formbook | 76d92a7295e68d47e688783bb1e85bc8ac0b0d8b1e35971ce890d23ace159d2c

Analysis

max time kernel
147s
max time network
132s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24/10/2022, 03:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Request for Quotation.exe
Size 214KB
Sample221024-d77htsedbl
SHA256 0673e3ccaf8f4bc60b304e94d608fb1511d2ea7644c672563b6a81b5c3338c19
MD5 c4113624b8037af315e5c2f75d4f6580
SHA1 c34d1c4d260fc9e5a910099aec296d431236f5aa
SHA512 892df9c9502b08d4c70c4968553daa6fca3deb2ae2f75b338f7ad40eca91259a1da0e961bf1ead3053674be9ec2dd85bbff105580040d0b20808c2622940dff6
SSDEEP 6144:qweEpMOKKcq1Y9HYwE0GYa+2GqDJZuIwH3XoY:bMGY9KN9DtwH3XX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook sm28 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

sm28

Decoy

encoter.shop
economicalhearing.com
composeexpertisefare.makeup
moffice.online
mayvar.store
klean4life.info
buytamaadoge.digital
digiwelldata.com
cngnaturalgas.com
scibrew.com
foxyellow.com
lceqtg.xyz
ufhrk.site
35445.top
reply.express
ky9347.com
takfy.com
77008.top
rentalsscreeningssetlement.com
incontrisessuali.space
thenerdcastle.net
vaynhanh.trade
senior-retirement-homes.xyz
3278591.buzz
lapdukejaritanggamus.online
dpworldbossaso.com
parkfonte.club
odcdev.tech
sph215.top
dislix.lol
amyrosevardy.com
lllss.club
mouraemoraesadvocacia.com
sawgrasselectric.site
delosegrai.info
dcc.productions
thedeck1488.com
sergiugobjila.com
coroii.fun
digital-it-systems.com
metaverseloan.xyz
creamsoldesfr.com
a3rf5.xyz
ziewip.xyz
i-am-god.online
ubvysahs.work
slimmediagroup.net
mdjlong.com
fcb8.fan
kurikuri.site
ky2185.com
00275.top
1stenergytowingnrecovery.xyz
fawnfood.com
jessicakorkis.com
dgeneralrepairs.com
atlantis-esports.com
31342.top
muib.top
lareneglife.club
pk555.mom
bestventuresdeals.click
feshoi.xyz
yp6409.com
gczav.store

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 4 IoCs

rat

resource	yara_rule
behavioral1/memory/904-64-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/904-69-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/940-73-0x00000000000C0000-0x00000000000EF000-memory.dmp	formbook
behavioral1/memory/940-76-0x00000000000C0000-0x00000000000EF000-memory.dmp	formbook

Executes dropped EXE 2 IoCs

pid	Process
2008	kcmachktc.exe
904	kcmachktc.exe

Loads dropped DLL 2 IoCs

pid	Process
1424	Request for Quotation.exe
2008	kcmachktc.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2008 set thread context of 904	2008	kcmachktc.exe	28
PID 904 set thread context of 1260	904	kcmachktc.exe	14
PID 940 set thread context of 1260	940	svchost.exe	14

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
904	kcmachktc.exe
904	kcmachktc.exe
940	svchost.exe
940	svchost.exe
940	svchost.exe
940	svchost.exe
940	svchost.exe
940	svchost.exe
940	svchost.exe
940	svchost.exe
940	svchost.exe
940	svchost.exe
940	svchost.exe
940	svchost.exe
940	svchost.exe
940	svchost.exe
940	svchost.exe
940	svchost.exe
940	svchost.exe
940	svchost.exe
940	svchost.exe
940	svchost.exe
940	svchost.exe
940	svchost.exe
940	svchost.exe
940	svchost.exe
940	svchost.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
2008	kcmachktc.exe
904	kcmachktc.exe
904	kcmachktc.exe
904	kcmachktc.exe
940	svchost.exe
940	svchost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	904	kcmachktc.exe
Token: SeDebugPrivilege	940	svchost.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1260	Explorer.EXE
1260	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1260	Explorer.EXE
1260	Explorer.EXE

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1424 wrote to memory of 2008	1424	Request for Quotation.exe	26
PID 1424 wrote to memory of 2008	1424	Request for Quotation.exe	26
PID 1424 wrote to memory of 2008	1424	Request for Quotation.exe	26
PID 1424 wrote to memory of 2008	1424	Request for Quotation.exe	26
PID 2008 wrote to memory of 904	2008	kcmachktc.exe	28
PID 2008 wrote to memory of 904	2008	kcmachktc.exe	28
PID 2008 wrote to memory of 904	2008	kcmachktc.exe	28
PID 2008 wrote to memory of 904	2008	kcmachktc.exe	28
PID 2008 wrote to memory of 904	2008	kcmachktc.exe	28
PID 1260 wrote to memory of 940	1260	Explorer.EXE	29
PID 1260 wrote to memory of 940	1260	Explorer.EXE	29
PID 1260 wrote to memory of 940	1260	Explorer.EXE	29
PID 1260 wrote to memory of 940	1260	Explorer.EXE	29
PID 940 wrote to memory of 1736	940	svchost.exe	30
PID 940 wrote to memory of 1736	940	svchost.exe	30
PID 940 wrote to memory of 1736	940	svchost.exe	30
PID 940 wrote to memory of 1736	940	svchost.exe	30

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe
  "C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1424
- - C:\Users\Admin\AppData\Local\Temp\kcmachktc.exe
    "C:\Users\Admin\AppData\Local\Temp\kcmachktc.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2008
  - - C:\Users\Admin\AppData\Local\Temp\kcmachktc.exe
      "C:\Users\Admin\AppData\Local\Temp\kcmachktc.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:904
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\SysWOW64\svchost.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:940
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\kcmachktc.exe"
    3⤵
    PID:1736

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

kcmachktc.exe

Path C:\Users\Admin\AppData\Local\Temp\kcmachktc.exe
Size 5KB
SHA256 ad562bd8801320570ec3d3ecf49f6ece10f5fe3f42084ec68aaf1166416f81f2
MD5 b022fc089b75187fcecfc4493802ed08
SHA1 36887647520288e433d9593c8845169ce29325f1
SHA512 43a2b73a8625f387e7fa13f2643f05034af5954f8681f4dee37ae1e00adf8774962dcefa4aee2da38fec5cf846730d97147313a76c976afc81cae03268ba270b
SSDEEP 48:a7J9BoSABs2zBqL5thSEPd65QfIUcjt87hqhFcLLZ4oyl1JhrMwjR/9VMHQidRuz:cJ9ABdtGhSEsQAUcSZ4oynDrtnVMbnx
MD5 SHA1 SHA512 SSDEEP

Submit Download

kcmachktc.exe

Path C:\Users\Admin\AppData\Local\Temp\kcmachktc.exe
Size 5KB
SHA256 ad562bd8801320570ec3d3ecf49f6ece10f5fe3f42084ec68aaf1166416f81f2
MD5 b022fc089b75187fcecfc4493802ed08
SHA1 36887647520288e433d9593c8845169ce29325f1
SHA512 43a2b73a8625f387e7fa13f2643f05034af5954f8681f4dee37ae1e00adf8774962dcefa4aee2da38fec5cf846730d97147313a76c976afc81cae03268ba270b
SSDEEP 48:a7J9BoSABs2zBqL5thSEPd65QfIUcjt87hqhFcLLZ4oyl1JhrMwjR/9VMHQidRuz:cJ9ABdtGhSEsQAUcSZ4oynDrtnVMbnx
MD5 SHA1 SHA512 SSDEEP

Submit Download

kcmachktc.exe

Path C:\Users\Admin\AppData\Local\Temp\kcmachktc.exe
Size 5KB
SHA256 ad562bd8801320570ec3d3ecf49f6ece10f5fe3f42084ec68aaf1166416f81f2
MD5 b022fc089b75187fcecfc4493802ed08
SHA1 36887647520288e433d9593c8845169ce29325f1
SHA512 43a2b73a8625f387e7fa13f2643f05034af5954f8681f4dee37ae1e00adf8774962dcefa4aee2da38fec5cf846730d97147313a76c976afc81cae03268ba270b
SSDEEP 48:a7J9BoSABs2zBqL5thSEPd65QfIUcjt87hqhFcLLZ4oyl1JhrMwjR/9VMHQidRuz:cJ9ABdtGhSEsQAUcSZ4oynDrtnVMbnx
MD5 SHA1 SHA512 SSDEEP

Submit Download

oyjbvbinag.usk

Path C:\Users\Admin\AppData\Local\Temp\oyjbvbinag.usk
Size 5KB
SHA256 27dafa62113736ab19e77f66708898018189f85fe5dc720e20dbfa15a19f8311
MD5 59b7300783bfa48e24b87d6deba9bbf5
SHA1 4fa4d9d98e22838117891f852c6ec2ecb3684997
SHA512 c8a86204785f4b1dc158e5a58eb7c969a04f30a3d673fbefaa3a4ba4b3e8e822e9c645588c320a4d5f206df647207c83dc1fbb86b45caba39636c1a03fe86889
SSDEEP 96:LUwJoZ1lYblbCSKXo+TcknTdxL7087F0q/tNPsKxSdRmwcaYWonEW2KtPfPV:LUwm1lYhWS4TLTT3lzLPspIwch1EW2ad
MD5 SHA1 SHA512 SSDEEP

Submit Download

tkswum.cxz

Path C:\Users\Admin\AppData\Local\Temp\tkswum.cxz
Size 185KB
SHA256 9c7a1e4a95fd842cd28952adf2d78318ce4d793f20ae071f22c26c6f31345ff2
MD5 3a24c19e602cbba8a750faf8f4f01eba
SHA1 c07469f0f39151da9a4518aa6ec427be8dc83f5e
SHA512 89d0b2ce31a6aec9a4ef5b6f257e8b6ecf5ebac67a71791aaa83bf5ea312e14cca05dbd243d2e26685941904b28871eeef46d29b9eea2b058d3167da34a0c7ab
SSDEEP 3072:pi93hQzU67JKmRd0j6mUWd5tMQV5J1UdGlHaljGMAK922kJjprjpuEGtWg50:UuJ7d0j6S5iQVCW6LHZkVVjcv70
MD5 SHA1 SHA512 SSDEEP

Submit Download

kcmachktc.exe

Path \Users\Admin\AppData\Local\Temp\kcmachktc.exe
Size 5KB
SHA256 ad562bd8801320570ec3d3ecf49f6ece10f5fe3f42084ec68aaf1166416f81f2
MD5 b022fc089b75187fcecfc4493802ed08
SHA1 36887647520288e433d9593c8845169ce29325f1
SHA512 43a2b73a8625f387e7fa13f2643f05034af5954f8681f4dee37ae1e00adf8774962dcefa4aee2da38fec5cf846730d97147313a76c976afc81cae03268ba270b
SSDEEP 48:a7J9BoSABs2zBqL5thSEPd65QfIUcjt87hqhFcLLZ4oyl1JhrMwjR/9VMHQidRuz:cJ9ABdtGhSEsQAUcSZ4oynDrtnVMbnx
MD5 SHA1 SHA512 SSDEEP

Submit Download

kcmachktc.exe

Path \Users\Admin\AppData\Local\Temp\kcmachktc.exe
Size 5KB
SHA256 ad562bd8801320570ec3d3ecf49f6ece10f5fe3f42084ec68aaf1166416f81f2
MD5 b022fc089b75187fcecfc4493802ed08
SHA1 36887647520288e433d9593c8845169ce29325f1
SHA512 43a2b73a8625f387e7fa13f2643f05034af5954f8681f4dee37ae1e00adf8774962dcefa4aee2da38fec5cf846730d97147313a76c976afc81cae03268ba270b
SSDEEP 48:a7J9BoSABs2zBqL5thSEPd65QfIUcjt87hqhFcLLZ4oyl1JhrMwjR/9VMHQidRuz:cJ9ABdtGhSEsQAUcSZ4oynDrtnVMbnx
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/904-66-0x0000000000340000-0x0000000000355000-memory.dmp

Download

memory/904-69-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/904-64-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/904-65-0x0000000000890000-0x0000000000B93000-memory.dmp

Download

memory/940-76-0x00000000000C0000-0x00000000000EF000-memory.dmp

Download

memory/940-71-0x00000000007D0000-0x00000000007D8000-memory.dmp

Download

memory/940-72-0x00000000007E0000-0x0000000000AE3000-memory.dmp

Download

memory/940-73-0x00000000000C0000-0x00000000000EF000-memory.dmp

Download

memory/940-74-0x0000000000450000-0x00000000004E4000-memory.dmp

Download

memory/1260-77-0x0000000005FE0000-0x000000000612D000-memory.dmp

Download

memory/1260-67-0x0000000004AF0000-0x0000000004BD8000-memory.dmp

Download

memory/1260-75-0x0000000005FE0000-0x000000000612D000-memory.dmp

Download

memory/1424-54-0x0000000076151000-0x0000000076153000-memory.dmp

Download