formbook | a7c1f4ae5c35b88e68b4d82db4c7e14d53922946d853569b5efd5050e7480229

Analysis

max time kernel
149s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02-09-2022 03:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

38.exe
Size

176KB
MD5

8d832564ccf944aa80614078e59afca3
SHA1

0eb7785515b2acc2c35fd4ec7b822fe97ef884b9
SHA256

71d20cb55abb01e4cdb1d2f7a5e61f6048c34079970d5850b785386ca53c7c1a
SHA512

c5a1a9acb1da0d57b057e0a1a8141b21f209d50ed838e03ee904364255e4889beaea43173e65d1188cd8057c6ac25f43328f0ba181e7ee34c8b49c34aa41bfc9
SSDEEP

3072:xrtRM59Srdxq5+HIbTS4WGRbQ/0oqcMisygnrs4oEV4oyDaShxt/RZG0TQh/mxrC:9I596dYoo3SYbQMogyUY4hV4oyDa87Zi

Score

10^/10

formbook xloader loader persistence rat spyware stealer trojan

Malware Config

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral6/memory/4632-137-0x0000000000940000-0x000000000096C000-memory.dmp	xloader
behavioral6/memory/4632-142-0x0000000000940000-0x000000000096C000-memory.dmp	xloader

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\0RX8FTBP = "C:\\Program Files (x86)\\Vwpx\\cz74anojp0kz.exe"	explorer.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

38.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 38.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	38.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

38.exeexplorer.exe

description	pid	process	target process
PID 5016 set thread context of 2556	5016	38.exe	Explorer.EXE
PID 4632 set thread context of 2556	4632	explorer.exe	Explorer.EXE

Drops file in Program Files directory 1 IoCs

Processes:

explorer.exe

description ioc process

File opened for modification C:\Program Files (x86)\Vwpx\cz74anojp0kz.exe explorer.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Vwpx\cz74anojp0kz.exe	explorer.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\Registry\User\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	explorer.exe

Suspicious behavior: EnumeratesProcesses 52 IoCs

Processes:

38.exeexplorer.exe

pid	process
5016	38.exe
5016	38.exe
5016	38.exe
5016	38.exe
4632	explorer.exe
4632	explorer.exe
4632	explorer.exe
4632	explorer.exe
4632	explorer.exe
4632	explorer.exe
4632	explorer.exe
4632	explorer.exe
4632	explorer.exe
4632	explorer.exe
4632	explorer.exe
4632	explorer.exe
4632	explorer.exe
4632	explorer.exe
4632	explorer.exe
4632	explorer.exe
4632	explorer.exe
4632	explorer.exe
4632	explorer.exe
4632	explorer.exe
4632	explorer.exe
4632	explorer.exe
4632	explorer.exe
4632	explorer.exe
4632	explorer.exe
4632	explorer.exe
4632	explorer.exe
4632	explorer.exe
4632	explorer.exe
4632	explorer.exe
4632	explorer.exe
4632	explorer.exe
4632	explorer.exe
4632	explorer.exe
4632	explorer.exe
4632	explorer.exe
4632	explorer.exe
4632	explorer.exe
4632	explorer.exe
4632	explorer.exe
4632	explorer.exe
4632	explorer.exe
4632	explorer.exe
4632	explorer.exe
4632	explorer.exe
4632	explorer.exe
4632	explorer.exe
4632	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

2556 Explorer.EXE
Suspicious behavior: MapViewOfSection 7 IoCs

Processes:

38.exeexplorer.exe

pid process

5016 38.exe
5016 38.exe
5016 38.exe
4632 explorer.exe
4632 explorer.exe
4632 explorer.exe
4632 explorer.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

38.exeexplorer.exe

description pid process

Token: SeDebugPrivilege 5016 38.exe
Token: SeDebugPrivilege 4632 explorer.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

2556 Explorer.EXE
2556 Explorer.EXE

pid	process
2556	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	5016	38.exe
Token: SeDebugPrivilege	4632	explorer.exe

pid	process
2556	Explorer.EXE
2556	Explorer.EXE

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

Explorer.EXEexplorer.exe

description	pid	process	target process
PID 2556 wrote to memory of 4632	2556	Explorer.EXE	explorer.exe
PID 2556 wrote to memory of 4632	2556	Explorer.EXE	explorer.exe
PID 2556 wrote to memory of 4632	2556	Explorer.EXE	explorer.exe
PID 4632 wrote to memory of 4616	4632	explorer.exe	cmd.exe
PID 4632 wrote to memory of 4616	4632	explorer.exe	cmd.exe
PID 4632 wrote to memory of 4616	4632	explorer.exe	cmd.exe
PID 4632 wrote to memory of 3116	4632	explorer.exe	Firefox.exe
PID 4632 wrote to memory of 3116	4632	explorer.exe	Firefox.exe
PID 4632 wrote to memory of 3116	4632	explorer.exe	Firefox.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2556

C:\Users\Admin\AppData\Local\Temp\38.exe
"C:\Users\Admin\AppData\Local\Temp\38.exe"
2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:5016

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\SysWOW64\explorer.exe"
2⤵
- Adds policy Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4632

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\38.exe"
3⤵
PID:4616

C:\Program Files\Mozilla Firefox\Firefox.exe
"C:\Program Files\Mozilla Firefox\Firefox.exe"
3⤵
PID:3116

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2556-134-0x0000000008940000-0x0000000008AC5000-memory.dmp

Filesize
1.5MB

Download
memory/2556-141-0x0000000008AD0000-0x0000000008BEF000-memory.dmp

Filesize
1.1MB

Download
memory/2556-143-0x0000000008AD0000-0x0000000008BEF000-memory.dmp

Filesize
1.1MB

Download
memory/4616-138-0x0000000000000000-mapping.dmp

Download
memory/4632-135-0x0000000000000000-mapping.dmp

Download
memory/4632-136-0x0000000000E50000-0x0000000001283000-memory.dmp

Filesize
4.2MB

Download
memory/4632-137-0x0000000000940000-0x000000000096C000-memory.dmp

Filesize
176KB

Download
memory/4632-139-0x0000000002F80000-0x00000000032CA000-memory.dmp

Filesize
3.3MB

Download
memory/4632-140-0x0000000002D20000-0x0000000002DB0000-memory.dmp

Filesize
576KB

Download
memory/4632-142-0x0000000000940000-0x000000000096C000-memory.dmp

Filesize
176KB

Download
memory/5016-132-0x0000000000F80000-0x00000000012CA000-memory.dmp

Filesize
3.3MB

Download
memory/5016-133-0x00000000009B0000-0x00000000009C1000-memory.dmp

Filesize
68KB

Download