formbook | 5032a3dbc97f17dba5cf4a7dc67a6c9ae6293a344d9d9433d63e8cd180226927

General

Target

Quotation.exe
Size

991KB
MD5

59d24bcc44a883d21a48b2d368a1ff45
SHA1

d933aac89872b6a5f60901563b19c6715a0d007a
SHA256

5032a3dbc97f17dba5cf4a7dc67a6c9ae6293a344d9d9433d63e8cd180226927
SHA512

9281ea610f54c4df7f849d4c9e9021b6b3983a04ce0c6606db587d8d3b412de0494a1717adc9e701947ddd97f40216768d40af96983ad95449040e5bccbdecaf
SSDEEP

12288:dHeyEXo6MY++34Ot1UzDMHvRJUHoPYFoBMmTA0+bB/jIyBXRsZZ4wiPWL1QORWl5:m/DkM1nHvRJ9PYqs0+5FXk+P41Q7BBz

Score

10^/10

formbook nhg6 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

nhg6

Decoy

FSZGb3Of7ECMIOG9mh1ql/w=

DAPP3Pm63eo+zg==

khOZTuClxYsKQsZALgy3ob9TFAk=

5uWol2f/RF3CAwFd

P70LqPOi2iE9g4vpPH1Lk8E0K6tC

KBRl7TSt3eo+zg==

rqedJWUJXKkDbORa

lpORtIg8lvMKbJ77PQW9kes=

Qinv+gsohAIooqyTcfUYgZ/IVxQ=

J0L2ggPAiE2gxm4=

r/I6qOGI5noJCghf

khJg6HKM6l9okVK+pg==

HRMTK/6p3eo+zg==

HqMiuv2JaKYJCghf

+FzGYtsGTpK46OkKkh5C

BBrOUpUY91R/r8gkPwrcuw==

klWfn2smdNcqog581h6vX7px

t8uvr7+R7IPaHSOH1hqvX7px

bHdghkj64OjzY2hOLa/WObrRkkeJjQ==

s3/smhoylh1J0mPS4aDHBDRyJw==

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Loads dropped DLL 1 IoCs

Processes:

raserver.exe

pid process

608 raserver.exe

pid	process
608	raserver.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

Quotation.exeRegSvcs.exeraserver.exe

description	pid	process	target process
PID 1976 set thread context of 1812	1976	Quotation.exe	RegSvcs.exe
PID 1812 set thread context of 1284	1812	RegSvcs.exe	Explorer.EXE
PID 1812 set thread context of 1284	1812	RegSvcs.exe	Explorer.EXE
PID 608 set thread context of 1284	608	raserver.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1464 schtasks.exe

pid	process
1464	schtasks.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

raserver.exe

description	ioc	process
Key created	\Registry\User\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	raserver.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

Processes:

Quotation.exeRegSvcs.exepowershell.exeraserver.exe

pid	process
1976	Quotation.exe
1976	Quotation.exe
1812	RegSvcs.exe
1812	RegSvcs.exe
1812	RegSvcs.exe
1812	RegSvcs.exe
1976	Quotation.exe
840	powershell.exe
1812	RegSvcs.exe
608	raserver.exe
608	raserver.exe
608	raserver.exe
608	raserver.exe
608	raserver.exe
608	raserver.exe
608	raserver.exe
608	raserver.exe
608	raserver.exe
608	raserver.exe
608	raserver.exe
608	raserver.exe

Suspicious behavior: MapViewOfSection 8 IoCs

Processes:

RegSvcs.exeraserver.exe

pid process

1812 RegSvcs.exe
1812 RegSvcs.exe
1812 RegSvcs.exe
1812 RegSvcs.exe
608 raserver.exe
608 raserver.exe
608 raserver.exe
608 raserver.exe

pid	process
1812	RegSvcs.exe
1812	RegSvcs.exe
1812	RegSvcs.exe
1812	RegSvcs.exe
608	raserver.exe
608	raserver.exe
608	raserver.exe
608	raserver.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

Quotation.exeRegSvcs.exepowershell.exeraserver.exe

description	pid	process
Token: SeDebugPrivilege	1976	Quotation.exe
Token: SeDebugPrivilege	1812	RegSvcs.exe
Token: SeDebugPrivilege	840	powershell.exe
Token: SeDebugPrivilege	608	raserver.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1284 Explorer.EXE
1284 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1284 Explorer.EXE
1284 Explorer.EXE

pid	process
1284	Explorer.EXE
1284	Explorer.EXE

pid	process
1284	Explorer.EXE
1284	Explorer.EXE

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

Quotation.exeExplorer.EXEraserver.exe

description	pid	process	target process
PID 1976 wrote to memory of 840	1976	Quotation.exe	powershell.exe
PID 1976 wrote to memory of 840	1976	Quotation.exe	powershell.exe
PID 1976 wrote to memory of 840	1976	Quotation.exe	powershell.exe
PID 1976 wrote to memory of 840	1976	Quotation.exe	powershell.exe
PID 1976 wrote to memory of 1464	1976	Quotation.exe	schtasks.exe
PID 1976 wrote to memory of 1464	1976	Quotation.exe	schtasks.exe
PID 1976 wrote to memory of 1464	1976	Quotation.exe	schtasks.exe
PID 1976 wrote to memory of 1464	1976	Quotation.exe	schtasks.exe
PID 1976 wrote to memory of 1812	1976	Quotation.exe	RegSvcs.exe
PID 1976 wrote to memory of 1812	1976	Quotation.exe	RegSvcs.exe
PID 1976 wrote to memory of 1812	1976	Quotation.exe	RegSvcs.exe
PID 1976 wrote to memory of 1812	1976	Quotation.exe	RegSvcs.exe
PID 1976 wrote to memory of 1812	1976	Quotation.exe	RegSvcs.exe
PID 1976 wrote to memory of 1812	1976	Quotation.exe	RegSvcs.exe
PID 1976 wrote to memory of 1812	1976	Quotation.exe	RegSvcs.exe
PID 1976 wrote to memory of 1812	1976	Quotation.exe	RegSvcs.exe
PID 1976 wrote to memory of 1812	1976	Quotation.exe	RegSvcs.exe
PID 1976 wrote to memory of 1812	1976	Quotation.exe	RegSvcs.exe
PID 1284 wrote to memory of 608	1284	Explorer.EXE	raserver.exe
PID 1284 wrote to memory of 608	1284	Explorer.EXE	raserver.exe
PID 1284 wrote to memory of 608	1284	Explorer.EXE	raserver.exe
PID 1284 wrote to memory of 608	1284	Explorer.EXE	raserver.exe
PID 608 wrote to memory of 2004	608	raserver.exe	Firefox.exe
PID 608 wrote to memory of 2004	608	raserver.exe	Firefox.exe
PID 608 wrote to memory of 2004	608	raserver.exe	Firefox.exe
PID 608 wrote to memory of 2004	608	raserver.exe	Firefox.exe
PID 608 wrote to memory of 2004	608	raserver.exe	Firefox.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1284

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1976

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\OJGfLeUSALnpf.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:840

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OJGfLeUSALnpf" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1363.tmp"
3⤵
- Creates scheduled task(s)
PID:1464

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1812

C:\Windows\SysWOW64\raserver.exe
"C:\Windows\SysWOW64\raserver.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:608

C:\Program Files\Mozilla Firefox\Firefox.exe
"C:\Program Files\Mozilla Firefox\Firefox.exe"
3⤵
PID:2004

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp1363.tmp
Filesize
1KB

MD5
9a2153fb3166791a0907db74b5ead471

SHA1
b017d8f2d7aa11f8c762084c5c961e9254470dc4

SHA256
64dd77e22128d2ccab300dceee013d134f5e4eb3973fcbe383dcba268696ed8b

SHA512
20d3c882a110c350eacd8354879a00b8c2adf252fa5bfa8678d4779010bffc5fd5a07ad75e847c040db606148e315ed377cd1b0a3ab5e8de94e4f1c9c3295d87

Download Submit
\Users\Admin\AppData\Local\Temp\sqlite3.dll
Filesize
904KB

MD5
5e5ba61531d74e45b11cadb79e7394a1

SHA1
677224e14aac9dd35f367d5eb1704b36e69356b8

SHA256
99e91ae250c955bd403ec1a2321d6b11fcb715bdcc7cb3f63ffb46b349afde5c

SHA512
712bfe419ba97ecf0ec8323a68743013e8c767da9d986f74ab94d2a395c3086cac2a5823048e0022d3bbcebb55281b9e1f8c87fdc9295c70cc5521b57850bf46

Download Submit
memory/608-81-0x0000000000000000-mapping.dmp

Download
memory/608-90-0x0000000000080000-0x00000000000AD000-memory.dmp

Filesize
180KB

Download
memory/608-88-0x0000000001DA0000-0x0000000001E2F000-memory.dmp

Filesize
572KB

Download
memory/608-87-0x0000000001F90000-0x0000000002293000-memory.dmp

Filesize
3.0MB

Download
memory/608-86-0x0000000000080000-0x00000000000AD000-memory.dmp

Filesize
180KB

Download
memory/608-85-0x0000000000100000-0x000000000011C000-memory.dmp

Filesize
112KB

Download
memory/840-73-0x000000006E240000-0x000000006E7EB000-memory.dmp

Filesize
5.7MB

Download
memory/840-59-0x0000000000000000-mapping.dmp

Download
memory/840-77-0x000000006E240000-0x000000006E7EB000-memory.dmp

Filesize
5.7MB

Download
memory/1284-76-0x0000000004410000-0x000000000451C000-memory.dmp

Filesize
1.0MB

Download
memory/1284-91-0x00000000061F0000-0x00000000062B3000-memory.dmp

Filesize
780KB

Download
memory/1284-89-0x00000000061F0000-0x00000000062B3000-memory.dmp

Filesize
780KB

Download
memory/1284-80-0x0000000006A30000-0x0000000006B3A000-memory.dmp

Filesize
1.0MB

Download
memory/1464-60-0x0000000000000000-mapping.dmp

Download
memory/1812-72-0x0000000000401000-0x000000000042F000-memory.dmp

Filesize
184KB

Download
memory/1812-83-0x0000000000401000-0x000000000042F000-memory.dmp

Filesize
184KB

Download
memory/1812-75-0x0000000000170000-0x0000000000180000-memory.dmp

Filesize
64KB

Download
memory/1812-64-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1812-65-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1812-79-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/1812-71-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1812-82-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1812-67-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1812-74-0x0000000000890000-0x0000000000B93000-memory.dmp

Filesize
3.0MB

Download
memory/1812-70-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1812-68-0x00000000004012B0-mapping.dmp

Download
memory/1976-58-0x0000000006040000-0x0000000006108000-memory.dmp

Filesize
800KB

Download
memory/1976-57-0x00000000004F0000-0x00000000004FC000-memory.dmp

Filesize
48KB

Download
memory/1976-63-0x0000000007F50000-0x0000000007FC0000-memory.dmp

Filesize
448KB

Download
memory/1976-56-0x0000000000300000-0x0000000000314000-memory.dmp

Filesize
80KB

Download
memory/1976-54-0x0000000000AC0000-0x0000000000BBE000-memory.dmp

Filesize
1016KB

Download
memory/1976-55-0x0000000074D81000-0x0000000074D83000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads