formbook | e2f2df406e05d13e2245e2fe9da7128c257a7bb11464dce77ce386b51470abd8

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24/10/2022, 16:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PO NO#6910009.exe
Size 258KB
Sample221024-t5ye5shfg3
SHA256 e2f2df406e05d13e2245e2fe9da7128c257a7bb11464dce77ce386b51470abd8
MD5 9bd749c7511ddd96b428c50f5023c81d
SHA1 985905d7d30d8e4dc9e627622fd1527ae228d825
SHA512 b13dda3d5ed399ec3d7d8b11be4b06e71b3e3ddafced126615bf49eefaf517fb77c6df5e6bcc3ae5f7627e8bf9021c552cba8eff0a9f4596cff09814d88241f6
SSDEEP 3072:ibG7N2kDTHUpouSbFRnXYAXwe1LM8ZRyWjfkV0BSGzgjVi4OOKLEKgvaKd1IpLL0:ibE/HUkPbweZvTE0B9zEjvaKj+4QIbWS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook sy01 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

sy01

Decoy

aeria.life
jotted.community
mozarspalace.com
bfkoxoih.work
doganmuzik.com
ljsq.shop
vitalitycook.store
74574575.xyz
infiniteuniverse.site
storkrv.com
amendmentsymmetrical.top
adevodigital.com
renammsac.com
tptretry.info
ninfainacquerello.com
25038.top
httpsthothub.lol
yvxbt.com
72028.top
vzxtopi.xyz
abw273.com
torqueandtension.com
topwawa24.site
omsaienterprise.info
remodelergarland.com
blackdogartco.net
mdeb.net
clickbests.net
yoody.xyz
campgreed.com
bazemorecontacts.com
daokes.top
jennyrossidesign.com
pinkroses.store
tentepergola.xyz
mrm2c.com
669.homes
catlettauto.com
distancepencilmarried.email
psg-ukraine.com
fasinixiaoribenguizi038.com
imperialwealthplanning.ltd
futa.gay
prod-lw-audience-builder.xyz
bestventureoffering.click
dentalsolution.store
320.productions
jzslime.com
ciciiceove.com
tuasolea.com
rhsallclass.net
yiersan.fun
myvipsuperapp.sbs
kalakaargraphics.com
trackmyapp.xyz
star138.com
metiswanderer.com
suv-cars.site
irofulaunc.sbs
transcendexperiences.com
25cse.xyz
peloporproperti.xyz
advertisementgallery25.monster
nordwandpartners.com
25800.biz

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/2380-145-0x0000000001000000-0x000000000102F000-memory.dmp	formbook

Blocklisted process makes network request 1 IoCs

flow	pid	Process
47	2380	cmstp.exe

Executes dropped EXE 1 IoCs

pid	Process
1972	qxzphrno.exe

Loads dropped DLL 1 IoCs

pid	Process
4460	qxzphrno.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1972 set thread context of 4460	1972	qxzphrno.exe	84
PID 4460 set thread context of 3092	4460	qxzphrno.exe	47
PID 2380 set thread context of 3092	2380	cmstp.exe	47

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
636	1972	WerFault.exe	83

Suspicious behavior: EnumeratesProcesses 62 IoCs

pid	Process
4460	qxzphrno.exe
4460	qxzphrno.exe
4460	qxzphrno.exe
4460	qxzphrno.exe
2380	cmstp.exe
2380	cmstp.exe
2380	cmstp.exe
2380	cmstp.exe
2380	cmstp.exe
2380	cmstp.exe
2380	cmstp.exe
2380	cmstp.exe
2380	cmstp.exe
2380	cmstp.exe
2380	cmstp.exe
2380	cmstp.exe
2380	cmstp.exe
2380	cmstp.exe
2380	cmstp.exe
2380	cmstp.exe
2380	cmstp.exe
2380	cmstp.exe
2380	cmstp.exe
2380	cmstp.exe
2380	cmstp.exe
2380	cmstp.exe
2380	cmstp.exe
2380	cmstp.exe
2380	cmstp.exe
2380	cmstp.exe
2380	cmstp.exe
2380	cmstp.exe
2380	cmstp.exe
2380	cmstp.exe
2380	cmstp.exe
2380	cmstp.exe
2380	cmstp.exe
2380	cmstp.exe
2380	cmstp.exe
2380	cmstp.exe
2380	cmstp.exe
2380	cmstp.exe
2380	cmstp.exe
2380	cmstp.exe
2380	cmstp.exe
2380	cmstp.exe
2380	cmstp.exe
2380	cmstp.exe
2380	cmstp.exe
2380	cmstp.exe
2380	cmstp.exe
2380	cmstp.exe
2380	cmstp.exe
2380	cmstp.exe
2380	cmstp.exe
2380	cmstp.exe
2380	cmstp.exe
2380	cmstp.exe
2380	cmstp.exe
2380	cmstp.exe
2380	cmstp.exe
2380	cmstp.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3092	Explorer.EXE

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
4460	qxzphrno.exe
4460	qxzphrno.exe
4460	qxzphrno.exe
2380	cmstp.exe
2380	cmstp.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4460	qxzphrno.exe
Token: SeShutdownPrivilege	3092	Explorer.EXE
Token: SeCreatePagefilePrivilege	3092	Explorer.EXE
Token: SeDebugPrivilege	2380	cmstp.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 568 wrote to memory of 1972	568	PO NO#6910009.exe	83
PID 568 wrote to memory of 1972	568	PO NO#6910009.exe	83
PID 568 wrote to memory of 1972	568	PO NO#6910009.exe	83
PID 1972 wrote to memory of 4460	1972	qxzphrno.exe	84
PID 1972 wrote to memory of 4460	1972	qxzphrno.exe	84
PID 1972 wrote to memory of 4460	1972	qxzphrno.exe	84
PID 1972 wrote to memory of 4460	1972	qxzphrno.exe	84
PID 3092 wrote to memory of 2380	3092	Explorer.EXE	94
PID 3092 wrote to memory of 2380	3092	Explorer.EXE	94
PID 3092 wrote to memory of 2380	3092	Explorer.EXE	94
PID 2380 wrote to memory of 2356	2380	cmstp.exe	97
PID 2380 wrote to memory of 2356	2380	cmstp.exe	97
PID 2380 wrote to memory of 2356	2380	cmstp.exe	97

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3092
- C:\Users\Admin\AppData\Local\Temp\PO NO#6910009.exe
  "C:\Users\Admin\AppData\Local\Temp\PO NO#6910009.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:568
- - C:\Users\Admin\AppData\Local\Temp\qxzphrno.exe
    "C:\Users\Admin\AppData\Local\Temp\qxzphrno.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1972
  - - C:\Users\Admin\AppData\Local\Temp\qxzphrno.exe
      "C:\Users\Admin\AppData\Local\Temp\qxzphrno.exe"
      4⤵
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:4460
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 560
      4⤵
      Program crash
      PID:636
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:4888
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:1340
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:2024
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:1368
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:1488
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:1240
- C:\Windows\SysWOW64\cmstp.exe
  "C:\Windows\SysWOW64\cmstp.exe"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2380
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\qxzphrno.exe"
    3⤵
    PID:2356
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:1396
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:1288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1972 -ip 1972
1⤵
PID:5016

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bpopk.nkw

Path C:\Users\Admin\AppData\Local\Temp\bpopk.nkw
Size 185KB
SHA256 8a65e501e758fd3c2ddc5e05c2b2419d8b3915595155d807d019385b48821ac8
MD5 3c689948ea46bdeb2ebe9933dbcc3e07
SHA1 5f990737de103d05070efe81e77ac37a4d3e3506
SHA512 dadeba4b5f747135b15b0f454cbd17d2b7f5a1590c0439669ae81a1d0f39e814b730e842d56c31990df3057870f99b42c04849b8e252cd5b5c87779bad711418
SSDEEP 3072:kvTS2PjbG4MW8cehSIF2zynt79c3apnXAEFg70sMNCu5xFxviKsEvaKd1IwsYXk:kvbm4OSIQzynt79gcXAmg4BCYJi/Evaj
MD5 SHA1 SHA512 SSDEEP

Submit Download

lfptyyd.pya

Path C:\Users\Admin\AppData\Local\Temp\lfptyyd.pya
Size 4KB
SHA256 c3b24f764b16109090e18ec87805cacf30f875d6a41edb48fa6954c9c698842d
MD5 4dfaeedadd9baf5f271a1a2e6e5c10ff
SHA1 6ff1c5e37b360ca539f6985c9ff87d4ea2b61fda
SHA512 22e040dc249d47cbf431672f45596702a61f9e47d690afbc9e6a9c0bda3530d741c7b1ca6edcf16a621e052d48df0d950ca6ad5ffa424ec3789e05cd61814687
SSDEEP 96:JxkyghlwemLiG5iP7EZy94NxUEXzF5CWNX3xT:JSh6T5kqy94NhzzJT
MD5 SHA1 SHA512 SSDEEP

Submit Download

qxzphrno.exe

Path C:\Users\Admin\AppData\Local\Temp\qxzphrno.exe
Size 59KB
SHA256 8e0abb8715ef116b5446cd411181611bcae01e570f18a6f69013c30f811434e9
MD5 81aaa1f3ed7097dae34be10cb93f6d63
SHA1 abfa73deb31399ed396892367633ac7b554aa105
SHA512 8529244e183fad676bcc140e815ca2e1a1f1428574a27e8e7a5f4cc7cb0b6deb58192f12220546bd4b9b3151f0f33deab6c357ab26f1e618c9362b0b1aa4ee19
SSDEEP 1536:0QvtLu0ZssXg2J2m3K5n2ETMCZQsuyXn5QnQC:0wCsPEvMCi32nCnQC
MD5 SHA1 SHA512 SSDEEP

Submit Download

qxzphrno.exe

Path C:\Users\Admin\AppData\Local\Temp\qxzphrno.exe
Size 59KB
SHA256 8e0abb8715ef116b5446cd411181611bcae01e570f18a6f69013c30f811434e9
MD5 81aaa1f3ed7097dae34be10cb93f6d63
SHA1 abfa73deb31399ed396892367633ac7b554aa105
SHA512 8529244e183fad676bcc140e815ca2e1a1f1428574a27e8e7a5f4cc7cb0b6deb58192f12220546bd4b9b3151f0f33deab6c357ab26f1e618c9362b0b1aa4ee19
SSDEEP 1536:0QvtLu0ZssXg2J2m3K5n2ETMCZQsuyXn5QnQC:0wCsPEvMCi32nCnQC
MD5 SHA1 SHA512 SSDEEP

Submit Download

qxzphrno.exe

Path C:\Users\Admin\AppData\Local\Temp\qxzphrno.exe
Size 59KB
SHA256 8e0abb8715ef116b5446cd411181611bcae01e570f18a6f69013c30f811434e9
MD5 81aaa1f3ed7097dae34be10cb93f6d63
SHA1 abfa73deb31399ed396892367633ac7b554aa105
SHA512 8529244e183fad676bcc140e815ca2e1a1f1428574a27e8e7a5f4cc7cb0b6deb58192f12220546bd4b9b3151f0f33deab6c357ab26f1e618c9362b0b1aa4ee19
SSDEEP 1536:0QvtLu0ZssXg2J2m3K5n2ETMCZQsuyXn5QnQC:0wCsPEvMCi32nCnQC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2380-144-0x0000000000520000-0x0000000000536000-memory.dmp

Download

memory/2380-145-0x0000000001000000-0x000000000102F000-memory.dmp

Download

memory/2380-146-0x0000000002F80000-0x00000000032CA000-memory.dmp

Download

memory/2380-147-0x0000000002D20000-0x0000000002DB3000-memory.dmp

Download

memory/3092-141-0x0000000008260000-0x000000000837C000-memory.dmp

Download

memory/3092-148-0x0000000008380000-0x0000000008487000-memory.dmp

Download

memory/3092-149-0x0000000008380000-0x0000000008487000-memory.dmp

Download

memory/4460-140-0x0000000000D60000-0x0000000000D74000-memory.dmp

Download

memory/4460-139-0x0000000001220000-0x000000000156A000-memory.dmp

Download