formbook | bb76e427660942cdf5c2f684ed7bcdf2be26e53d12adca57ee7757dd2ce4a9c9

Analysis

max time kernel
150s
max time network
149s
platform
windows7_x64
resource
win7-20220414-en
submitted
28/06/2022, 10:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
shipping docs.exe
Size 563KB
Sample220628-mdncjaggbr
SHA256 bb76e427660942cdf5c2f684ed7bcdf2be26e53d12adca57ee7757dd2ce4a9c9
MD5 e5b549ddaad375f61e761db0dd225d60
SHA1 f759109591636f985b6f43755be56b0adcab305b
SHA512 58bf3c12c8f293e6e926628ec4f6b03bfa26dc48169e312c2dbc04076387d06a45dc0f8f5c482038e36fa1a58545c967d111f4c80bd13811fd280991086107f6
MD5 SHA1 SHA512

Score

10^/10

formbook xloader gfv7 loader persistence rat spyware stealer suricata trojan

Malware Config

Extracted

Family

xloader

Version

Campaign

gfv7

Decoy

hd4AZDZ3XeSkZ9w0NRn2+JU=
6iAxmGKdumxFEgwp
jM6QcxNUSeCKaUdvvh3g9mffhosQ
d4CC0LS0DjTJS8FdXqd3soM=
S1LPlXEIJY52Og==
doeO7AimsF0NEvFgnIV5
W2TlzH/byHtUU3B7tw==
Y2RAbyZjex2qj6GQv4Q=
ftoOsCpZdfmALQ==
4kqL8v/6rDj8Ohs/wAjkb0gD5Gfiww==
8mVs/AkvwLnIWp4=
yfqAazgHioT8b9yHSKpLDtgY
EyWD5F+Wu3L0xq/VJXgdlnFvBDdUz5WM
jn9ty+pdRNdtcDhJ5k8nwZofm4EJ
s9XVNv4/aRDBUx4w
+vHFE7Fw1rnIWp4=
wC395Yvi6G/3yoWRGW1USxzshi3Dyw==
jcbufIN91gHAUK1RYUMYIdyqpDlUz5WM
iIyoIvZNXwPNmBlBxGk6+A==
C/hTD8h/KWLiMW4Mt/joXyz23Q==
V5ApC8yE9ga07OV4Q61LDtgY
xtLNTFFs/RCJA4orMGL9ApU=
/AKLeE8idfmALQ==
WJL8UAHhVg7FSqAxOWL9ApU=
9iK1jWPdwWJFEgwp
Rz0Nb3NpyLnIWp4=
th3awtVSNNiFPLlnLxPmXyz23Q==
PLAGb2JN/0tFEgwp
DwBJL0vXwz6VU3B7tw==
bOAIYklXEJsP7BUDjxTubP8Q
AzA1r1ApwbnIWp4=
GY7VFP8Z42Eu0zrPgv7M27H2j0s=
M1Xf2X3iJY52Og==
TniK5ZHG5YsoO/UBSCIK04Osyg==
bNielgswlcIx
BT5/syRLwuaFFoo=
zwZKrUOtnTLZkPUBUkIUo7nAxA==
S3TY7rP8Gao+W6GQv4Q=
8vR8aFToJinc8vkLXbaY8pHOkINUz5WM
fn99yILT1WJFEgwp
4CI0fVVcxeyXIYwwPVLo9Iw=
hq6/DbfACpAm
ZJBMLtsgRN6izYKOI6xLDtgY
0w51/t24cgbsNUTkoS3BBZM=
KigtlHKAVuSnOpkzO1Lo9Iw=
QJKEvBztdfmALQ==
JCr9WGswGbg7
cbnlTTM1lc+s9s/6j/3mXyz23Q==
nC9880u66IpFEgwp
8l0tFQeq3HFHilpg32RN0GRVOaxXKO8YOA==
aV4laF9ZdfmALQ==
p8+JhjIKxEMWa1707GVKBdbbhi3Dyw==
lsDLGs6vauq8ERrIkwrU1m76mhgPoVk=
VmL44pRG8A56zSK0xGk6+A==
0MtFU1jACpAm
ASApso7Btzm4sbLiY79LDtgY
ULrfRv1BUwzoty9HxGk6+A==
qasiAbIOJY52Og==
UZN9Xx2miW9FEgwp
zDMIAhSLts63jRpCxGk6+A==
f3gLFxpk+DG+U3B7tw==
qzWSblb1ernIWp4=
+CZPmjzmSGIHjN6BSapLDtgY
jsw3l0sshQ0MzjNRqA==
littlemountainnomad.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Xloader Payload 5 IoCs

rat

resource	yara_rule
behavioral1/memory/1744-62-0x0000000000400000-0x000000000042C000-memory.dmp	xloader
behavioral1/memory/1744-63-0x000000000041F810-mapping.dmp	xloader
behavioral1/memory/1744-65-0x0000000000400000-0x000000000042C000-memory.dmp	xloader
behavioral1/memory/1996-72-0x0000000000080000-0x00000000000AC000-memory.dmp	xloader
behavioral1/memory/1996-77-0x0000000000080000-0x00000000000AC000-memory.dmp	xloader

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Control Panel\International\Geo\Nation	shipping docs.exe

Deletes itself 1 IoCs

pid	Process
920	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	mstsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FJLHZLE8 = "C:\\Program Files (x86)\\Ylrwt8tj0\\vgalx4.exe"	mstsc.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1528 set thread context of 1744	1528	shipping docs.exe	29
PID 1744 set thread context of 1264	1744	shipping docs.exe	14
PID 1996 set thread context of 1264	1996	mstsc.exe	14

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Ylrwt8tj0\vgalx4.exe	mstsc.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-2277218442-1199762539-2004043321-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	mstsc.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
1528	shipping docs.exe
1744	shipping docs.exe
1744	shipping docs.exe
1996	mstsc.exe
1996	mstsc.exe
1996	mstsc.exe
1996	mstsc.exe
1996	mstsc.exe
1996	mstsc.exe
1996	mstsc.exe
1996	mstsc.exe
1996	mstsc.exe
1996	mstsc.exe
1996	mstsc.exe
1996	mstsc.exe
1996	mstsc.exe
1996	mstsc.exe
1996	mstsc.exe
1996	mstsc.exe
1996	mstsc.exe
1996	mstsc.exe
1996	mstsc.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
1744	shipping docs.exe
1744	shipping docs.exe
1744	shipping docs.exe
1996	mstsc.exe
1996	mstsc.exe
1996	mstsc.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1528	shipping docs.exe
Token: SeDebugPrivilege	1744	shipping docs.exe
Token: SeDebugPrivilege	1996	mstsc.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1264	Explorer.EXE
1264	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1264	Explorer.EXE
1264	Explorer.EXE

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 1100	1528	shipping docs.exe	28
PID 1528 wrote to memory of 1100	1528	shipping docs.exe	28
PID 1528 wrote to memory of 1100	1528	shipping docs.exe	28
PID 1528 wrote to memory of 1100	1528	shipping docs.exe	28
PID 1528 wrote to memory of 1744	1528	shipping docs.exe	29
PID 1528 wrote to memory of 1744	1528	shipping docs.exe	29
PID 1528 wrote to memory of 1744	1528	shipping docs.exe	29
PID 1528 wrote to memory of 1744	1528	shipping docs.exe	29
PID 1528 wrote to memory of 1744	1528	shipping docs.exe	29
PID 1528 wrote to memory of 1744	1528	shipping docs.exe	29
PID 1528 wrote to memory of 1744	1528	shipping docs.exe	29
PID 1264 wrote to memory of 1996	1264	Explorer.EXE	30
PID 1264 wrote to memory of 1996	1264	Explorer.EXE	30
PID 1264 wrote to memory of 1996	1264	Explorer.EXE	30
PID 1264 wrote to memory of 1996	1264	Explorer.EXE	30
PID 1996 wrote to memory of 920	1996	mstsc.exe	31
PID 1996 wrote to memory of 920	1996	mstsc.exe	31
PID 1996 wrote to memory of 920	1996	mstsc.exe	31
PID 1996 wrote to memory of 920	1996	mstsc.exe	31
PID 1996 wrote to memory of 1840	1996	mstsc.exe	34
PID 1996 wrote to memory of 1840	1996	mstsc.exe	34
PID 1996 wrote to memory of 1840	1996	mstsc.exe	34
PID 1996 wrote to memory of 1840	1996	mstsc.exe	34

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Users\Admin\AppData\Local\Temp\shipping docs.exe
  "C:\Users\Admin\AppData\Local\Temp\shipping docs.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1528
- - C:\Users\Admin\AppData\Local\Temp\shipping docs.exe
    "{path}"
    3⤵
    PID:1100
- - C:\Users\Admin\AppData\Local\Temp\shipping docs.exe
    "{path}"
    3⤵
    - Checks computer location settings
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:1744
- C:\Windows\SysWOW64\mstsc.exe
  "C:\Windows\SysWOW64\mstsc.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1996
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\shipping docs.exe"
    3⤵
    - Deletes itself
    PID:920
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:1840

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1264-78-0x00000000047F0000-0x00000000048DB000-memory.dmp

Download

memory/1264-76-0x00000000047F0000-0x00000000048DB000-memory.dmp

Download

memory/1264-68-0x0000000006AE0000-0x0000000006C60000-memory.dmp

Download

memory/1528-54-0x0000000000060000-0x00000000000F4000-memory.dmp

Download

memory/1528-55-0x0000000075C51000-0x0000000075C53000-memory.dmp

Download

memory/1528-56-0x0000000000590000-0x000000000059A000-memory.dmp

Download

memory/1528-57-0x0000000004DD0000-0x0000000004E54000-memory.dmp

Download

memory/1528-58-0x0000000001F00000-0x0000000001F32000-memory.dmp

Download

memory/1744-66-0x0000000000800000-0x0000000000B03000-memory.dmp

Download

memory/1744-65-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/1744-67-0x00000000003B0000-0x00000000003C1000-memory.dmp

Download

memory/1744-62-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/1744-60-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/1744-59-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/1996-71-0x0000000000490000-0x0000000000594000-memory.dmp

Download

memory/1996-72-0x0000000000080000-0x00000000000AC000-memory.dmp

Download

memory/1996-74-0x0000000002150000-0x0000000002453000-memory.dmp

Download

memory/1996-75-0x0000000001FA0000-0x0000000002030000-memory.dmp

Download

memory/1996-77-0x0000000000080000-0x00000000000AC000-memory.dmp

Download