formbook | fc15ab19130fccdae7dee477e0ae6d711fe3492cbac1b7e5d472eae4902f9516

General

Target

PROOF OF PAYMENT.exe
Size

24KB
MD5

7f99d249840dc2c5009b4771f887336e
SHA1

0a4de6946dca7444da62b7794bcb59e553108f0c
SHA256

fc15ab19130fccdae7dee477e0ae6d711fe3492cbac1b7e5d472eae4902f9516
SHA512

2dc950577ee4fa9b999d044cbb93aa365b13eb5a012633e7ec61410536790080c6c2f3be9f684ac3f11694b51d40d4732aa9975d91fd0c2b68c6e9d66a204237
SSDEEP

384:JwkCN7n8OIo3A12++XCCvcXEMA+7QEh2Fobm22:5CNz8OBnMA8R2

Score

10^/10

formbook nanocore a520 evasion keylogger persistence rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

a520

Decoy

/gLFv8NVc2nqbYCCoHLJDBi+TWOu

sjwFU14OMEn7e45Z11ou

stKh65U2h0eAsE3C4do=

tk5xxHYnTytQmuXoUyhstM+PmMM3eNzI

VExtu7dXhpO5DVpouFRxSlhP

YdSW3s9Pg88HRHs7IfKVBk8dGis=

/LJ5vLk+mifRECHWQPfgWQ==

/4qc8tqSwrszxE3C4do=

e4IkI9v2EV+ertKMol1xSlhP

VlwmZCwqUvsUbriqC/RU8Hnh9yM=

o8+X4ZkxbmtygJJZ11ou

YPS3vnb0JRuS8CAOQ0OY2PG4s8U3eNzI

JT5iqFqVvyfGCDX2Httopp4=

2qeFp5QULYE4suWiry9MYFtH

6OaHllqHu+H49V0VCw==

c4xPnUPM8hW3Nldbq6j8X+iVlQ==

s0tmqKSyw0FK0vLpFZ1mX+iVlQ==

SWU1e3eTqiCzv8TIDAtus757e6k3eNzI

CcDlcuyGx8ZDyynuQjQLRg==

KNq19/KCns+bobJdXiXu9AK+TWOu

Extracted

Family

nanocore

Version

1.2.2.0

C2

amechi.duckdns.org:4190

Mutex

7766992d-5166-4919-9d26-1d114e11093c

Attributes

activate_away_mode
true
backup_connection_host
amechi.duckdns.org
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2022-06-17T10:10:35.253943636Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
4190
default_group
NEW TRY FOR SUCCESS
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
7766992d-5166-4919-9d26-1d114e11093c
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
amechi.duckdns.org
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Executes dropped EXE 1 IoCs

Processes:

Bjlavuqqxsfvuyykucvpptdbin.exe

pid process

1268 Bjlavuqqxsfvuyykucvpptdbin.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Bjlavuqqxsfvuyykucvpptdbin.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\Geo\Nation	Bjlavuqqxsfvuyykucvpptdbin.exe

Loads dropped DLL 3 IoCs

Processes:

PROOF OF PAYMENT.exenetsh.exe

pid process

1676 PROOF OF PAYMENT.exe
1676 PROOF OF PAYMENT.exe
1016 netsh.exe

pid	process
1676	PROOF OF PAYMENT.exe
1676	PROOF OF PAYMENT.exe
1016	netsh.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

PROOF OF PAYMENT.exePROOF OF PAYMENT.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\game = "\"C:\\Users\\Admin\\AppData\\Roaming\\game.exe\""	PROOF OF PAYMENT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NTFS Monitor = "C:\\Program Files (x86)\\NTFS Monitor\\ntfsmon.exe"	PROOF OF PAYMENT.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

PROOF OF PAYMENT.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA PROOF OF PAYMENT.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	PROOF OF PAYMENT.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

Bjlavuqqxsfvuyykucvpptdbin.exePROOF OF PAYMENT.exenetsh.exe

description	pid	process	target process
PID 1268 set thread context of 1212	1268	Bjlavuqqxsfvuyykucvpptdbin.exe	Explorer.EXE
PID 1676 set thread context of 1556	1676	PROOF OF PAYMENT.exe	PROOF OF PAYMENT.exe
PID 1016 set thread context of 1212	1016	netsh.exe	Explorer.EXE

Drops file in Program Files directory 2 IoCs

Processes:

PROOF OF PAYMENT.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\NTFS Monitor\ntfsmon.exe	PROOF OF PAYMENT.exe
File created	C:\Program Files (x86)\NTFS Monitor\ntfsmon.exe	PROOF OF PAYMENT.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

netsh.exe

description	ioc	process
Key created	\Registry\User\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	netsh.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

Processes:

powershell.exeBjlavuqqxsfvuyykucvpptdbin.exePROOF OF PAYMENT.exePROOF OF PAYMENT.exenetsh.exe

pid	process
1844	powershell.exe
1268	Bjlavuqqxsfvuyykucvpptdbin.exe
1268	Bjlavuqqxsfvuyykucvpptdbin.exe
1268	Bjlavuqqxsfvuyykucvpptdbin.exe
1268	Bjlavuqqxsfvuyykucvpptdbin.exe
1676	PROOF OF PAYMENT.exe
1676	PROOF OF PAYMENT.exe
1556	PROOF OF PAYMENT.exe
1556	PROOF OF PAYMENT.exe
1016	netsh.exe
1016	netsh.exe
1016	netsh.exe
1016	netsh.exe
1016	netsh.exe
1016	netsh.exe
1016	netsh.exe
1016	netsh.exe
1016	netsh.exe
1016	netsh.exe
1016	netsh.exe
1016	netsh.exe
1016	netsh.exe
1016	netsh.exe
1016	netsh.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

PROOF OF PAYMENT.exe

pid process

1556 PROOF OF PAYMENT.exe

pid	process
1556	PROOF OF PAYMENT.exe

Suspicious behavior: MapViewOfSection 7 IoCs

Processes:

Bjlavuqqxsfvuyykucvpptdbin.exenetsh.exe

pid	process
1268	Bjlavuqqxsfvuyykucvpptdbin.exe
1268	Bjlavuqqxsfvuyykucvpptdbin.exe
1268	Bjlavuqqxsfvuyykucvpptdbin.exe
1016	netsh.exe
1016	netsh.exe
1016	netsh.exe
1016	netsh.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

PROOF OF PAYMENT.exepowershell.exeBjlavuqqxsfvuyykucvpptdbin.exePROOF OF PAYMENT.exenetsh.exe

description	pid	process
Token: SeDebugPrivilege	1676	PROOF OF PAYMENT.exe
Token: SeDebugPrivilege	1844	powershell.exe
Token: SeDebugPrivilege	1268	Bjlavuqqxsfvuyykucvpptdbin.exe
Token: SeDebugPrivilege	1556	PROOF OF PAYMENT.exe
Token: SeDebugPrivilege	1016	netsh.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

PROOF OF PAYMENT.exeExplorer.EXEnetsh.exe

description	pid	process	target process
PID 1676 wrote to memory of 1844	1676	PROOF OF PAYMENT.exe	powershell.exe
PID 1676 wrote to memory of 1844	1676	PROOF OF PAYMENT.exe	powershell.exe
PID 1676 wrote to memory of 1844	1676	PROOF OF PAYMENT.exe	powershell.exe
PID 1676 wrote to memory of 1844	1676	PROOF OF PAYMENT.exe	powershell.exe
PID 1676 wrote to memory of 1268	1676	PROOF OF PAYMENT.exe	Bjlavuqqxsfvuyykucvpptdbin.exe
PID 1676 wrote to memory of 1268	1676	PROOF OF PAYMENT.exe	Bjlavuqqxsfvuyykucvpptdbin.exe
PID 1676 wrote to memory of 1268	1676	PROOF OF PAYMENT.exe	Bjlavuqqxsfvuyykucvpptdbin.exe
PID 1676 wrote to memory of 1268	1676	PROOF OF PAYMENT.exe	Bjlavuqqxsfvuyykucvpptdbin.exe
PID 1212 wrote to memory of 1016	1212	Explorer.EXE	netsh.exe
PID 1212 wrote to memory of 1016	1212	Explorer.EXE	netsh.exe
PID 1212 wrote to memory of 1016	1212	Explorer.EXE	netsh.exe
PID 1212 wrote to memory of 1016	1212	Explorer.EXE	netsh.exe
PID 1676 wrote to memory of 1476	1676	PROOF OF PAYMENT.exe	PROOF OF PAYMENT.exe
PID 1676 wrote to memory of 1476	1676	PROOF OF PAYMENT.exe	PROOF OF PAYMENT.exe
PID 1676 wrote to memory of 1476	1676	PROOF OF PAYMENT.exe	PROOF OF PAYMENT.exe
PID 1676 wrote to memory of 1476	1676	PROOF OF PAYMENT.exe	PROOF OF PAYMENT.exe
PID 1676 wrote to memory of 1476	1676	PROOF OF PAYMENT.exe	PROOF OF PAYMENT.exe
PID 1676 wrote to memory of 1476	1676	PROOF OF PAYMENT.exe	PROOF OF PAYMENT.exe
PID 1676 wrote to memory of 1476	1676	PROOF OF PAYMENT.exe	PROOF OF PAYMENT.exe
PID 1676 wrote to memory of 1556	1676	PROOF OF PAYMENT.exe	PROOF OF PAYMENT.exe
PID 1676 wrote to memory of 1556	1676	PROOF OF PAYMENT.exe	PROOF OF PAYMENT.exe
PID 1676 wrote to memory of 1556	1676	PROOF OF PAYMENT.exe	PROOF OF PAYMENT.exe
PID 1676 wrote to memory of 1556	1676	PROOF OF PAYMENT.exe	PROOF OF PAYMENT.exe
PID 1676 wrote to memory of 1556	1676	PROOF OF PAYMENT.exe	PROOF OF PAYMENT.exe
PID 1676 wrote to memory of 1556	1676	PROOF OF PAYMENT.exe	PROOF OF PAYMENT.exe
PID 1676 wrote to memory of 1556	1676	PROOF OF PAYMENT.exe	PROOF OF PAYMENT.exe
PID 1676 wrote to memory of 1556	1676	PROOF OF PAYMENT.exe	PROOF OF PAYMENT.exe
PID 1676 wrote to memory of 1556	1676	PROOF OF PAYMENT.exe	PROOF OF PAYMENT.exe
PID 1676 wrote to memory of 1556	1676	PROOF OF PAYMENT.exe	PROOF OF PAYMENT.exe
PID 1676 wrote to memory of 1556	1676	PROOF OF PAYMENT.exe	PROOF OF PAYMENT.exe
PID 1676 wrote to memory of 1556	1676	PROOF OF PAYMENT.exe	PROOF OF PAYMENT.exe
PID 1016 wrote to memory of 2044	1016	netsh.exe	Firefox.exe
PID 1016 wrote to memory of 2044	1016	netsh.exe	Firefox.exe
PID 1016 wrote to memory of 2044	1016	netsh.exe	Firefox.exe
PID 1016 wrote to memory of 2044	1016	netsh.exe	Firefox.exe
PID 1016 wrote to memory of 2044	1016	netsh.exe	Firefox.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:1212

C:\Users\Admin\AppData\Local\Temp\PROOF OF PAYMENT.exe
"C:\Users\Admin\AppData\Local\Temp\PROOF OF PAYMENT.exe"
2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1676

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwAxAA==
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1844

C:\Users\Admin\AppData\Local\Temp\Bjlavuqqxsfvuyykucvpptdbin.exe
"C:\Users\Admin\AppData\Local\Temp\Bjlavuqqxsfvuyykucvpptdbin.exe"
3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1268

C:\Users\Admin\AppData\Local\Temp\PROOF OF PAYMENT.exe
"C:\Users\Admin\AppData\Local\Temp\PROOF OF PAYMENT.exe"
3⤵
PID:1476

C:\Users\Admin\AppData\Local\Temp\PROOF OF PAYMENT.exe
"C:\Users\Admin\AppData\Local\Temp\PROOF OF PAYMENT.exe"
3⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1556

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\SysWOW64\netsh.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1016

C:\Program Files\Mozilla Firefox\Firefox.exe
"C:\Program Files\Mozilla Firefox\Firefox.exe"
3⤵
PID:2044

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Bjlavuqqxsfvuyykucvpptdbin.exe
Filesize
185KB

MD5
81a6c3beb08a0f5029528dbbaa991dd7

SHA1
cca8dd79b8a4710baa1726a476227b3e25ecf056

SHA256
096a5d8dd996c380d7fc28c0350836b9c3cdf2651099869eb64b430145af939d

SHA512
1332f16ef45280e74976a29766b468c7f0679744bbe6382b25b85ce60c5d4e0e3af22f537307be62f2ba0276519ad5b90e42e32c41d34287009ca3cbbcf1a366

Download Submit
C:\Users\Admin\AppData\Local\Temp\Bjlavuqqxsfvuyykucvpptdbin.exe
Filesize
185KB

MD5
81a6c3beb08a0f5029528dbbaa991dd7

SHA1
cca8dd79b8a4710baa1726a476227b3e25ecf056

SHA256
096a5d8dd996c380d7fc28c0350836b9c3cdf2651099869eb64b430145af939d

SHA512
1332f16ef45280e74976a29766b468c7f0679744bbe6382b25b85ce60c5d4e0e3af22f537307be62f2ba0276519ad5b90e42e32c41d34287009ca3cbbcf1a366

Download Submit
\Users\Admin\AppData\Local\Temp\Bjlavuqqxsfvuyykucvpptdbin.exe
Filesize
185KB

MD5
81a6c3beb08a0f5029528dbbaa991dd7

SHA1
cca8dd79b8a4710baa1726a476227b3e25ecf056

SHA256
096a5d8dd996c380d7fc28c0350836b9c3cdf2651099869eb64b430145af939d

SHA512
1332f16ef45280e74976a29766b468c7f0679744bbe6382b25b85ce60c5d4e0e3af22f537307be62f2ba0276519ad5b90e42e32c41d34287009ca3cbbcf1a366

Download Submit
\Users\Admin\AppData\Local\Temp\Bjlavuqqxsfvuyykucvpptdbin.exe
Filesize
185KB

MD5
81a6c3beb08a0f5029528dbbaa991dd7

SHA1
cca8dd79b8a4710baa1726a476227b3e25ecf056

SHA256
096a5d8dd996c380d7fc28c0350836b9c3cdf2651099869eb64b430145af939d

SHA512
1332f16ef45280e74976a29766b468c7f0679744bbe6382b25b85ce60c5d4e0e3af22f537307be62f2ba0276519ad5b90e42e32c41d34287009ca3cbbcf1a366

Download Submit
\Users\Admin\AppData\Local\Temp\sqlite3.dll
Filesize
770KB

MD5
65f6090dfb069aca962a59f6df9e6113

SHA1
879bad504dfcce1a591c97817f3ff1e63931cfd2

SHA256
32a302d8c235226d8cdda4d957f151df3e5736fdce7886e6c794f0648b2eb106

SHA512
4c0e5e1103749356dceaaaa312e853bda83ec14f2f12288e9020cdf42b6e80d4caaec03d1ef7f34d81ddf2da88e6160c0c711380c2a7d89012e660406cdbb987

Download Submit
memory/1016-91-0x0000000002220000-0x0000000002523000-memory.dmp

Filesize
3.0MB

Download
memory/1016-92-0x0000000000A20000-0x0000000000AAF000-memory.dmp

Filesize
572KB

Download
memory/1016-90-0x00000000001D0000-0x00000000001FD000-memory.dmp

Filesize
180KB

Download
memory/1016-93-0x00000000001D0000-0x00000000001FD000-memory.dmp

Filesize
180KB

Download
memory/1016-89-0x0000000000B30000-0x0000000000B4B000-memory.dmp

Filesize
108KB

Download
memory/1016-86-0x0000000000000000-mapping.dmp

Download
memory/1212-85-0x0000000006460000-0x00000000065E4000-memory.dmp

Filesize
1.5MB

Download
memory/1212-94-0x00000000065F0000-0x0000000006721000-memory.dmp

Filesize
1.2MB

Download
memory/1212-95-0x00000000065F0000-0x0000000006721000-memory.dmp

Filesize
1.2MB

Download
memory/1268-87-0x0000000000B20000-0x0000000000B4F000-memory.dmp

Filesize
188KB

Download
memory/1268-83-0x0000000000B50000-0x0000000000E53000-memory.dmp

Filesize
3.0MB

Download
memory/1268-64-0x0000000000000000-mapping.dmp

Download
memory/1268-66-0x0000000000B20000-0x0000000000B4F000-memory.dmp

Filesize
188KB

Download
memory/1268-84-0x0000000000110000-0x0000000000120000-memory.dmp

Filesize
64KB

Download
memory/1556-80-0x0000000000630000-0x000000000063A000-memory.dmp

Filesize
40KB

Download
memory/1556-67-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1556-81-0x0000000001F80000-0x0000000001F9E000-memory.dmp

Filesize
120KB

Download
memory/1556-82-0x0000000001FA0000-0x0000000001FAA000-memory.dmp

Filesize
40KB

Download
memory/1556-78-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1556-76-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1556-70-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1556-71-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1556-73-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1556-68-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1556-74-0x000000000041E792-mapping.dmp

Download
memory/1676-54-0x0000000000230000-0x000000000023C000-memory.dmp

Filesize
48KB

Download
memory/1676-56-0x0000000006420000-0x0000000006690000-memory.dmp

Filesize
2.4MB

Download
memory/1676-55-0x0000000075E31000-0x0000000075E33000-memory.dmp

Filesize
8KB

Download
memory/1844-61-0x000000006E800000-0x000000006EDAB000-memory.dmp

Filesize
5.7MB

Download
memory/1844-60-0x000000006E800000-0x000000006EDAB000-memory.dmp

Filesize
5.7MB

Download
memory/1844-59-0x000000006E800000-0x000000006EDAB000-memory.dmp

Filesize
5.7MB

Download
memory/1844-57-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads