formbook | 73f74f1aec6f93a54aeb2da104556dfd49eeb747a4d88ef3cf9d2bed4ad41b70

Analysis

max time kernel
152s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/10/2022, 09:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Receipts.exe
Size 952KB
Sample221007-lg2tnaccdk
SHA256 73f74f1aec6f93a54aeb2da104556dfd49eeb747a4d88ef3cf9d2bed4ad41b70
MD5 3cd0e10e033f2df74137a0edac59a908
SHA1 d8382d69665bfc5d5032b1a1e1675c87356ced6f
SHA512 7772cacbc218d119752a21116c5a1769ee5527cd1044af7ccca9a4567cb683e5257378780fc0d91c2763bd134aadd40e48ed6ebcb44a444b427b90a9b3ab4949
SSDEEP 12288:J2iNzJ2u6oYTNQojI18eFJS0jspmWH8gHaS7zXe73EHrTbAb:J16JPjIH0AQzJuELT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook 49id rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

49id

Decoy

Lx+qn+IuFHrpYw4aLjqrV0s=
oTFyf7DpzDr0CxnANoHd0ZVn/P8=
trcX/OnzxdkmnRMQYog=
bAVbrILTo2dyzVNRlZs=
iAt82zY2FbeLnZ8ehqD3sK3DSc/7
RthInWSwiITUYAQES3n0
HqXZ8LT4ijH4
4b3T7LD8lizy
5vB1eWJzRz5Ypzm/NYXPcz5O7f0=
cR4+Ihw2Dip6B4MTL5XnkA==
7pPqTAFNLJ5iZ4AlY4LXnYc/2KDXVrE=
OOZBmRMh+XcG5R3WGjmDKfzDSc/7
w9u6j6Eu1IZfM1UZ
zEzLU87y1D/by8xuxcvs5JcY
PsU4iyYvBf8LYQQES3n0
22GzGcX92mw0Hhy89Xng
fzOL5pruzSWaYm79VoD14Vvq1w==
Ltts7l9lO8GnD4kXL5XnkA==
uuw9zZXjqDLEk50zm9Hs5JcY
zk+U6pwAzuk5t3QwM3bxhw==
gCOF2UZYPtZddXQR
vLH05Knz0cSGbmXzWZk=
JUGorKKtP32O2Q==
6qclaLz4ijH4
x1OXDI2RUrUNQnET
QFmIDHVnTxogLzEINHvj
EJHQRfApEaddOTUINHvj
+CBKol+pfUMOsPWN+0emZks=
E8QheypuRpcSkSO5GEJkSFIx647z
2GeeBU2JZBbw
ZnHgG8Yh7yuVGaU8fqr94Vvq1w==
zPOSku43EHTvxb9XjaPv5adgbvU=
LTnDxG+yP32O2Q==
8g8kaQ5TH+jw3PwINHvj
msUTkUmZd1+mBVM1eJE=
+ma+YqM/FGU=
GUFjunSlP32O2Q==
EgxzUUZaKCBcrnAKbw==
AzGMbJ7ruZFd4oIG
hoavisFb/ukmZk4Zcg==
jmsYgVeYP32O2Q==
BowVnTPlP32O2Q==
E5kenwT1xmgzDjLfSmm6WQeBRQwDUaWaXg==
APYiVc4Z3/rCqp3UDEaaPjYQ
myKVEJm1he+EBlM1eJE=
/P99h37MZGiH2w==
WONs30pQKdrAuvgINHvj
5BClnZ2pfasCbCDRSYe0pWUB
43fyQugi9dHZI4YVL5XnkA==
DB9QDERzUN1ddXQR
fg963KT1wnBZZk4Zcg==
WfdUvXfEmNsgZwC/IUlwUAycgfU=
8WuwKKmxgfejcIg0sPU80I0N28jmQKg=
M9b0xZ6ohbULJjHbZQ==
+586s3S+nHBqwTkES3n0
xlB+2oPBiNQmhTjlIz+NSQXCRAwDUaWaXg==
MKvuTuQhhlpd4oIG
qNMmqGLAnVMqA0kKYILj4Vvq1w==
m1O4DDyEbiIMACUSRnfgmA==
AqElj1j9kSr2+BL6BCuBQEI=
lIkMFhActQpizW8=
ucInGmKhhwCTC7G65i1WQEU=
BSa/r5+1P32O2Q==
Se1y2jIwF9Xi6BDeRrmz4Vvq1w==
chitimaarchitects.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	Receipts.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1364 set thread context of 4268	1364	Receipts.exe	91
PID 4268 set thread context of 2456	4268	Receipts.exe	37
PID 4032 set thread context of 2456	4032	netsh.exe	37

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	netsh.exe

Suspicious behavior: EnumeratesProcesses 49 IoCs

pid	Process
1364	Receipts.exe
1364	Receipts.exe
1364	Receipts.exe
1364	Receipts.exe
1364	Receipts.exe
1364	Receipts.exe
1364	Receipts.exe
4268	Receipts.exe
4268	Receipts.exe
4268	Receipts.exe
4268	Receipts.exe
4268	Receipts.exe
4268	Receipts.exe
4268	Receipts.exe
4268	Receipts.exe
4032	netsh.exe
4032	netsh.exe
4032	netsh.exe
4032	netsh.exe
4032	netsh.exe
4032	netsh.exe
4032	netsh.exe
4032	netsh.exe
4032	netsh.exe
4032	netsh.exe
4032	netsh.exe
4032	netsh.exe
4032	netsh.exe
4032	netsh.exe
4032	netsh.exe
4032	netsh.exe
4032	netsh.exe
4032	netsh.exe
4032	netsh.exe
4032	netsh.exe
4032	netsh.exe
4032	netsh.exe
4032	netsh.exe
4032	netsh.exe
4032	netsh.exe
4032	netsh.exe
4032	netsh.exe
4032	netsh.exe
4032	netsh.exe
4032	netsh.exe
4032	netsh.exe
4032	netsh.exe
4032	netsh.exe
4032	netsh.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2456	Explorer.EXE

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
4268	Receipts.exe
4268	Receipts.exe
4268	Receipts.exe
4032	netsh.exe
4032	netsh.exe
4032	netsh.exe
4032	netsh.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1364	Receipts.exe
Token: SeDebugPrivilege	4268	Receipts.exe
Token: SeDebugPrivilege	4032	netsh.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 4268	1364	Receipts.exe	91
PID 1364 wrote to memory of 4268	1364	Receipts.exe	91
PID 1364 wrote to memory of 4268	1364	Receipts.exe	91
PID 1364 wrote to memory of 4268	1364	Receipts.exe	91
PID 1364 wrote to memory of 4268	1364	Receipts.exe	91
PID 1364 wrote to memory of 4268	1364	Receipts.exe	91
PID 2456 wrote to memory of 4032	2456	Explorer.EXE	106
PID 2456 wrote to memory of 4032	2456	Explorer.EXE	106
PID 2456 wrote to memory of 4032	2456	Explorer.EXE	106
PID 4032 wrote to memory of 1420	4032	netsh.exe	107
PID 4032 wrote to memory of 1420	4032	netsh.exe	107
PID 4032 wrote to memory of 1420	4032	netsh.exe	107

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Users\Admin\AppData\Local\Temp\Receipts.exe
  "C:\Users\Admin\AppData\Local\Temp\Receipts.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1364
- - C:\Users\Admin\AppData\Local\Temp\Receipts.exe
    "C:\Users\Admin\AppData\Local\Temp\Receipts.exe"
    3⤵
    - Checks computer location settings
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:4268
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:3032
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:4420
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:2260
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:4380
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:4928
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:2944
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:724
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:2132
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:2872
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:4464
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:4944
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:4528
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:4492
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:4480
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\SysWOW64\netsh.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4032
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:1420

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1364-133-0x0000000005770000-0x0000000005D14000-memory.dmp

Download

memory/1364-134-0x00000000050E0000-0x0000000005172000-memory.dmp

Download

memory/1364-135-0x0000000005190000-0x000000000519A000-memory.dmp

Download

memory/1364-136-0x0000000009FE0000-0x000000000A07C000-memory.dmp

Download

memory/1364-137-0x000000000A400000-0x000000000A466000-memory.dmp

Download

memory/1364-132-0x0000000000660000-0x0000000000752000-memory.dmp

Download

memory/2456-146-0x00000000028F0000-0x00000000029EA000-memory.dmp

Download

memory/2456-154-0x0000000007CC0000-0x0000000007DB3000-memory.dmp

Download

memory/2456-152-0x0000000007CC0000-0x0000000007DB3000-memory.dmp

Download

memory/4032-149-0x0000000000340000-0x000000000036D000-memory.dmp

Download

memory/4032-148-0x0000000000B70000-0x0000000000B8E000-memory.dmp

Download

memory/4032-150-0x00000000011A0000-0x00000000014EA000-memory.dmp

Download

memory/4032-151-0x0000000000B90000-0x0000000000C1F000-memory.dmp

Download

memory/4032-153-0x0000000000340000-0x000000000036D000-memory.dmp

Download

memory/4268-143-0x0000000000401000-0x000000000042F000-memory.dmp

Download

memory/4268-144-0x00000000018A0000-0x0000000001BEA000-memory.dmp

Download

memory/4268-145-0x0000000000FF0000-0x0000000001000000-memory.dmp

Download

memory/4268-142-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4268-141-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4268-139-0x0000000000400000-0x000000000042F000-memory.dmp

Download