formbook | 205e6c6df8dffec4ab2525d317bf4f0b79ab0fd4c84b197ec8555adcf8f15e40

Analysis

max time kernel
158s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2022, 14:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DHL Shipment Notification_pdf.exe
Size 430KB
Sample221014-rz96msdfd6
SHA256 205e6c6df8dffec4ab2525d317bf4f0b79ab0fd4c84b197ec8555adcf8f15e40
MD5 ba3cc95fb5384c855a83b2c7eef89658
SHA1 bed0e9f85cc884fe614b85a5e4280444ad017678
SHA512 d86673d9700a5e37f68b5291524300400699f7011af72d8165c12c90f1240f9ba3708e1eb12ed97d656229db8cdcf2a56bea890aae6eac7e01e350b107ddedc4
SSDEEP 12288:wbwv6cxdNE7AhxQHWrHG9Rlkzk9kLufPuu3X:wbwvlNE7orBzk9kLuf9H
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook g28p rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

g28p

Decoy

whhmgs.asia
wellmedcaredirect.net
beggarded.com
wtpjiv.site
todo-celulares.com
parkitny.net
43345.top
pro-genie.com
cwdxz.com
cbc-inc.xyz
healthspots.net
rulil.top
pyramidaudit.solutions
k8sb15.live
hempaware.report
usclink.life
stayefs.net
05262.top
shop-izakaya-jin.com
iccworldcupnews.com
lulamail.xyz
dubaistocks.club
royaleyeandearhospital.com
cash-date.biz
hbfcjgj.com
zcx625.fun
compra-venta-autos.online
waltherchen.xyz
asyimpo.xyz
gayxxxporn.info
xn--igvy44d.xn--55qx5d
teaktime.net
aydesign.xyz
hfamq.site
tunayreklam.net
rxof.rest
naturebody.love
elijahelijah.com
lojasiadis.com
amazrsxrszwna.com
realtranzex.com
elelfo3d.fun
fse.community
28369.xyz
minigolfauthority.net
venturebestdeals.click
robeholidayrentals.store
edarva.skin
xikixvtj.work
ecolabspeyua.store
infidelitytoolkit.com
crawfordbayoysterroast.net
adenongel.dentist
appliancegrey.site
ky7769.com
kshd.xyz
ausbonusbets.com
aks.capital
rv8288.xyz
retetelebunicii.com
younginheart.net
ps4controller.net
todotutoriales10.com
boletosdeavionbaratos.com
spartanburgwebdesign.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/1796-145-0x0000000000700000-0x000000000072F000-memory.dmp	formbook
behavioral2/memory/1796-150-0x0000000000700000-0x000000000072F000-memory.dmp	formbook

Executes dropped EXE 2 IoCs

pid	Process
3404	vchvt.exe
5020	vchvt.exe

Loads dropped DLL 1 IoCs

pid	Process
4980	vchvt.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3404 set thread context of 4980	3404	vchvt.exe	83
PID 4980 set thread context of 3044	4980	vchvt.exe	66
PID 1796 set thread context of 3044	1796	control.exe	66

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1200	3404	WerFault.exe	80

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
4980	vchvt.exe
4980	vchvt.exe
4980	vchvt.exe
4980	vchvt.exe
1796	control.exe
1796	control.exe
1796	control.exe
1796	control.exe
1796	control.exe
1796	control.exe
1796	control.exe
1796	control.exe
1796	control.exe
1796	control.exe
1796	control.exe
1796	control.exe
1796	control.exe
1796	control.exe
1796	control.exe
1796	control.exe
1796	control.exe
1796	control.exe
1796	control.exe
1796	control.exe
1796	control.exe
1796	control.exe
1796	control.exe
1796	control.exe
1796	control.exe
1796	control.exe
1796	control.exe
1796	control.exe
1796	control.exe
1796	control.exe
1796	control.exe
1796	control.exe
1796	control.exe
1796	control.exe
1796	control.exe
1796	control.exe
1796	control.exe
1796	control.exe
1796	control.exe
1796	control.exe
1796	control.exe
1796	control.exe
1796	control.exe
1796	control.exe
1796	control.exe
1796	control.exe
1796	control.exe
1796	control.exe
1796	control.exe
1796	control.exe
1796	control.exe
1796	control.exe
1796	control.exe
1796	control.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3044	Explorer.EXE

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
4980	vchvt.exe
4980	vchvt.exe
4980	vchvt.exe
1796	control.exe
1796	control.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	4980	vchvt.exe
Token: SeDebugPrivilege	1796	control.exe
Token: SeShutdownPrivilege	3044	Explorer.EXE
Token: SeCreatePagefilePrivilege	3044	Explorer.EXE
Token: SeShutdownPrivilege	3044	Explorer.EXE
Token: SeCreatePagefilePrivilege	3044	Explorer.EXE
Token: SeShutdownPrivilege	3044	Explorer.EXE
Token: SeCreatePagefilePrivilege	3044	Explorer.EXE

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 3404	1512	DHL Shipment Notification_pdf.exe	80
PID 1512 wrote to memory of 3404	1512	DHL Shipment Notification_pdf.exe	80
PID 1512 wrote to memory of 3404	1512	DHL Shipment Notification_pdf.exe	80
PID 3404 wrote to memory of 5020	3404	vchvt.exe	82
PID 3404 wrote to memory of 5020	3404	vchvt.exe	82
PID 3404 wrote to memory of 5020	3404	vchvt.exe	82
PID 3404 wrote to memory of 4980	3404	vchvt.exe	83
PID 3404 wrote to memory of 4980	3404	vchvt.exe	83
PID 3404 wrote to memory of 4980	3404	vchvt.exe	83
PID 3404 wrote to memory of 4980	3404	vchvt.exe	83
PID 3044 wrote to memory of 1796	3044	Explorer.EXE	85
PID 3044 wrote to memory of 1796	3044	Explorer.EXE	85
PID 3044 wrote to memory of 1796	3044	Explorer.EXE	85
PID 1796 wrote to memory of 1596	1796	control.exe	88
PID 1796 wrote to memory of 1596	1796	control.exe	88
PID 1796 wrote to memory of 1596	1796	control.exe	88

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Users\Admin\AppData\Local\Temp\DHL Shipment Notification_pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\DHL Shipment Notification_pdf.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1512
- - C:\Users\Admin\AppData\Local\Temp\vchvt.exe
    "C:\Users\Admin\AppData\Local\Temp\vchvt.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3404
  - - C:\Users\Admin\AppData\Local\Temp\vchvt.exe
      "C:\Users\Admin\AppData\Local\Temp\vchvt.exe"
      4⤵
      Executes dropped EXE
      PID:5020
  - - C:\Users\Admin\AppData\Local\Temp\vchvt.exe
      "C:\Users\Admin\AppData\Local\Temp\vchvt.exe"
      4⤵
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:4980
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3404 -s 476
      4⤵
      Program crash
      PID:1200
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\SysWOW64\control.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1796
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\vchvt.exe"
    3⤵
    PID:1596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3404 -ip 3404
1⤵
PID:636

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

gqxstdq.u

Path C:\Users\Admin\AppData\Local\Temp\gqxstdq.u
Size 4KB
SHA256 17d179a3734755971b1c1bc10d0ff8957dc48fb7ad3ded68f540ea4f66171351
MD5 776373b6c314a1db7f35a1b881751417
SHA1 7ed86f57b2b7cc787deebc9309cce1d26e1c0813
SHA512 45e096c2e16baf622f8780c62420cd7ce3631227fe6ac9ebf695722e3000ff42c5fbef24d7b8ddea4057ccf30d46c35240d65522333466a4e6c9a6aa677fb11b
SSDEEP 96:9casWRXe5i0+nXizIc1V1q06k350ty+5sRl6ljYdBF:mfc0+Szr9q06k35HLEJY/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

nlmfwfbsxy.cns

Path C:\Users\Admin\AppData\Local\Temp\nlmfwfbsxy.cns
Size 185KB
SHA256 c0da196bab49ae0413a225b1a2557ea54b461b0f977bda1f9b391756e9b8e229
MD5 42d4b56d64ecae1d8c17809b4a34332e
SHA1 c83e1073bf96bd9e6a472bebca870fab43531b65
SHA512 8f4c4becf0f77cda0877658cf26b055216d7edcaa95e9061f9f2e554c580fce179e9422a26867c65d21153b34e494ebe950e66d0a4e8b7bfbf676205b600bdde
SSDEEP 3072:5q3XSaZTggXAeWYFjtGulrP92zHu11fVymOoNim4Rg43ujNb7UpiRlX0+4slHWnm:5xxgXDFj9Pra2im4nujNjRlX0+4s8N0r
MD5 SHA1 SHA512 SSDEEP

Submit Download

vchvt.exe

Path C:\Users\Admin\AppData\Local\Temp\vchvt.exe
Size 130KB
SHA256 49429dc3bcf2989b368ecc5889ab4d1744916c388b21f7f1400e40bd0935b43b
MD5 d4e12b7da7f16a764a2699bff6be19e5
SHA1 351abba635f125467cc50ade240f9a5f9604466d
SHA512 577b0ecac3ec4c38b9487eed5e552351f440e699231d5aff5f4c7297c56291acccc2738cb1eeead906b03810d42ec87e924f60c7683990dbd9e966dc83ad32be
SSDEEP 3072:pDCsPEvMCi32nCnQCwk2os5ssyBXseRS709hJFTx3RFF:99PkKud4n9dseDhJ1FF
MD5 SHA1 SHA512 SSDEEP

Submit Download

vchvt.exe

Path C:\Users\Admin\AppData\Local\Temp\vchvt.exe
Size 130KB
SHA256 49429dc3bcf2989b368ecc5889ab4d1744916c388b21f7f1400e40bd0935b43b
MD5 d4e12b7da7f16a764a2699bff6be19e5
SHA1 351abba635f125467cc50ade240f9a5f9604466d
SHA512 577b0ecac3ec4c38b9487eed5e552351f440e699231d5aff5f4c7297c56291acccc2738cb1eeead906b03810d42ec87e924f60c7683990dbd9e966dc83ad32be
SSDEEP 3072:pDCsPEvMCi32nCnQCwk2os5ssyBXseRS709hJFTx3RFF:99PkKud4n9dseDhJ1FF
MD5 SHA1 SHA512 SSDEEP

Submit Download

vchvt.exe

Path C:\Users\Admin\AppData\Local\Temp\vchvt.exe
Size 130KB
SHA256 49429dc3bcf2989b368ecc5889ab4d1744916c388b21f7f1400e40bd0935b43b
MD5 d4e12b7da7f16a764a2699bff6be19e5
SHA1 351abba635f125467cc50ade240f9a5f9604466d
SHA512 577b0ecac3ec4c38b9487eed5e552351f440e699231d5aff5f4c7297c56291acccc2738cb1eeead906b03810d42ec87e924f60c7683990dbd9e966dc83ad32be
SSDEEP 3072:pDCsPEvMCi32nCnQCwk2os5ssyBXseRS709hJFTx3RFF:99PkKud4n9dseDhJ1FF
MD5 SHA1 SHA512 SSDEEP

Submit Download

vchvt.exe

Path C:\Users\Admin\AppData\Local\Temp\vchvt.exe
Size 130KB
SHA256 49429dc3bcf2989b368ecc5889ab4d1744916c388b21f7f1400e40bd0935b43b
MD5 d4e12b7da7f16a764a2699bff6be19e5
SHA1 351abba635f125467cc50ade240f9a5f9604466d
SHA512 577b0ecac3ec4c38b9487eed5e552351f440e699231d5aff5f4c7297c56291acccc2738cb1eeead906b03810d42ec87e924f60c7683990dbd9e966dc83ad32be
SSDEEP 3072:pDCsPEvMCi32nCnQCwk2os5ssyBXseRS709hJFTx3RFF:99PkKud4n9dseDhJ1FF
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1796-147-0x0000000002860000-0x0000000002BAA000-memory.dmp

Download

memory/1796-144-0x00000000009C0000-0x00000000009E7000-memory.dmp

Download

memory/1796-145-0x0000000000700000-0x000000000072F000-memory.dmp

Download

memory/1796-148-0x0000000002500000-0x0000000002593000-memory.dmp

Download

memory/1796-150-0x0000000000700000-0x000000000072F000-memory.dmp

Download

memory/3044-142-0x0000000007710000-0x0000000007850000-memory.dmp

Download

memory/3044-149-0x0000000007850000-0x0000000007998000-memory.dmp

Download

memory/3044-151-0x0000000007850000-0x0000000007998000-memory.dmp

Download

memory/4980-140-0x0000000000DE0000-0x000000000112A000-memory.dmp

Download

memory/4980-141-0x0000000001130000-0x0000000001144000-memory.dmp

Download