formbook | a013267b2dae410a6e166f9faaceebef0324d4b9036531856f10275f30ce41b8

Analysis

max time kernel
147s
max time network
152s
platform
windows7_x64
resource
win7-20220414-en
submitted
20/06/2022, 10:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Purchase Order.exe
Size 510KB
Sample220620-mv4e3sceam
SHA256 a013267b2dae410a6e166f9faaceebef0324d4b9036531856f10275f30ce41b8
MD5 c0d6aba1944e05446c8589d0add13e16
SHA1 804c051f00fecabab909b845ae9def8231572967
SHA512 50fb56803be91339619193cf621bfda489eb58d5757c64674a2b7fb95abab2916be4d90ddf32da13ee299ba0d272713a0898828792667021f085accc086770dc
MD5 SHA1 SHA512

Score

10^/10

formbook xloader utg6 loader persistence rat spyware stealer suricata trojan

Malware Config

Extracted

Family

xloader

Version

Campaign

utg6

Decoy

HH9H3kXZHIk0wrXfJq4s5Q==
dJojMwcUlkY3/12Ghl4=
M97sg6hotTOvNY1D
6o+YPIQARtqPHA4sKdmWYke8FA==
Pt71lrWLDblvQJ9A
K0fU6/BseTox+kSSmYQw5NtN00EV7tXr
4sohLE0CeRrTl+2X03jpYke8FA==
zrcKky6asFs+yUeWmQ==
VodJdmzh+A==
gobc7RDsOEAw9A==
xEYVn8uhKPPkPWuJo43QVuWhzgLM
Fw9Ybr9DXRz9jnd/jXvyYke8FA==
VCyIpJ9WjQS9AUudt5mWvMjCzE4=
0a6vT2kQTs1+SYepk6NO
TGCqvhzKUAj3RWvPX/5G
h4bU7i39XUJV4szsQt9e/A==
vwqYIIH/DLW3bpeqo3HpYke8FA==
vxbocZI8hKNcZb9Moli2Yv0dHg==
7JCQHUYhm19m7lrqPADuDrOhzgLM
gJjwBFXqM6BPYIxcaVY=
WYIgwTrqZQGsZbXL+PhR
KgZciArIHaFgamqJiWNdf06wJKXE
wZTaBoYqaPCuscppu3S2YTPnXIwV7tXr
NHsMkedknR+6CS+x2N5XPQWw
S/TxBpFMlwC28DmHhDhu+LOhzgLM
T5koS4H1Nch/iJC+6Yo3TuH+CEkA/ts=
1rvxCZROuEe9DhJch18=
KaxpFKG2wPS9+VbBPUn1n0S4
JhBkc8xMWSMxNkKOy3u0w4E=
MHUGjeB2vkgOxwKUJq4s5Q==
qGZvI3kPEcKCR4nfJq4s5Q==
oIrHwQHPIaNi6XsbeDTt7Q==
yc4MEk0V3skwRjs=
mEBH0fncP79+vdfn+ObrEt8TEEkA/ts=
dZoswFAcrnokNl+MnnHsYke8FA==
5OkmQrlCTQm36+lX
ms5RddVuqiL1PmrPX/5G
47fByGIP4oh1
Tuvnd5paqRveLIxcaVY=
KQpN+Bfe8JpFTzk=
3Q+uQqhS1oBGyUeWmQ==
I8zS5FwEVuirvBWjzHu0w4E=
Xsnefbe/NLR7
ZcmcQrdFXiYYX6ZKpGpdgzcxDEkA/ts=
qQbDVdWUolIZ7gtI
r/B9q+deOEAw9A==
a+jHZXcxhQbB+UWNiEIwPtXwJVjT4NQ=
xfd2BJxuFckwRjs=
gjRJa9peOEAw9A==
AHBF3Ta66MkwRjs=
0DQPpwW1BYNNyUeWmQ==
MjRyieFfoHPB/azPX/5G
h5rUfrs2eQhvQJ9A
6JyirxST08DN2BccXWKRyMjCzE4=
/jO+R7tYrIt4/GTPX/5G
LGzpEm8Yj1tf4OxAkjhq3XNkSFEV7tXr
PNTt91DJB5tSWoxcaVY=
BHxU+jEHtja36+lX
AVnS6zey83kcKTuMzHu0w4E=
N2LwByXjYiwR3hlqnSVW4J2Z3xjV
21Qhs8VuzJ0NGCI=
CXl2DSDgqV1QkgZelaFO
BzbD3QrpOEAw9A==
oKTh9lvw8JpFTzk=
propagandefilms.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Xloader Payload 5 IoCs

rat

resource	yara_rule
behavioral1/memory/2040-62-0x0000000000400000-0x000000000042C000-memory.dmp	xloader
behavioral1/memory/2040-63-0x000000000041F6B0-mapping.dmp	xloader
behavioral1/memory/2040-65-0x0000000000400000-0x000000000042C000-memory.dmp	xloader
behavioral1/memory/900-72-0x0000000000090000-0x00000000000BC000-memory.dmp	xloader
behavioral1/memory/900-77-0x0000000000090000-0x00000000000BC000-memory.dmp	xloader

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\9RL8KTLH6NNL = "C:\\Program Files (x86)\\Obx5\\user2d3.exe"	msiexec.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Control Panel\International\Geo\Nation	Purchase Order.exe

Deletes itself 1 IoCs

pid	Process
1160	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1868 set thread context of 2040	1868	Purchase Order.exe	28
PID 2040 set thread context of 1196	2040	Purchase Order.exe	16
PID 900 set thread context of 1196	900	msiexec.exe	16

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Obx5\user2d3.exe	msiexec.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-2277218442-1199762539-2004043321-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	msiexec.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
2040	Purchase Order.exe
2040	Purchase Order.exe
900	msiexec.exe
900	msiexec.exe
900	msiexec.exe
900	msiexec.exe
900	msiexec.exe
900	msiexec.exe
900	msiexec.exe
900	msiexec.exe
900	msiexec.exe
900	msiexec.exe
900	msiexec.exe
900	msiexec.exe
900	msiexec.exe
900	msiexec.exe
900	msiexec.exe
900	msiexec.exe

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
2040	Purchase Order.exe
2040	Purchase Order.exe
2040	Purchase Order.exe
900	msiexec.exe
900	msiexec.exe
900	msiexec.exe
900	msiexec.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2040	Purchase Order.exe
Token: SeDebugPrivilege	900	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1196	Explorer.EXE
1196	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1196	Explorer.EXE
1196	Explorer.EXE

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 2040	1868	Purchase Order.exe	28
PID 1868 wrote to memory of 2040	1868	Purchase Order.exe	28
PID 1868 wrote to memory of 2040	1868	Purchase Order.exe	28
PID 1868 wrote to memory of 2040	1868	Purchase Order.exe	28
PID 1868 wrote to memory of 2040	1868	Purchase Order.exe	28
PID 1868 wrote to memory of 2040	1868	Purchase Order.exe	28
PID 1868 wrote to memory of 2040	1868	Purchase Order.exe	28
PID 1196 wrote to memory of 900	1196	Explorer.EXE	32
PID 1196 wrote to memory of 900	1196	Explorer.EXE	32
PID 1196 wrote to memory of 900	1196	Explorer.EXE	32
PID 1196 wrote to memory of 900	1196	Explorer.EXE	32
PID 1196 wrote to memory of 900	1196	Explorer.EXE	32
PID 1196 wrote to memory of 900	1196	Explorer.EXE	32
PID 1196 wrote to memory of 900	1196	Explorer.EXE	32
PID 900 wrote to memory of 1160	900	msiexec.exe	33
PID 900 wrote to memory of 1160	900	msiexec.exe	33
PID 900 wrote to memory of 1160	900	msiexec.exe	33
PID 900 wrote to memory of 1160	900	msiexec.exe	33
PID 900 wrote to memory of 1812	900	msiexec.exe	36
PID 900 wrote to memory of 1812	900	msiexec.exe	36
PID 900 wrote to memory of 1812	900	msiexec.exe	36
PID 900 wrote to memory of 1812	900	msiexec.exe	36
PID 900 wrote to memory of 1812	900	msiexec.exe	36

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe
  "C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1868
- - C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe
    "C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"
    3⤵
    - Checks computer location settings
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:2040
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:948
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:1800
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:912
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe"
  2⤵
  - Adds policy Run key to start application
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:900
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"
    3⤵
    - Deletes itself
    PID:1160
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:1812

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/900-77-0x0000000000090000-0x00000000000BC000-memory.dmp

Download

memory/900-71-0x0000000000350000-0x0000000000364000-memory.dmp

Download

memory/900-72-0x0000000000090000-0x00000000000BC000-memory.dmp

Download

memory/900-75-0x0000000000730000-0x00000000007C0000-memory.dmp

Download

memory/900-73-0x0000000002390000-0x0000000002693000-memory.dmp

Download

memory/1196-78-0x0000000004CD0000-0x0000000004E35000-memory.dmp

Download

memory/1196-76-0x0000000004CD0000-0x0000000004E35000-memory.dmp

Download

memory/1196-68-0x0000000004B40000-0x0000000004CCF000-memory.dmp

Download

memory/1868-54-0x0000000000CB0000-0x0000000000D36000-memory.dmp

Download

memory/1868-58-0x0000000004340000-0x0000000004372000-memory.dmp

Download

memory/1868-57-0x0000000005750000-0x00000000057BA000-memory.dmp

Download

memory/1868-56-0x0000000000560000-0x000000000056E000-memory.dmp

Download

memory/1868-55-0x0000000075541000-0x0000000075543000-memory.dmp

Download

memory/2040-59-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/2040-67-0x0000000000190000-0x00000000001A1000-memory.dmp

Download

memory/2040-66-0x0000000000950000-0x0000000000C53000-memory.dmp

Download

memory/2040-65-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/2040-62-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/2040-60-0x0000000000400000-0x000000000042C000-memory.dmp

Download