formbook | cc8fab47732be49333428c71d3c6dfa04663cb9bb2bc388f0dbb2c303e067150

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 13:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
New Inquiry.exe
Size 792KB
Sample221003-ql79fshac6
SHA256 cc8fab47732be49333428c71d3c6dfa04663cb9bb2bc388f0dbb2c303e067150
MD5 2303cddd86181ded5023331ecc15ef5a
SHA1 5e99544e1a88fc6fb601ca28fccb168f5c53ef9d
SHA512 2afff78ca3b566123bf58d5a74786c954a261570c2c35240ca9d08e176c32fb07186cfc00aef612ff0aad2ddde9d2bb2888a610945bec983b281ffd60d47b48e
SSDEEP 12288:atvX3E3BtLtcLw6bXQnyiwxc/OyYDtxA/x/qrzlVic8ZBs:atvX3E3BtLtcjxW/lYDw/srzkZB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook r83r rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

r83r

Decoy

dF1arqf0q8jqGHpo
3s5obdLT/D42OkXYzXA=
MY4GqPg1TNBZiXEkrsyhlycGUN24oOaU
wKsmWEGSmhvRwo4=
jXeqRbgNrXzVBjEkt+Ircn8q8uqLRxB04g==
kWzwCGp3hZyQemHg2Ho=
vlaarHzH3YTtXSLeyQ==
LSNL62SxS36qDZBx
QzB7kGyuEkIf
AFmNF5DlgUzZjArFIxovHKlaz9E74po=
C/cWvSksOW1y2Gdi
5FdJf9GEwRvRwo4=
szFiiGFq8ubjqCPe/ChZC0g=
AWObGX3KVG9bBtWG4Mu5
80uIK32XLmNVA4xryvpajNA0
10WHLY+Nqu3Pkw/cKRD3Y6pVG8jd
kW/9OTF2FgXkki8UJM8K1vSogA0XnQ==
mAtF/lLM2RvRwo4=
VNFX6OUCoH1rU0XYzXA=
qAdGBejjez+ZCfPo0A==
yTR2+GKnGsAJQ1FKSid6ocYt
JyBe6lqrOf1t5Cn4xS5Y3cB2Mw==
syE7MRBZYJSHoqItMsis
/WeHjltQ+jUs3nR28RZR3cB2Mw==
Fe7zgspEodA/gg==
shdWfUhT/Ar8rlM4BiMlNQ==
ta0kJZidw0f345c=
uCWQHPUF/j0zHwK123Y=
XcENsP/+NnZUQkXYzXA=
2UrZd9kTJbAoKtaYjO9xnkw=
PbE5xsPhZ009BYhHn5KngqUJsGINig==
TLQwww9Sge1JcGA4EK73J5PEayo=
QrflC+Lz7CAR/bacnkdpcCUQVN64oOaU
kY7GaLLD8HXXCgvZlojjIg==
8lagWtvn5l7UXSLeyQ==
Qqon50dcodA/gg==
7NQKC+03QHRWQEXYzXA=
qQNU8kJQodA/gg==
AVmNPaGttjem1+a+uzJa3cB2Mw==
f+lR7c7ihnk9o8pF3cq7
UcJSAGm24mULzreoju9xnkw=
TDtu5jN5B8pAiqJk+iZajNA0
rqkrVd/SfFQyCJlF3cq7
wzKmM4vWbi6SAks4x/pajNA0
pAWQEPb0imHXXSLeyQ==
2MDsmgcWGIvx8p1xz8HmlJPEayo=
w7Pfeek1cQRgUPu9u2aVkHFZP7/57pI=
hfdtMLMEIIziEhvilojjIg==
H3OtS88kV8o5jbaAWQZe3cB2Mw==
6N0VtR91JvRsuKQtMsis
s7Hfb8TR31DTLY5F3cq7
mIOpRcUbkz7qGHpo
FgllXfJJw4DzYbi+iOd1N4FmqiI=
qhtb2+X+imZGDpNy1P4tlcUnKNq4oOaU
7NUQxzg7a7qz8Ukk3g==
C/EjxD2VO3JfB9WG4Mu5
uiNMY1JQ2p4JZdDKMSlajNA0
kAVCQSRxcZldCKeKjO9xnkw=
RyOeuzx/YiCXnohsPqyp3cB2Mw==
Q7gooXZ6LvJvM0Q3G5az
gOQYSDEqXsYcTHQtMsis
gfYpIfpLQMIfEPTT1nVlZt59GpLE
FX/6mJ+5Szoq65qV1PZajNA0
GgFyk4HS2Uf35ZM=
yankeebuilder.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	New Inquiry.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1440 set thread context of 748	1440	New Inquiry.exe	93
PID 748 set thread context of 3048	748	New Inquiry.exe	56
PID 4072 set thread context of 3048	4072	wscript.exe	56

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	wscript.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
748	New Inquiry.exe
748	New Inquiry.exe
748	New Inquiry.exe
748	New Inquiry.exe
748	New Inquiry.exe
748	New Inquiry.exe
748	New Inquiry.exe
748	New Inquiry.exe
4072	wscript.exe
4072	wscript.exe
4072	wscript.exe
4072	wscript.exe
4072	wscript.exe
4072	wscript.exe
4072	wscript.exe
4072	wscript.exe
4072	wscript.exe
4072	wscript.exe
4072	wscript.exe
4072	wscript.exe
4072	wscript.exe
4072	wscript.exe
4072	wscript.exe
4072	wscript.exe
4072	wscript.exe
4072	wscript.exe
4072	wscript.exe
4072	wscript.exe
4072	wscript.exe
4072	wscript.exe
4072	wscript.exe
4072	wscript.exe
4072	wscript.exe
4072	wscript.exe
4072	wscript.exe
4072	wscript.exe
4072	wscript.exe
4072	wscript.exe
4072	wscript.exe
4072	wscript.exe
4072	wscript.exe
4072	wscript.exe
4072	wscript.exe
4072	wscript.exe
4072	wscript.exe
4072	wscript.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3048	Explorer.EXE

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
748	New Inquiry.exe
748	New Inquiry.exe
748	New Inquiry.exe
4072	wscript.exe
4072	wscript.exe
4072	wscript.exe
4072	wscript.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	748	New Inquiry.exe
Token: SeDebugPrivilege	4072	wscript.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 748	1440	New Inquiry.exe	93
PID 1440 wrote to memory of 748	1440	New Inquiry.exe	93
PID 1440 wrote to memory of 748	1440	New Inquiry.exe	93
PID 1440 wrote to memory of 748	1440	New Inquiry.exe	93
PID 1440 wrote to memory of 748	1440	New Inquiry.exe	93
PID 1440 wrote to memory of 748	1440	New Inquiry.exe	93
PID 3048 wrote to memory of 4072	3048	Explorer.EXE	112
PID 3048 wrote to memory of 4072	3048	Explorer.EXE	112
PID 3048 wrote to memory of 4072	3048	Explorer.EXE	112
PID 4072 wrote to memory of 948	4072	wscript.exe	119
PID 4072 wrote to memory of 948	4072	wscript.exe	119
PID 4072 wrote to memory of 948	4072	wscript.exe	119

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Users\Admin\AppData\Local\Temp\New Inquiry.exe
  "C:\Users\Admin\AppData\Local\Temp\New Inquiry.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1440
- - C:\Users\Admin\AppData\Local\Temp\New Inquiry.exe
    "C:\Users\Admin\AppData\Local\Temp\New Inquiry.exe"
    3⤵
    - Checks computer location settings
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:748
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:3840
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:2424
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:3828
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:868
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:1268
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:3348
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:4760
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:916
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:1084
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:2000
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:4740
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:2944
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:3240
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:4032
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:4480
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:1800
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:3392
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:3068
- C:\Windows\SysWOW64\wscript.exe
  "C:\Windows\SysWOW64\wscript.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4072
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:948

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/748-139-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/748-145-0x0000000000F60000-0x0000000000F70000-memory.dmp

Download

memory/748-144-0x00000000014E0000-0x000000000182A000-memory.dmp

Download

memory/748-143-0x0000000000401000-0x000000000042F000-memory.dmp

Download

memory/748-142-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/748-141-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1440-137-0x00000000072E0000-0x0000000007346000-memory.dmp

Download

memory/1440-136-0x0000000007240000-0x00000000072DC000-memory.dmp

Download

memory/1440-135-0x0000000004B10000-0x0000000004B1A000-memory.dmp

Download

memory/1440-134-0x0000000004B30000-0x0000000004BC2000-memory.dmp

Download

memory/1440-133-0x0000000005040000-0x00000000055E4000-memory.dmp

Download

memory/1440-132-0x00000000000A0000-0x000000000016C000-memory.dmp

Download

memory/3048-153-0x00000000088F0000-0x0000000008A77000-memory.dmp

Download

memory/3048-146-0x0000000008380000-0x00000000084FA000-memory.dmp

Download

memory/3048-154-0x00000000088F0000-0x0000000008A77000-memory.dmp

Download

memory/4072-149-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4072-151-0x00000000023A0000-0x000000000242F000-memory.dmp

Download

memory/4072-152-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4072-150-0x00000000025A0000-0x00000000028EA000-memory.dmp

Download

memory/4072-148-0x0000000000C70000-0x0000000000C97000-memory.dmp

Download