formbook | 91c69e984e53cc30d77e21fcb1a44044fff62368ee2740f04b3b26bfb82f2967

Analysis

max time kernel
152s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 10:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PURCHASE ORDER.exe
Size 780KB
Sample221002-l5mpmsaec9
SHA256 91c69e984e53cc30d77e21fcb1a44044fff62368ee2740f04b3b26bfb82f2967
MD5 f98bec40f03d25ad5b32a76d9c2ec644
SHA1 8d92bbb1f1d103edd65ae7f0c607bb255b2d025e
SHA512 251e97202be44ff44342cc95d7df56f23d7ccad49495340e2acc1859b54003ef1cb98621b305d7c99a4c4dcf43c8e67af0c32aee024f461eebd2458ea41ae9ac
SSDEEP 12288:oAr2iNEmbRuWQbYMoqIydCZUjisTh6GD5BWjULBmb:N1ziDIA0Uhr5kju
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook uymo rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

uymo

Decoy

A4J+j1lFUiMbPgQD0uzpdg==
F3lajp/JwxgpzPZ3bf9zrK0EzWDU/JY=
bOCwjfx/jOF4Las6GFv7+tQ=
9BDZHgUVSa1ypSWjNcPR
S9u+wp+ai+yEW4OWIQ==
wXxiP8BRWDG2JiTw5XA=
VeumNjNg3QeL/qtw
KYxbMI9RU7eqPpEYg1v7+tQ=
zwfU2Vv4NxXzDLy1IWFrDo3iqOoV1KB3
0XQ3wM3oGntH+iTw5XA=
nx7p2XIfYkHv9+Uu+VKx3l41j3mS454=
+BIOmtNni5xbAo5VEZFYQFAw
tkQa0SXOEjV/0yTw5XA=
YOLHv42Us4eMrHCod80dYluXJzNn
HZdsbBNsdAvOq+cr4CaIfg==
YlQ/0dwFQYtd+DXIxzKUlO8kBc9C9A==
mCL+zS69yZ9DyvVMC4399tE/Xk0V1KB3
+tXLkwCl2LyCqaNnalv7+tQ=
yPzM2bjLKPyixsjWSoWe9NI=
KQPQVL5puBHigv/RmyAU0ExD4GDU/JY=
JvKyLYsRMI2eQH4OQrebYQ==
HvrKKC9HQdKSW4OWIQ==
p9Sx6ie6rYwuxDm5sQbZ
UaaHyOMC+VT0Q3/1g82zLvwXcl1+
66h/Ay3OGvu/EiTw5XA=
PXw/UO+Fm7Bx5SWEL6cRC5YvSwRwCsN/
Q0EktsDXF4M+v+O5jgzO
x9Kw+8TDzSQYyA9uGFpUp06Ywg==
ZLBtbv+o8Pfz3kbXRID+Bs2RKmr1Y04b5A==
Osy8wKGdt5mXpm52/Flbp06Ywg==
a/i5N40UXcn0GNTLR1rmrvkALU0=
KR/wD+0NEqt/W4OWIQ==
2IRS4je8+cSuTIMUEFv7+tQ=
G3pJUeaZF+49W4OWIQ==
cx7olwCt/6K97JpoDHow8EvAl+dw
K6Jc4l8WqbXE
mYFozKXUK7zUgdNTV93qhvE4
BW9RWSo1MY8tRjFxN5Htp06Ywg==
hc+pu5Suqw8QnZmuhctYQFAw
sFAJl/t7tBhCaSe5sQbZ
MG1EEShq9h/ae+c=
1ibC9F5Npwk=
68qwb3sWqbXE
/PjVVbxRrjMwW4OWIQ==
Rsy3gq6/sg==
i5tqtbri2SfQBQ1KElv7+tQ=
eKiFlF5eqbaL/qtw
9q6BF270EWZsBy91cLQWC9Y=
ExLkJvn7EKVudy65sQbZ
TgDl2cXOEr2kLiTw5XA=
c93K2KWlHs9W8STw5XA=
BY6GjF6ClSTg7OO5jgzO
TX5lkGNnpv/R9A==
hOKqhe2K0sB4XAgC0uzpdg==
njAAwivU9M1kwnwLfFv7+tQ=
tuCt6svLyxcDrfhHQrebYQ==
YgFhX0yTVL5EuO8=
BE4kVDdOjvOjDi56Klv7+tQ=
Lr6Qa81hdlH6qzm5sQbZ
RJ92hwuPn3oQqi65sQbZ
C1EcGPQnM5EvQzBwKVv7+tQ=
hO7e83wwjpdAyQF46fGqKv0Xcl1+
4cuR28DW6bUyJdWnW+XtlpmciXEj7Q==
skDwJ+vzKjvc/g==
cdrhdl.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\Geo\Nation	PURCHASE ORDER.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 328 set thread context of 1832	328	PURCHASE ORDER.exe	33
PID 1832 set thread context of 1412	1832	PURCHASE ORDER.exe	14

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1036	schtasks.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
328	PURCHASE ORDER.exe
328	PURCHASE ORDER.exe
328	PURCHASE ORDER.exe
328	PURCHASE ORDER.exe
328	PURCHASE ORDER.exe
328	PURCHASE ORDER.exe
328	PURCHASE ORDER.exe
328	PURCHASE ORDER.exe
328	PURCHASE ORDER.exe
328	PURCHASE ORDER.exe
328	PURCHASE ORDER.exe
328	PURCHASE ORDER.exe
328	PURCHASE ORDER.exe
328	PURCHASE ORDER.exe
328	PURCHASE ORDER.exe
328	PURCHASE ORDER.exe
328	PURCHASE ORDER.exe
328	PURCHASE ORDER.exe
328	PURCHASE ORDER.exe
328	PURCHASE ORDER.exe
328	PURCHASE ORDER.exe
328	PURCHASE ORDER.exe
328	PURCHASE ORDER.exe
328	PURCHASE ORDER.exe
328	PURCHASE ORDER.exe
1832	PURCHASE ORDER.exe
1832	PURCHASE ORDER.exe
1832	PURCHASE ORDER.exe
1832	PURCHASE ORDER.exe
1488	powershell.exe
880	powershell.exe
1912	netsh.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
1832	PURCHASE ORDER.exe
1832	PURCHASE ORDER.exe
1832	PURCHASE ORDER.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	328	PURCHASE ORDER.exe
Token: SeDebugPrivilege	1832	PURCHASE ORDER.exe
Token: SeDebugPrivilege	1488	powershell.exe
Token: SeDebugPrivilege	880	powershell.exe
Token: SeDebugPrivilege	1912	netsh.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 328 wrote to memory of 1488	328	PURCHASE ORDER.exe	27
PID 328 wrote to memory of 1488	328	PURCHASE ORDER.exe	27
PID 328 wrote to memory of 1488	328	PURCHASE ORDER.exe	27
PID 328 wrote to memory of 1488	328	PURCHASE ORDER.exe	27
PID 328 wrote to memory of 880	328	PURCHASE ORDER.exe	29
PID 328 wrote to memory of 880	328	PURCHASE ORDER.exe	29
PID 328 wrote to memory of 880	328	PURCHASE ORDER.exe	29
PID 328 wrote to memory of 880	328	PURCHASE ORDER.exe	29
PID 328 wrote to memory of 1036	328	PURCHASE ORDER.exe	31
PID 328 wrote to memory of 1036	328	PURCHASE ORDER.exe	31
PID 328 wrote to memory of 1036	328	PURCHASE ORDER.exe	31
PID 328 wrote to memory of 1036	328	PURCHASE ORDER.exe	31
PID 328 wrote to memory of 1832	328	PURCHASE ORDER.exe	33
PID 328 wrote to memory of 1832	328	PURCHASE ORDER.exe	33
PID 328 wrote to memory of 1832	328	PURCHASE ORDER.exe	33
PID 328 wrote to memory of 1832	328	PURCHASE ORDER.exe	33
PID 328 wrote to memory of 1832	328	PURCHASE ORDER.exe	33
PID 328 wrote to memory of 1832	328	PURCHASE ORDER.exe	33
PID 328 wrote to memory of 1832	328	PURCHASE ORDER.exe	33
PID 1412 wrote to memory of 1912	1412	Explorer.EXE	35
PID 1412 wrote to memory of 1912	1412	Explorer.EXE	35
PID 1412 wrote to memory of 1912	1412	Explorer.EXE	35
PID 1412 wrote to memory of 1912	1412	Explorer.EXE	35

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER.exe
  "C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:328
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1488
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\LCxTzOU.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:880
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LCxTzOU" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8F46.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:1036
- - C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER.exe
    "C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER.exe"
    3⤵
    - Checks computer location settings
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:1832
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:1820
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\SysWOW64\netsh.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1912

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp8F46.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp8F46.tmp
Size 1KB
SHA256 77cfb4c19a0cf9174beea2039cfd8280a46f72f787e07b11e7e4b6f6ca5a0d27
MD5 298eda6d0fef94df292af6eb3e1f6f42
SHA1 e90ff660877a09cd9e90061dfbccfecdb471a458
SHA512 0336a5a67dfa3e982d8bcdb5f1db28515c7b358dea2e7f72ee6fd0de1180a4b0b80585cd486415c5e3dbb0504e7ab7819fdce190263ba04eb42ebfa6639c5b37
MD5 SHA1 SHA512

Submit Download

d93f411851d7c929.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Size 7KB
SHA256 0578dec377de3bddf6d176674428068e28164430cee37c01004e674217229ccc
MD5 71ffd4195d4454480a03b54193b4c70b
SHA1 57064f676beee540f53c8d279d51a0cdf14f0e45
SHA512 4ba0a00be7a37e28a3c51eaedf1524651c1275e4111d1608623bcd0223feb7d4f6d18a4403fd98b6452d9cbc31d1ac2aaceb81e773965585e6b0f93118c7c35d
SSDEEP 96:IxmxCoBM8ynqvsqvJCwoW0v00xmxCoBM8ynqvsEHyqvJCwor80v0qLOsQHfQ70Kf:4YmUozYmAHnorJ1qQ70Kf
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/328-55-0x0000000075ED1000-0x0000000075ED3000-memory.dmp

Download

memory/328-56-0x00000000004B0000-0x00000000004C4000-memory.dmp

Download

memory/328-57-0x00000000008A0000-0x00000000008B4000-memory.dmp

Download

memory/328-58-0x0000000000A80000-0x0000000000A8C000-memory.dmp

Download

memory/328-59-0x0000000006010000-0x000000000609E000-memory.dmp

Download

memory/328-54-0x0000000000B20000-0x0000000000BEA000-memory.dmp

Download

memory/328-69-0x0000000004E10000-0x0000000004E44000-memory.dmp

Download

memory/880-68-0x000000006EBE0000-0x000000006F18B000-memory.dmp

Download

memory/880-84-0x000000006EBE0000-0x000000006F18B000-memory.dmp

Download

memory/1412-81-0x00000000050F0000-0x00000000051FF000-memory.dmp

Download

memory/1488-67-0x000000006EBE0000-0x000000006F18B000-memory.dmp

Download

memory/1488-83-0x000000006EBE0000-0x000000006F18B000-memory.dmp

Download

memory/1832-70-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1832-76-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1832-77-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1832-78-0x0000000000401000-0x000000000042F000-memory.dmp

Download

memory/1832-79-0x0000000000BF0000-0x0000000000EF3000-memory.dmp

Download

memory/1832-80-0x00000000000F0000-0x0000000000100000-memory.dmp

Download

memory/1832-73-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1832-71-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1912-85-0x0000000001FC0000-0x00000000022C3000-memory.dmp

Download

memory/1912-86-0x0000000000A10000-0x0000000000A2B000-memory.dmp

Download

memory/1912-87-0x0000000000190000-0x00000000001BD000-memory.dmp

Download