formbook | 714e4e1608cc5486e6ebbb112c3dda90ce2398d346539ef636adb31d5268ee58

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
04/10/2022, 10:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PO.41022.pdf.exe
Size 1.1MB
Sample221004-l43dpsaee2
SHA256 714e4e1608cc5486e6ebbb112c3dda90ce2398d346539ef636adb31d5268ee58
MD5 611cac35588e905fd549327d435c80fb
SHA1 f6871a3d076f654bd444ddb5b463ae59751c2236
SHA512 2a947a119e143898dafae97eb353bdb18b192a27bcc1fdc224c3960e234fc4a29bdc0606cc53006eca3315665af072bba9542b0858a19b2dc7b20a3d7633fbe6
SSDEEP 12288:sfaK4HTNwJ8KROwE4n332sIxfc3jnTVtjtTLnDTOBPtJ/WzAw+HUzPIvuUa6XyGx:IBFF2sJznT7tfXODJxt0zgWyzWhj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook tz8t rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

tz8t

Decoy

NFk7MP6QpDFJEJrVpUy0
GEMrXu+Hnm9IKFxy
IT8gJF3/gCxP
7dtVECE6S0wDp06OGg==
kzuhI3D1M9lFyzWhFA==
UVGjAr/aAiVEBPtKKrIHS8c=
LUoV7DnQCbhftSNxAa/sb9o=
gBXNjrxhyASzXx9kAw==
6o0Vl1R+tXIKX8MLl075wvb+
wWleMnYYLapbM/cZKrIHS8c=
mxcAPMpdoFgFWMnluG7HiA==
Lc8s0dmxDB7HJA==
fNexBb7nimQMfDM=
/wFu2LTK4fCH1sEQoIB5gwZYMbig
9ZsAf01ejq1YOX+fR9iK7DQUpO65
kk66JPP8RtSC3lTXoWfy8W8RpInmvB3fWg==
y//p1p2nIgC2Ig==
6csYfkRRU1wPp06OGg==
OjvSTCtGd5JAKOFmIMGghg==
Cr/W0C7J+w5GXx9kAw==
3HvUO4khN0j+0WjwqVYHU3tYMbig
LZciY1N6IgC2Ig==
4YU8M2wPeCBL
rp0Fz9nzbmiJbDY=
+qsPdjBUioxNEJrVpUy0
KJ/+1cPWFzXeIhiZOUMlg5vvC1w=
k59lSqQvQUJpTRUr06/sb9o=
+Ok43+X6Rn9XfjU=
lhkoZuROvOxQ4NJYJAf9RcM=
XlY5PA4qSRV9XCo=
ABUeOLRjvTZW
AuoP0wrYC64=
SZb1lhWn5X0q5q780q/sb9o=
rxhfx4a3IgC2Ig==
/priiCK02HZRZgN6
mUe0QJ4xZwOyE5/VpUy0
megX8EFMeNA2C2NxXynXnQ==
xnvkVgkNKUj2zhFMHjJaKiCxdw==
AiUkP01li9Zz14+aPSHfNVX50Ijs+G0=
PLLuVh9LiaoXwNFdFSkOe9X5
t6MF0unVHbA=
zvTuNtFgZ+0K4m6vi4Mz+W3v
KVEmT8taewwxHLkvt6VYKKxBoPXmvB3fWg==
YHZDYWqNtlAR5vF5jBTOnw==
YohnPg4UT2+Sa2aojBTOnw==
bVMkRl98y+ZRZgN6
+X/NbPSSsDhuObgHkEKrm3TUZFPKvB3fWg==
nIZockRsrF4DyNDap8A=
/mZEkcSctC9U
ErO8944qaf6a/HGvi4Mz+W3v
1NWsztv8FulbLd0a5d8=
4osd2G0ZQWcS45fVpUy0
M81VLzc9T2DRa0GAGg==
Mml+h2F9zYWtjEVLLwvqZdk=
Fpj9k0tocfyYC5zVpUy0
pyEdZet2liHIG4Svi4Mz+W3v
RbkKskHPC7zt3ITgdC+EbgZYMbig
bO3ZxQyWxs8Ew/bsCuDdZtg=
xy+CGqxHXRGCXCs=
O6Sbo6iHozZP
4N43mmSAtDDifJZUjBTOnw==
ALc0wRCW1xe5Jx1bOyb9bNM=
4ICM0lr5MdMAvy+2eVk+qwXwva31nT4H
bpH9Pj10IgC2Ig==
wwszvfno.buzz

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\Geo\Nation	PO.41022.pdf.exe

Loads dropped DLL 1 IoCs

pid	Process
1844	svchost.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 620 set thread context of 552	620	PO.41022.pdf.exe	27
PID 552 set thread context of 1192	552	PO.41022.pdf.exe	13
PID 1844 set thread context of 1192	1844	svchost.exe	13

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	svchost.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
620	PO.41022.pdf.exe
620	PO.41022.pdf.exe
620	PO.41022.pdf.exe
620	PO.41022.pdf.exe
620	PO.41022.pdf.exe
620	PO.41022.pdf.exe
552	PO.41022.pdf.exe
552	PO.41022.pdf.exe
552	PO.41022.pdf.exe
552	PO.41022.pdf.exe
1844	svchost.exe
1844	svchost.exe
1844	svchost.exe
1844	svchost.exe
1844	svchost.exe
1844	svchost.exe
1844	svchost.exe
1844	svchost.exe
1844	svchost.exe
1844	svchost.exe
1844	svchost.exe
1844	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1192	Explorer.EXE

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
552	PO.41022.pdf.exe
552	PO.41022.pdf.exe
552	PO.41022.pdf.exe
1844	svchost.exe
1844	svchost.exe
1844	svchost.exe
1844	svchost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	620	PO.41022.pdf.exe
Token: SeDebugPrivilege	552	PO.41022.pdf.exe
Token: SeDebugPrivilege	1844	svchost.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
620	PO.41022.pdf.exe
1192	Explorer.EXE
1192	Explorer.EXE

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
620	PO.41022.pdf.exe
1192	Explorer.EXE
1192	Explorer.EXE

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 620 wrote to memory of 552	620	PO.41022.pdf.exe	27
PID 620 wrote to memory of 552	620	PO.41022.pdf.exe	27
PID 620 wrote to memory of 552	620	PO.41022.pdf.exe	27
PID 620 wrote to memory of 552	620	PO.41022.pdf.exe	27
PID 620 wrote to memory of 552	620	PO.41022.pdf.exe	27
PID 620 wrote to memory of 552	620	PO.41022.pdf.exe	27
PID 620 wrote to memory of 552	620	PO.41022.pdf.exe	27
PID 1192 wrote to memory of 1844	1192	Explorer.EXE	28
PID 1192 wrote to memory of 1844	1192	Explorer.EXE	28
PID 1192 wrote to memory of 1844	1192	Explorer.EXE	28
PID 1192 wrote to memory of 1844	1192	Explorer.EXE	28
PID 1844 wrote to memory of 1936	1844	svchost.exe	31
PID 1844 wrote to memory of 1936	1844	svchost.exe	31
PID 1844 wrote to memory of 1936	1844	svchost.exe	31
PID 1844 wrote to memory of 1936	1844	svchost.exe	31
PID 1844 wrote to memory of 1936	1844	svchost.exe	31

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Users\Admin\AppData\Local\Temp\PO.41022.pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\PO.41022.pdf.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:620
- - C:\Users\Admin\AppData\Local\Temp\PO.41022.pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\PO.41022.pdf.exe"
    3⤵
    - Checks computer location settings
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:552
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\SysWOW64\svchost.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1844
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:1936

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sqlite3.dll

Path \Users\Admin\AppData\Local\Temp\sqlite3.dll
Size 888KB
SHA256 6710d91d77e1937dd5b46d96c0852042985dc78c4c51ce12d3e07a4cdb12c202
MD5 9c73b282279e74e40435132e61fda001
SHA1 63c7248e91b68fbde4641e3c5e2dc3e9d38671fa
SHA512 02f9a01a3a5f74ef994ebb9e5f24c6870e2d48c8b99c429a63e74dad73fb581f0b52b2a86d651cafa414675b70a0e85b2e08c843d07e080fe69ee835e3c91108
SSDEEP 24576:Gk99/oB1gHyv1DmZIVHas0Sy4bfR/oVAZzv/Zg:G2KDBmZS6v54zR/2AA
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/552-70-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/552-71-0x0000000000401000-0x000000000042F000-memory.dmp

Download

memory/552-72-0x00000000000A0000-0x00000000000B0000-memory.dmp

Download

memory/552-68-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/552-69-0x0000000000820000-0x0000000000B23000-memory.dmp

Download

memory/552-61-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/552-62-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/552-64-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/620-60-0x0000000005CF0000-0x0000000005D60000-memory.dmp

Download

memory/620-67-0x0000000004E35000-0x0000000004E46000-memory.dmp

Download

memory/620-56-0x00000000004D0000-0x00000000004EC000-memory.dmp

Download

memory/620-59-0x0000000008010000-0x00000000080D8000-memory.dmp

Download

memory/620-58-0x0000000000B30000-0x0000000000B3C000-memory.dmp

Download

memory/620-57-0x0000000004E35000-0x0000000004E46000-memory.dmp

Download

memory/620-55-0x0000000075711000-0x0000000075713000-memory.dmp

Download

memory/620-54-0x00000000011E0000-0x00000000012FE000-memory.dmp

Download

memory/1192-80-0x0000000004670000-0x000000000474C000-memory.dmp

Download

memory/1192-73-0x0000000004E80000-0x0000000004FC3000-memory.dmp

Download

memory/1192-83-0x0000000004670000-0x000000000474C000-memory.dmp

Download

memory/1192-81-0x0000000004E80000-0x0000000004FC3000-memory.dmp

Download

memory/1844-82-0x0000000000080000-0x00000000000AD000-memory.dmp

Download

memory/1844-79-0x0000000000710000-0x000000000079F000-memory.dmp

Download

memory/1844-77-0x0000000000830000-0x0000000000B33000-memory.dmp

Download

memory/1844-76-0x0000000000080000-0x00000000000AD000-memory.dmp

Download

memory/1844-75-0x0000000000550000-0x0000000000558000-memory.dmp

Download