formbook | 129f2604f1e1718d464a01fcd1c76e845e784d783fed333642b77e231f121ef3

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25/10/2022, 03:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
REF344266679_pdf.exe
Size 226KB
Sample221025-d627qabean
SHA256 129f2604f1e1718d464a01fcd1c76e845e784d783fed333642b77e231f121ef3
MD5 b94e95ba33a76a3f5fd8e123d9d8f4b7
SHA1 63393ef816336b47af8d9490100cf335c8d60997
SHA512 fe542447701bc3037a2613d483062ed87a5299112fda9f6ec560c3a7b78e19581e2be14a521f4cad1d3fd40246d019124e4c7839c54775a55e5a066d18839805
SSDEEP 6144:qweEpFbv7aGAwgdX7Dk4z0HZ13Kdx/lMeydbH:bFb1PiX3nz0HvseD
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook axe3 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

axe3

Decoy

nV63ydJMXMf7memspIpnnVLl3Q==
uJ50rs5Y/80AqT79guHh
FcsTFQ1xekTgcal8G0P2ZTQ=
uLWWVJP++ID3dkoB8g==
YyoybGF5Fsa/UH8=
Tk4htwkBBfM5ZA==
QgJ8vN9f+uCdsD79guHh
wmjC9UuSBGyTrY5PAX9t1A==
Sw7JEwOKl576ndxw/A==
BOqs09Ikjej1BN98ZYtVfSi5xQ==
YA5cbH3/4wVAYg==
fRWIvatAXM3+t0X9guHh
FAbZXq/jFuaEq2YCwQh3b2oE
STL+RDTA652/tD/9guHh
zgLNcuX32aFB
WmgwW1UCJ/9Nc0ofkIhVyQ==
jiWgy9ckGh8G+3Q7Rl//NW9ZU7TU
JCoawiBkwAkeJOehkNXRCYnj3A==
WQDFZvang91P
zGrJ4CA2pAhR
QPRTjvEmeNHJHLw4
hEsOq/9JLoNbN7xMFR/pVZbo3A==
v8ye4m6wAfCjtD/9guHh
BBLwmMMaoKz+DbU6
sjgLlNkZ9mir2p0w
RA94vAgqczVm8w+fAX9t1A==
Jc7S9gc/CMtY
d3Q3djg/CMtY
VhqBnq4x3sYMs0L9guHh
n/v36+MW2b27KCv99g==
Vi71NEakLqvP3MqenbNiUC4Ag77W
q2PO39wujdOnAuxj/A==
ZR3lmukghPyiLio14Qr3UzQ=
Zl6HrWMq4wVAYg==
cSLhluP/Ofkn0vf86RH8
9eSoKHzSznZ2E2I=
VS76OTqEeTTUTf3yG0P2ZTQ=
SvRzutQ0LP2xOD65OIlNvcGjf7wR95Ls
k35uD09p0eN9KnU=
lFirx9M0pQpUg0jpvjMpH5S0UrTP
ajKdwrz9WE/8A1dLTCw=
CaL/NoESHca/R3Y0GCQ=
Sghzwgx+c9nHatnaLXxVyQ==
UwF0yGa7uiI=
fjKKobYsUVNpBGc=
OScsLPAH3p9A
kVEWzgFRqnZTJ5QB4w==
wpZxCWOk7NaBlkkWI2dWfSi5xQ==
ijqu3+QWAg603ptOFAq1qfMEc1sXIr/5
zZ4ewkBx7qdG
qI9yt8kQwDhe/2/igMWe3CgL
ANUmYpsVtpbSTJViQ3TjXDY=
nzb3pvZA80MQWk3SbYjyUi8=
HAbPWI0YyvXqYJgf4EEpi3xdT6B13J7x
olY01h1WKvkhBy/y7Q==
dGJK/EiDz5UuvM1W9Q==
em4mQ1fciHK2cC3u/EdFfSi5xQ==
pxC52NcfWmjL+qUw
j3o1VEaAW6jAS1tkRjs=
UAK5/hRmtnmXLXQbf+3sTCs=
v2yzvsMvthMyTA7Gq50ZfSi5xQ==
ehryofUgZVKUMZtJ2vCggmkD
B7kHDAhZxHzJHLw4
nYxx+02TYE35jH5JXYU0fLuPYDw=
succes-digitalmlm.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Executes dropped EXE 2 IoCs

pid	Process
1516	hqiyzna.exe
4856	hqiyzna.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	hqiyzna.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1516 set thread context of 4856	1516	hqiyzna.exe	83
PID 4856 set thread context of 3068	4856	hqiyzna.exe	45
PID 4388 set thread context of 3068	4388	cmmon32.exe	45

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	cmmon32.exe

Suspicious behavior: EnumeratesProcesses 62 IoCs

pid	Process
4856	hqiyzna.exe
4856	hqiyzna.exe
4856	hqiyzna.exe
4856	hqiyzna.exe
4856	hqiyzna.exe
4856	hqiyzna.exe
4856	hqiyzna.exe
4856	hqiyzna.exe
4388	cmmon32.exe
4388	cmmon32.exe
4388	cmmon32.exe
4388	cmmon32.exe
4388	cmmon32.exe
4388	cmmon32.exe
4388	cmmon32.exe
4388	cmmon32.exe
4388	cmmon32.exe
4388	cmmon32.exe
4388	cmmon32.exe
4388	cmmon32.exe
4388	cmmon32.exe
4388	cmmon32.exe
4388	cmmon32.exe
4388	cmmon32.exe
4388	cmmon32.exe
4388	cmmon32.exe
4388	cmmon32.exe
4388	cmmon32.exe
4388	cmmon32.exe
4388	cmmon32.exe
4388	cmmon32.exe
4388	cmmon32.exe
4388	cmmon32.exe
4388	cmmon32.exe
4388	cmmon32.exe
4388	cmmon32.exe
4388	cmmon32.exe
4388	cmmon32.exe
4388	cmmon32.exe
4388	cmmon32.exe
4388	cmmon32.exe
4388	cmmon32.exe
4388	cmmon32.exe
4388	cmmon32.exe
4388	cmmon32.exe
4388	cmmon32.exe
4388	cmmon32.exe
4388	cmmon32.exe
4388	cmmon32.exe
4388	cmmon32.exe
4388	cmmon32.exe
4388	cmmon32.exe
4388	cmmon32.exe
4388	cmmon32.exe
4388	cmmon32.exe
4388	cmmon32.exe
4388	cmmon32.exe
4388	cmmon32.exe
4388	cmmon32.exe
4388	cmmon32.exe
4388	cmmon32.exe
4388	cmmon32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3068	Explorer.EXE

Suspicious behavior: MapViewOfSection 8 IoCs

pid	Process
1516	hqiyzna.exe
4856	hqiyzna.exe
4856	hqiyzna.exe
4856	hqiyzna.exe
4388	cmmon32.exe
4388	cmmon32.exe
4388	cmmon32.exe
4388	cmmon32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4856	hqiyzna.exe
Token: SeDebugPrivilege	4388	cmmon32.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 1516	2492	REF344266679_pdf.exe	81
PID 2492 wrote to memory of 1516	2492	REF344266679_pdf.exe	81
PID 2492 wrote to memory of 1516	2492	REF344266679_pdf.exe	81
PID 1516 wrote to memory of 4856	1516	hqiyzna.exe	83
PID 1516 wrote to memory of 4856	1516	hqiyzna.exe	83
PID 1516 wrote to memory of 4856	1516	hqiyzna.exe	83
PID 1516 wrote to memory of 4856	1516	hqiyzna.exe	83
PID 3068 wrote to memory of 4388	3068	Explorer.EXE	84
PID 3068 wrote to memory of 4388	3068	Explorer.EXE	84
PID 3068 wrote to memory of 4388	3068	Explorer.EXE	84
PID 4388 wrote to memory of 4852	4388	cmmon32.exe	92
PID 4388 wrote to memory of 4852	4388	cmmon32.exe	92
PID 4388 wrote to memory of 4852	4388	cmmon32.exe	92

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Users\Admin\AppData\Local\Temp\REF344266679_pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\REF344266679_pdf.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2492
- - C:\Users\Admin\AppData\Local\Temp\hqiyzna.exe
    "C:\Users\Admin\AppData\Local\Temp\hqiyzna.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:1516
  - - C:\Users\Admin\AppData\Local\Temp\hqiyzna.exe
      "C:\Users\Admin\AppData\Local\Temp\hqiyzna.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:4856
- C:\Windows\SysWOW64\cmmon32.exe
  "C:\Windows\SysWOW64\cmmon32.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4388
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:4852

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hqiyzna.exe

Path C:\Users\Admin\AppData\Local\Temp\hqiyzna.exe
Size 6KB
SHA256 c50553b262fcae812720a5cfb9b1646eabfcc88d4658e3cfcb78c3d33539c23b
MD5 d9bea4251a1a7b4748a95b84876dc615
SHA1 3482d2f3cde595c22ef743568053d0720b8180f4
SHA512 af1eb02e65eb82fe03893051aeb4141c280a13dab582aa17097ccb1239dea2232657ba6a68aab76d8764932a7bc8e9106b8c5b45aaf7474dc63eb1310a8541dd
SSDEEP 96:3KZQyLhEoUjvgVGU+2JW4F0pYEW+4oyn0Tv9ukbXx:WQym+GU+P4F0pYF+4oyn04
MD5 SHA1 SHA512 SSDEEP

Submit Download

hqiyzna.exe

Path C:\Users\Admin\AppData\Local\Temp\hqiyzna.exe
Size 6KB
SHA256 c50553b262fcae812720a5cfb9b1646eabfcc88d4658e3cfcb78c3d33539c23b
MD5 d9bea4251a1a7b4748a95b84876dc615
SHA1 3482d2f3cde595c22ef743568053d0720b8180f4
SHA512 af1eb02e65eb82fe03893051aeb4141c280a13dab582aa17097ccb1239dea2232657ba6a68aab76d8764932a7bc8e9106b8c5b45aaf7474dc63eb1310a8541dd
SSDEEP 96:3KZQyLhEoUjvgVGU+2JW4F0pYEW+4oyn0Tv9ukbXx:WQym+GU+P4F0pYF+4oyn04
MD5 SHA1 SHA512 SSDEEP

Submit Download

hqiyzna.exe

Path C:\Users\Admin\AppData\Local\Temp\hqiyzna.exe
Size 6KB
SHA256 c50553b262fcae812720a5cfb9b1646eabfcc88d4658e3cfcb78c3d33539c23b
MD5 d9bea4251a1a7b4748a95b84876dc615
SHA1 3482d2f3cde595c22ef743568053d0720b8180f4
SHA512 af1eb02e65eb82fe03893051aeb4141c280a13dab582aa17097ccb1239dea2232657ba6a68aab76d8764932a7bc8e9106b8c5b45aaf7474dc63eb1310a8541dd
SSDEEP 96:3KZQyLhEoUjvgVGU+2JW4F0pYEW+4oyn0Tv9ukbXx:WQym+GU+P4F0pYF+4oyn04
MD5 SHA1 SHA512 SSDEEP

Submit Download

phzibx.bx

Path C:\Users\Admin\AppData\Local\Temp\phzibx.bx
Size 5KB
SHA256 6257a03dcd872216ddb39c7ac06d1da62c84dd54559d8a66d4cdf4dc43dcd629
MD5 b2df95ceaff4d015095ed96816668b9c
SHA1 c932d102a7934b1d015ab7b4b5c7047e3e212cdb
SHA512 3a0fb0f50bd71346eda95321f1743bedf86d2fef02828d323fa89ae446b50a94fa5e919b9d086fc40730ada5af2a464dfd18f516e4cd91e364a70ac2374cbf15
SSDEEP 96:WTjjHuP/PV30fkjg/sBrbSEhMnub0HHsFVu+HMSPUThZa5rnm3v37lbDoI+PHF2:eHuP/d3sygSr/eH3VBhObm/37doI+fA
MD5 SHA1 SHA512 SSDEEP

Submit Download

sckepc.fwm

Path C:\Users\Admin\AppData\Local\Temp\sckepc.fwm
Size 185KB
SHA256 15edf5648cc15db173195d68540e2443300e0e1626437f0bcd24d8b3bfa98d8b
MD5 963564e1ab3d99dfac9a04b29a382017
SHA1 142f5c30131f8095a68d0e9fae42b068c0306ea9
SHA512 5614f4ff1b855825dd28cea705de4a86a02b559a03e73ffc106c4ec40a33e876ceace0423d228e5abf9ff2c9b217f3809abd89674c56b5e9320584ac1d72ceaf
SSDEEP 3072:yLy32xlwxilHRGLaTZOEFzI31TPkMlS6lnfjruopGSc:Gy3qwxi/mkZHFOlSAbruANc
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3068-151-0x0000000008780000-0x00000000088D9000-memory.dmp

Download

memory/3068-149-0x0000000008780000-0x00000000088D9000-memory.dmp

Download

memory/3068-143-0x0000000008600000-0x0000000008780000-memory.dmp

Download

memory/4388-147-0x0000000002720000-0x0000000002A6A000-memory.dmp

Download

memory/4388-150-0x0000000000820000-0x000000000084D000-memory.dmp

Download

memory/4388-148-0x0000000002550000-0x00000000025DF000-memory.dmp

Download

memory/4388-145-0x0000000000370000-0x000000000037C000-memory.dmp

Download

memory/4388-146-0x0000000000820000-0x000000000084D000-memory.dmp

Download

memory/4856-142-0x0000000000520000-0x0000000000530000-memory.dmp

Download

memory/4856-141-0x0000000000B10000-0x0000000000E5A000-memory.dmp

Download

memory/4856-140-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4856-139-0x0000000000400000-0x000000000042F000-memory.dmp

Download