d25f2436ecedf7408fecdc85f0ad3242cdbebef8a226ff7edc5c2cdb521afdeb4b52927dac6808f2a349e489aa
MD5 SHA1 SHA512

Score

10^/10

formbook b0y1 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

b0y1

Decoy

newindexpress.com
tg5szfdz.xyz
aims1881.com
bonaegroup.com
be99caboi8.xyz
weddingcentrepieces.com
acigdmodel.com
ketotax.info
learnedware.com
learning-rich-work.store
multipreset.store
flyttfirmaorebro.com
58bilisim.xyz
joseketofitdiet.site
duomeishop.com
programacaozerobarriga.site
gygezau517.xyz
awesometutorials.xyz
hwvzfn3t.xyz
nycexoticbullies.com
smallbizmaker.com
isarfeuer.com
wacker-silicones.com
tongtoto.com
xofitessentials.com
begep.space
paperbackbookbox.com
ihhsiljc.beauty
jankarbaniye.com
boli-12.xyz
gridwriter.com
377manhua.com
willywaw98cop.com
acumelet.com
theupgradeexperiencemedia.com
pimientamultimedia.com
phoenixgold.xyz
plunderdseign.com
erdberrehausgsd.net
aboutsprouts.com
castle-clash.com
nwcabin.com
kurtizanki-spb.com
yqphx.xyz
casinowithout.com
jctcopera.com
antalyaluxuryvilla.xyz
sagedidthis.com
144z.xyz
iska4peps.life
rightthewrong.biz
zib0bsivacf8.xyz
beijingzhongruanchuangheng.site
jylfxx.net
newsletterexperience.com
rnrprowash.com
bylunakdy.com
upasev.online
businessreputationmanager.com
kidsacooking.com
brangusprimebeef.com
nickhaven.com
o1apopdpzhah.xyz
negociodigital.store
liuchenggang.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/4220-139-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Executes dropped EXE 2 IoCs

pid	Process
3152	smqlig.exe
4220	smqlig.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3152 set thread context of 4220	3152	smqlig.exe	62
PID 4220 set thread context of 3120	4220	smqlig.exe	25
PID 3788 set thread context of 3120	3788	msdt.exe	25

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
4220	smqlig.exe
4220	smqlig.exe
4220	smqlig.exe
4220	smqlig.exe
3788	msdt.exe
3788	msdt.exe
3788	msdt.exe
3788	msdt.exe
3788	msdt.exe
3788	msdt.exe
3788	msdt.exe
3788	msdt.exe
3788	msdt.exe
3788	msdt.exe
3788	msdt.exe
3788	msdt.exe
3788	msdt.exe
3788	msdt.exe
3788	msdt.exe
3788	msdt.exe
3788	msdt.exe
3788	msdt.exe
3788	msdt.exe
3788	msdt.exe
3788	msdt.exe
3788	msdt.exe
3788	msdt.exe
3788	msdt.exe
3788	msdt.exe
3788	msdt.exe
3788	msdt.exe
3788	msdt.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3120	Explorer.EXE

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
4220	smqlig.exe
4220	smqlig.exe
4220	smqlig.exe
3788	msdt.exe
3788	msdt.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4220	smqlig.exe
Token: SeDebugPrivilege	3788	msdt.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 3152	2712	ORDER LIST 011405.exe	50
PID 2712 wrote to memory of 3152	2712	ORDER LIST 011405.exe	50
PID 2712 wrote to memory of 3152	2712	ORDER LIST 011405.exe	50
PID 3152 wrote to memory of 4220	3152	smqlig.exe	62
PID 3152 wrote to memory of 4220	3152	smqlig.exe	62
PID 3152 wrote to memory of 4220	3152	smqlig.exe	62
PID 3152 wrote to memory of 4220	3152	smqlig.exe	62
PID 3152 wrote to memory of 4220	3152	smqlig.exe	62
PID 3152 wrote to memory of 4220	3152	smqlig.exe	62
PID 3120 wrote to memory of 3788	3120	Explorer.EXE	74
PID 3120 wrote to memory of 3788	3120	Explorer.EXE	74
PID 3120 wrote to memory of 3788	3120	Explorer.EXE	74
PID 3788 wrote to memory of 4160	3788	msdt.exe	83
PID 3788 wrote to memory of 4160	3788	msdt.exe	83
PID 3788 wrote to memory of 4160	3788	msdt.exe	83

C:\Users\Admin\AppData\Local\Temp\ORDER LIST 011405.exe
"C:\Users\Admin\AppData\Local\Temp\ORDER LIST 011405.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Users\Admin\AppData\Local\Temp\smqlig.exe
  C:\Users\Admin\AppData\Local\Temp\smqlig.exe C:\Users\Admin\AppData\Local\Temp\gqxew
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3152
- - C:\Users\Admin\AppData\Local\Temp\smqlig.exe
    C:\Users\Admin\AppData\Local\Temp\smqlig.exe C:\Users\Admin\AppData\Local\Temp\gqxew
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:4220

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3120
- C:\Windows\SysWOW64\msdt.exe
  "C:\Windows\SysWOW64\msdt.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3788
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\smqlig.exe"
    3⤵
    PID:4160

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

gqxew

Path C:\Users\Admin\AppData\Local\Temp\gqxew
Size 4KB
SHA256 12306a80133eb40bab41564ddc235c3e16c7a0644b5df82dc4f2e035caae37b3
MD5 59a15724b30cd06e08c7e133adaec58e
SHA1 08a1b6fdede36e86897f7346bd3be176702615df
SHA512 f0cd2e9285420b2c6fb2ca4eb524eaa6717484ccf24ec5b6a411f66e67bd46844de331e731a79f18ad97f1f4c7035f36a40eef0369a88c3987c20234f3c91818
SSDEEP 96:pyxbgOzza098heuw/g8PUcgNFX1eV1wwVY5SiPXw7R:pyiKxuw/ZM9N5QlGlIN
MD5 SHA1 SHA512 SSDEEP

Submit Download

smqlig.exe

Path C:\Users\Admin\AppData\Local\Temp\smqlig.exe
Size 128KB
SHA256 1aaf8ae01fe0c94c9c9c1f69969949d3be87c9cd904432e70c509664fe5e7551
MD5 f1dc6263b62f209d072eaedb4acd760d
SHA1 9763741c4126ca4c85980a3d5ed58dfdaec4d30d
SHA512 866fc15606e54f5537638dacbd30a8400e308253fdb76fbd6caf20bd2e5ef9d7f43b29204ff3d548806554e7af51e4e2c0e977d4dca65c5bac8908a2e8b45801
SSDEEP 3072:+XtdFhs2X4lXuFrwsm06aEsNWIp62UmYQV:+dkXArfMsNj
MD5 SHA1 SHA512 SSDEEP

Submit Download

smqlig.exe

Path C:\Users\Admin\AppData\Local\Temp\smqlig.exe
Size 126KB
SHA256 2cd768036c467ece0f457a829c39d7ce4d1a81cee764932ac5273d21663b6e3a
MD5 3027c96568cf00ae5d443707afbed75d
SHA1 69f0d0169ab8d16d6ff10406f45d9867d2566d25
SHA512 938aead02f7373cf496dfb1c7d2ec87db1a5e388e911a0e325f744e781f61939e3758c35a62d0a8836a8b7bddb6abd6f96a72f240d44605752f6c5ffb8205c72
SSDEEP 3072:+XtdFhs2X4lXuFrwsm06aEsNWIp62UmYQV:+dkXArfMsNj
MD5 SHA1 SHA512 SSDEEP

Submit Download

smqlig.exe

Path C:\Users\Admin\AppData\Local\Temp\smqlig.exe
Size 105KB
SHA256 ad6a01427905e792900e2484e9b4860f3e9070e02176a91dc66d116adda9b148
MD5 1da0327bc549bee2f3fa77155008abaf
SHA1 0c4797af3a0db95d6e1d3742046182331453759e
SHA512 c429ac9f1db8b0c6b30ed8c6cd7c5428e4d93257a6385e4911e9d227379f9014d29db5ca2705716443ca33b90d3ece5882ed5da935b8eb655b9f6e2ffa875383
SSDEEP 1536:+ISxO8x/Fhs2TjR2OuXSrC0rwbLgRmq3iBI635oEsNWb0pFlCeE0F:+XtdFhs2X4lXuFrwsm06aEsNWIp6U
MD5 SHA1 SHA512 SSDEEP

Submit Download

zp7r6twmnft

Path C:\Users\Admin\AppData\Local\Temp\zp7r6twmnft
Size 127KB
SHA256 e4a5e30db89743bf7b37c922b51199a9ed0ea37bd0d8cae82d4db1e545ea2b89
MD5 9957eefb5bbea17c875ae23ea2f61ad4
SHA1 948eaa601efd5d51e45a2b167720e23d44338d8c
SHA512 6cf0e3ae32ae9dd26f15b63a3c4967bd382d8a58b709242213d87ff01a5a3841707a24f1e12664bf2c5a66369934c70750204ba5894baac1f32c9d2e5a3de7d0
SSDEEP 3072:Dp8SRLX+bWqD8Cyf93KOiGrg6R/QUpIyS5kyGgviZ5mPkYA3xSdlXmV:t8Eb2D8ReGrgy/3p+5kej6Sdl4
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3120-149-0x0000000008A70000-0x0000000008B72000-memory.dmp

Download

memory/3120-142-0x0000000003200000-0x0000000003330000-memory.dmp

Download

memory/3788-148-0x0000000002BB0000-0x0000000002C44000-memory.dmp

Download

memory/3788-146-0x0000000003000000-0x000000000334A000-memory.dmp

Download

memory/3788-144-0x00000000006F0000-0x0000000000747000-memory.dmp

Download

memory/3788-145-0x0000000000E00000-0x0000000000E2F000-memory.dmp

Download

memory/4220-140-0x0000000000A30000-0x0000000000D7A000-memory.dmp

Download

memory/4220-141-0x00000000009C0000-0x00000000009D5000-memory.dmp

Download

memory/4220-139-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4220-136-0x0000000000400000-0x000000000042F000-memory.dmp

Download