formbook | 5032a3dbc97f17dba5cf4a7dc67a6c9ae6293a344d9d9433d63e8cd180226927

General

Target

Quotation.pif.exe
Size

991KB
MD5

59d24bcc44a883d21a48b2d368a1ff45
SHA1

d933aac89872b6a5f60901563b19c6715a0d007a
SHA256

5032a3dbc97f17dba5cf4a7dc67a6c9ae6293a344d9d9433d63e8cd180226927
SHA512

9281ea610f54c4df7f849d4c9e9021b6b3983a04ce0c6606db587d8d3b412de0494a1717adc9e701947ddd97f40216768d40af96983ad95449040e5bccbdecaf
SSDEEP

12288:dHeyEXo6MY++34Ot1UzDMHvRJUHoPYFoBMmTA0+bB/jIyBXRsZZ4wiPWL1QORWl5:m/DkM1nHvRJ9PYqs0+5FXk+P41Q7BBz

Score

10^/10

formbook nhg6 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

nhg6

Decoy

FSZGb3Of7ECMIOG9mh1ql/w=

DAPP3Pm63eo+zg==

khOZTuClxYsKQsZALgy3ob9TFAk=

5uWol2f/RF3CAwFd

P70LqPOi2iE9g4vpPH1Lk8E0K6tC

KBRl7TSt3eo+zg==

rqedJWUJXKkDbORa

lpORtIg8lvMKbJ77PQW9kes=

Qinv+gsohAIooqyTcfUYgZ/IVxQ=

J0L2ggPAiE2gxm4=

r/I6qOGI5noJCghf

khJg6HKM6l9okVK+pg==

HRMTK/6p3eo+zg==

HqMiuv2JaKYJCghf

+FzGYtsGTpK46OkKkh5C

BBrOUpUY91R/r8gkPwrcuw==

klWfn2smdNcqog581h6vX7px

t8uvr7+R7IPaHSOH1hqvX7px

bHdghkj64OjzY2hOLa/WObrRkkeJjQ==

s3/smhoylh1J0mPS4aDHBDRyJw==

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Quotation.pif.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	Quotation.pif.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 3 IoCs

Processes:

Quotation.pif.exeRegSvcs.execscript.exe

description	pid	process	target process
PID 960 set thread context of 3420	960	Quotation.pif.exe	RegSvcs.exe
PID 3420 set thread context of 2576	3420	RegSvcs.exe	Explorer.EXE
PID 4392 set thread context of 2576	4392	cscript.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1228 schtasks.exe

pid	process
1228	schtasks.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

cscript.exe

description	ioc	process
Key created	\Registry\User\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	cscript.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

Processes:

Quotation.pif.exepowershell.exeRegSvcs.execscript.exe

pid	process
960	Quotation.pif.exe
4416	powershell.exe
960	Quotation.pif.exe
3420	RegSvcs.exe
3420	RegSvcs.exe
3420	RegSvcs.exe
3420	RegSvcs.exe
3420	RegSvcs.exe
3420	RegSvcs.exe
3420	RegSvcs.exe
3420	RegSvcs.exe
4416	powershell.exe
4392	cscript.exe
4392	cscript.exe
4392	cscript.exe
4392	cscript.exe
4392	cscript.exe
4392	cscript.exe
4392	cscript.exe
4392	cscript.exe
4392	cscript.exe
4392	cscript.exe
4392	cscript.exe
4392	cscript.exe
4392	cscript.exe
4392	cscript.exe
4392	cscript.exe
4392	cscript.exe
4392	cscript.exe
4392	cscript.exe
4392	cscript.exe
4392	cscript.exe
4392	cscript.exe
4392	cscript.exe
4392	cscript.exe
4392	cscript.exe
4392	cscript.exe
4392	cscript.exe
4392	cscript.exe
4392	cscript.exe
4392	cscript.exe
4392	cscript.exe
4392	cscript.exe
4392	cscript.exe
4392	cscript.exe
4392	cscript.exe
4392	cscript.exe
4392	cscript.exe
4392	cscript.exe
4392	cscript.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

2576 Explorer.EXE
Suspicious behavior: MapViewOfSection 7 IoCs

Processes:

RegSvcs.execscript.exe

pid process

3420 RegSvcs.exe
3420 RegSvcs.exe
3420 RegSvcs.exe
4392 cscript.exe
4392 cscript.exe
4392 cscript.exe
4392 cscript.exe

pid	process
2576	Explorer.EXE

pid	process
3420	RegSvcs.exe
3420	RegSvcs.exe
3420	RegSvcs.exe
4392	cscript.exe
4392	cscript.exe
4392	cscript.exe
4392	cscript.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

Quotation.pif.exepowershell.exeRegSvcs.execscript.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	960	Quotation.pif.exe
Token: SeDebugPrivilege	4416	powershell.exe
Token: SeDebugPrivilege	3420	RegSvcs.exe
Token: SeDebugPrivilege	4392	cscript.exe
Token: SeShutdownPrivilege	2576	Explorer.EXE
Token: SeCreatePagefilePrivilege	2576	Explorer.EXE

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

Quotation.pif.exeExplorer.EXEcscript.exe

description	pid	process	target process
PID 960 wrote to memory of 4416	960	Quotation.pif.exe	powershell.exe
PID 960 wrote to memory of 4416	960	Quotation.pif.exe	powershell.exe
PID 960 wrote to memory of 4416	960	Quotation.pif.exe	powershell.exe
PID 960 wrote to memory of 1228	960	Quotation.pif.exe	schtasks.exe
PID 960 wrote to memory of 1228	960	Quotation.pif.exe	schtasks.exe
PID 960 wrote to memory of 1228	960	Quotation.pif.exe	schtasks.exe
PID 960 wrote to memory of 3420	960	Quotation.pif.exe	RegSvcs.exe
PID 960 wrote to memory of 3420	960	Quotation.pif.exe	RegSvcs.exe
PID 960 wrote to memory of 3420	960	Quotation.pif.exe	RegSvcs.exe
PID 960 wrote to memory of 3420	960	Quotation.pif.exe	RegSvcs.exe
PID 960 wrote to memory of 3420	960	Quotation.pif.exe	RegSvcs.exe
PID 960 wrote to memory of 3420	960	Quotation.pif.exe	RegSvcs.exe
PID 2576 wrote to memory of 4392	2576	Explorer.EXE	cscript.exe
PID 2576 wrote to memory of 4392	2576	Explorer.EXE	cscript.exe
PID 2576 wrote to memory of 4392	2576	Explorer.EXE	cscript.exe
PID 4392 wrote to memory of 4612	4392	cscript.exe	Firefox.exe
PID 4392 wrote to memory of 4612	4392	cscript.exe	Firefox.exe
PID 4392 wrote to memory of 4612	4392	cscript.exe	Firefox.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2576

C:\Users\Admin\AppData\Local\Temp\Quotation.pif.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.pif.exe"
2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:960

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\OJGfLeUSALnpf.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4416

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OJGfLeUSALnpf" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2318.tmp"
3⤵
- Creates scheduled task(s)
PID:1228

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3420

C:\Windows\SysWOW64\cscript.exe
"C:\Windows\SysWOW64\cscript.exe"
2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4392

C:\Program Files\Mozilla Firefox\Firefox.exe
"C:\Program Files\Mozilla Firefox\Firefox.exe"
3⤵
PID:4612

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp2318.tmp
Filesize
1KB

MD5
771a2c043443bd78d6f97d12e732bae9

SHA1
462965f969ffa3f8ad57d30246ab91801b017f43

SHA256
0fb0ea70afba29da669495aa92b4166cf46421eca8b369977010ab9ea8d1b6c9

SHA512
a167c0ae55285d898a95c058c561a2b6b9e17c452cdedbe8201633e793e7337991be18da243d471f1974593f288b995dd6169d9bb2077d9fb549a62be58e6fb1

Download Submit
memory/960-133-0x0000000005F60000-0x0000000006504000-memory.dmp

Filesize
5.6MB

Download
memory/960-134-0x0000000005A50000-0x0000000005AE2000-memory.dmp

Filesize
584KB

Download
memory/960-135-0x00000000059C0000-0x00000000059CA000-memory.dmp

Filesize
40KB

Download
memory/960-136-0x0000000009940000-0x00000000099DC000-memory.dmp

Filesize
624KB

Download
memory/960-137-0x0000000009C10000-0x0000000009C76000-memory.dmp

Filesize
408KB

Download
memory/960-132-0x0000000000F30000-0x000000000102E000-memory.dmp

Filesize
1016KB

Download
memory/1228-139-0x0000000000000000-mapping.dmp

Download
memory/2576-154-0x0000000002D60000-0x0000000002E4D000-memory.dmp

Filesize
948KB

Download
memory/2576-174-0x0000000007260000-0x0000000007312000-memory.dmp

Filesize
712KB

Download
memory/2576-172-0x0000000007260000-0x0000000007312000-memory.dmp

Filesize
712KB

Download
memory/3420-164-0x0000000000401000-0x000000000042F000-memory.dmp

Filesize
184KB

Download
memory/3420-153-0x0000000000EC0000-0x0000000000ED0000-memory.dmp

Filesize
64KB

Download
memory/3420-144-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3420-163-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3420-148-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3420-149-0x0000000000401000-0x000000000042F000-memory.dmp

Filesize
184KB

Download
memory/3420-143-0x0000000000000000-mapping.dmp

Download
memory/3420-152-0x0000000001340000-0x000000000168A000-memory.dmp

Filesize
3.3MB

Download
memory/4392-167-0x0000000002CB0000-0x0000000002FFA000-memory.dmp

Filesize
3.3MB

Download
memory/4392-162-0x0000000000000000-mapping.dmp

Download
memory/4392-173-0x00000000008E0000-0x000000000090D000-memory.dmp

Filesize
180KB

Download
memory/4392-171-0x0000000002AE0000-0x0000000002B6F000-memory.dmp

Filesize
572KB

Download
memory/4392-168-0x00000000008E0000-0x000000000090D000-memory.dmp

Filesize
180KB

Download
memory/4392-166-0x0000000000940000-0x0000000000967000-memory.dmp

Filesize
156KB

Download
memory/4416-142-0x0000000005180000-0x00000000057A8000-memory.dmp

Filesize
6.2MB

Download
memory/4416-158-0x0000000007860000-0x0000000007EDA000-memory.dmp

Filesize
6.5MB

Download
memory/4416-161-0x00000000074A0000-0x0000000007536000-memory.dmp

Filesize
600KB

Download
memory/4416-159-0x0000000007220000-0x000000000723A000-memory.dmp

Filesize
104KB

Download
memory/4416-147-0x0000000004FF0000-0x0000000005056000-memory.dmp

Filesize
408KB

Download
memory/4416-151-0x0000000005F20000-0x0000000005F3E000-memory.dmp

Filesize
120KB

Download
memory/4416-165-0x0000000007450000-0x000000000745E000-memory.dmp

Filesize
56KB

Download
memory/4416-160-0x0000000007290000-0x000000000729A000-memory.dmp

Filesize
40KB

Download
memory/4416-145-0x0000000004E50000-0x0000000004E72000-memory.dmp

Filesize
136KB

Download
memory/4416-157-0x00000000064C0000-0x00000000064DE000-memory.dmp

Filesize
120KB

Download
memory/4416-169-0x0000000007560000-0x000000000757A000-memory.dmp

Filesize
104KB

Download
memory/4416-170-0x0000000007540000-0x0000000007548000-memory.dmp

Filesize
32KB

Download
memory/4416-156-0x0000000074F70000-0x0000000074FBC000-memory.dmp

Filesize
304KB

Download
memory/4416-140-0x0000000002650000-0x0000000002686000-memory.dmp

Filesize
216KB

Download
memory/4416-155-0x0000000006EF0000-0x0000000006F22000-memory.dmp

Filesize
200KB

Download
memory/4416-138-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads