formbook | e4a8d78909b8d84fcb3d01b91ddeab26615148da704621a3635ac869c9d5dcaf

Analysis

max time kernel
147s
max time network
152s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27/10/2022, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3745a1fe4166a96e06729c67fd1469c7.exe
Size 274KB
Sample221027-va526schfn
SHA256 e4a8d78909b8d84fcb3d01b91ddeab26615148da704621a3635ac869c9d5dcaf
MD5 3745a1fe4166a96e06729c67fd1469c7
SHA1 0bef21b140c023b1158ba5d90f74fb761f1c573b
SHA512 0f8800a60cc66a64b9c14421c60b96c416e73612542f64b1a96758514b6f45552c68ae5a4f64ea7eee37298bf9cc3cf1da1ec0dbcc332ff4942b137f416654cc
SSDEEP 6144:PweEU2uCgUVrQSDux93/mMvthm7pp7jsSLWVaKsTdDfYJfTd:z2uCg69Dux9Pmehm7pp/sSaVMZYJfTd
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook axe3 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

axe3

Decoy

nV63ydJMXMf7memspIpnnVLl3Q==
uJ50rs5Y/80AqT79guHh
FcsTFQ1xekTgcal8G0P2ZTQ=
uLWWVJP++ID3dkoB8g==
YyoybGF5Fsa/UH8=
Tk4htwkBBfM5ZA==
QgJ8vN9f+uCdsD79guHh
wmjC9UuSBGyTrY5PAX9t1A==
Sw7JEwOKl576ndxw/A==
BOqs09Ikjej1BN98ZYtVfSi5xQ==
YA5cbH3/4wVAYg==
fRWIvatAXM3+t0X9guHh
FAbZXq/jFuaEq2YCwQh3b2oE
STL+RDTA652/tD/9guHh
zgLNcuX32aFB
WmgwW1UCJ/9Nc0ofkIhVyQ==
jiWgy9ckGh8G+3Q7Rl//NW9ZU7TU
JCoawiBkwAkeJOehkNXRCYnj3A==
WQDFZvang91P
zGrJ4CA2pAhR
QPRTjvEmeNHJHLw4
hEsOq/9JLoNbN7xMFR/pVZbo3A==
v8ye4m6wAfCjtD/9guHh
BBLwmMMaoKz+DbU6
sjgLlNkZ9mir2p0w
RA94vAgqczVm8w+fAX9t1A==
Jc7S9gc/CMtY
d3Q3djg/CMtY
VhqBnq4x3sYMs0L9guHh
n/v36+MW2b27KCv99g==
Vi71NEakLqvP3MqenbNiUC4Ag77W
q2PO39wujdOnAuxj/A==
ZR3lmukghPyiLio14Qr3UzQ=
Zl6HrWMq4wVAYg==
cSLhluP/Ofkn0vf86RH8
9eSoKHzSznZ2E2I=
VS76OTqEeTTUTf3yG0P2ZTQ=
SvRzutQ0LP2xOD65OIlNvcGjf7wR95Ls
k35uD09p0eN9KnU=
lFirx9M0pQpUg0jpvjMpH5S0UrTP
ajKdwrz9WE/8A1dLTCw=
CaL/NoESHca/R3Y0GCQ=
Sghzwgx+c9nHatnaLXxVyQ==
UwF0yGa7uiI=
fjKKobYsUVNpBGc=
OScsLPAH3p9A
kVEWzgFRqnZTJ5QB4w==
wpZxCWOk7NaBlkkWI2dWfSi5xQ==
ijqu3+QWAg603ptOFAq1qfMEc1sXIr/5
zZ4ewkBx7qdG
qI9yt8kQwDhe/2/igMWe3CgL
ANUmYpsVtpbSTJViQ3TjXDY=
nzb3pvZA80MQWk3SbYjyUi8=
HAbPWI0YyvXqYJgf4EEpi3xdT6B13J7x
olY01h1WKvkhBy/y7Q==
dGJK/EiDz5UuvM1W9Q==
em4mQ1fciHK2cC3u/EdFfSi5xQ==
pxC52NcfWmjL+qUw
j3o1VEaAW6jAS1tkRjs=
UAK5/hRmtnmXLXQbf+3sTCs=
v2yzvsMvthMyTA7Gq50ZfSi5xQ==
ehryofUgZVKUMZtJ2vCggmkD
B7kHDAhZxHzJHLw4
nYxx+02TYE35jH5JXYU0fLuPYDw=
succes-digitalmlm.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Executes dropped EXE 2 IoCs

pid	Process
1296	psyfho.exe
1600	psyfho.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\Geo\Nation	psyfho.exe

Loads dropped DLL 4 IoCs

pid	Process
1132	3745a1fe4166a96e06729c67fd1469c7.exe
1132	3745a1fe4166a96e06729c67fd1469c7.exe
1296	psyfho.exe
1608	chkdsk.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1296 set thread context of 1600	1296	psyfho.exe	30
PID 1600 set thread context of 1216	1600	psyfho.exe	16
PID 1608 set thread context of 1216	1608	chkdsk.exe	16

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	chkdsk.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	chkdsk.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
1600	psyfho.exe
1600	psyfho.exe
1600	psyfho.exe
1600	psyfho.exe
1608	chkdsk.exe
1608	chkdsk.exe
1608	chkdsk.exe
1608	chkdsk.exe
1608	chkdsk.exe
1608	chkdsk.exe
1608	chkdsk.exe
1608	chkdsk.exe
1608	chkdsk.exe
1608	chkdsk.exe
1608	chkdsk.exe
1608	chkdsk.exe
1608	chkdsk.exe
1608	chkdsk.exe
1608	chkdsk.exe
1608	chkdsk.exe
1608	chkdsk.exe
1608	chkdsk.exe
1608	chkdsk.exe
1608	chkdsk.exe
1608	chkdsk.exe
1608	chkdsk.exe

Suspicious behavior: MapViewOfSection 8 IoCs

pid	Process
1296	psyfho.exe
1600	psyfho.exe
1600	psyfho.exe
1600	psyfho.exe
1608	chkdsk.exe
1608	chkdsk.exe
1608	chkdsk.exe
1608	chkdsk.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1600	psyfho.exe
Token: SeDebugPrivilege	1608	chkdsk.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1216	Explorer.EXE
1216	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1216	Explorer.EXE
1216	Explorer.EXE

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 1296	1132	3745a1fe4166a96e06729c67fd1469c7.exe	28
PID 1132 wrote to memory of 1296	1132	3745a1fe4166a96e06729c67fd1469c7.exe	28
PID 1132 wrote to memory of 1296	1132	3745a1fe4166a96e06729c67fd1469c7.exe	28
PID 1132 wrote to memory of 1296	1132	3745a1fe4166a96e06729c67fd1469c7.exe	28
PID 1296 wrote to memory of 1600	1296	psyfho.exe	30
PID 1296 wrote to memory of 1600	1296	psyfho.exe	30
PID 1296 wrote to memory of 1600	1296	psyfho.exe	30
PID 1296 wrote to memory of 1600	1296	psyfho.exe	30
PID 1296 wrote to memory of 1600	1296	psyfho.exe	30
PID 1216 wrote to memory of 1608	1216	Explorer.EXE	31
PID 1216 wrote to memory of 1608	1216	Explorer.EXE	31
PID 1216 wrote to memory of 1608	1216	Explorer.EXE	31
PID 1216 wrote to memory of 1608	1216	Explorer.EXE	31
PID 1608 wrote to memory of 240	1608	chkdsk.exe	34
PID 1608 wrote to memory of 240	1608	chkdsk.exe	34
PID 1608 wrote to memory of 240	1608	chkdsk.exe	34
PID 1608 wrote to memory of 240	1608	chkdsk.exe	34
PID 1608 wrote to memory of 240	1608	chkdsk.exe	34

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Users\Admin\AppData\Local\Temp\3745a1fe4166a96e06729c67fd1469c7.exe
  "C:\Users\Admin\AppData\Local\Temp\3745a1fe4166a96e06729c67fd1469c7.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1132
- - C:\Users\Admin\AppData\Local\Temp\psyfho.exe
    "C:\Users\Admin\AppData\Local\Temp\psyfho.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:1296
  - - C:\Users\Admin\AppData\Local\Temp\psyfho.exe
      "C:\Users\Admin\AppData\Local\Temp\psyfho.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:1600
- C:\Windows\SysWOW64\chkdsk.exe
  "C:\Windows\SysWOW64\chkdsk.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1608
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:240

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

iyswjuwfq.txa

Path C:\Users\Admin\AppData\Local\Temp\iyswjuwfq.txa
Size 185KB
SHA256 5e41e235f96c3bc784d1d5959752e8f5184366c7c265de1bc76279ad2d2e96c4
MD5 ea21e5d81767a314ccb0ba7becaf765f
SHA1 0630995a565e43c9c0b00e1a6365ee08e9c93019
SHA512 4e308c7812813e6a1aefe7a1e64ca495be0f38824989bc07796375487000ace87c71130bf40fd372a06e22c0a1e14d511bec0f1e46119445cc7385e5ffae2f99
SSDEEP 3072:kDytqASUSf9IvEM4sBxhiMwB+SKsFKjZny4Pmn5of1oDHu/VB:kGEASDf2EMDPhiJPKsI9y4P45C1oDQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

mqndj.psu

Path C:\Users\Admin\AppData\Local\Temp\mqndj.psu
Size 5KB
SHA256 91462d813f240b66b586ce6bca0ae1a3d7acb6f4e8a9c787b3b76f5afdf8e72c
MD5 8cdd489fb795ba76d37af601d3e1bc5c
SHA1 0db9fa2de0de0d468d26636ab21e4f6e1ba6457d
SHA512 c18686766a4c1fbdf5d5ac92069832de0b540d046d695d59b6df0b2fd917885f737a0572443e224206780d3d5c9accf7923aea34404bb3689c150104a571ea1e
SSDEEP 96:W+zjDlaNN9THDoMh64Wio2KoN0ZVR90qdcN0q0aFVHEh2:djDlYnExv2FIj0qdk0qJ33
MD5 SHA1 SHA512 SSDEEP

Submit Download

psyfho.exe

Path C:\Users\Admin\AppData\Local\Temp\psyfho.exe
Size 77KB
SHA256 5dbe88158dd2f1913f67b98a9505c38e370846583cadcb668c759a4b60e5cb48
MD5 6e99b51b6533fe7a1ed56fa1ea553b82
SHA1 fb422cda0e04c577528849b4400d8b1ff44e9589
SHA512 f9af2c0bc3b420a04436436e1ba6816882e6204a242b58e519b3dfa8c272572e247c858fb108e4fab5c5acb355d17db49ecfe759c6c5db5de674314b28301b0c
SSDEEP 1536:nsOsBnobqPGAgPbjppql6ZW4mmE19UzEWDG6EwmagksWGsicdPCTm5RGFt:nsOWxPzyfppLOmE19UzEWvm3xsDPCTmM
MD5 SHA1 SHA512 SSDEEP

Submit Download

psyfho.exe

Path C:\Users\Admin\AppData\Local\Temp\psyfho.exe
Size 77KB
SHA256 5dbe88158dd2f1913f67b98a9505c38e370846583cadcb668c759a4b60e5cb48
MD5 6e99b51b6533fe7a1ed56fa1ea553b82
SHA1 fb422cda0e04c577528849b4400d8b1ff44e9589
SHA512 f9af2c0bc3b420a04436436e1ba6816882e6204a242b58e519b3dfa8c272572e247c858fb108e4fab5c5acb355d17db49ecfe759c6c5db5de674314b28301b0c
SSDEEP 1536:nsOsBnobqPGAgPbjppql6ZW4mmE19UzEWDG6EwmagksWGsicdPCTm5RGFt:nsOWxPzyfppLOmE19UzEWvm3xsDPCTmM
MD5 SHA1 SHA512 SSDEEP

Submit Download

psyfho.exe

Path C:\Users\Admin\AppData\Local\Temp\psyfho.exe
Size 77KB
SHA256 5dbe88158dd2f1913f67b98a9505c38e370846583cadcb668c759a4b60e5cb48
MD5 6e99b51b6533fe7a1ed56fa1ea553b82
SHA1 fb422cda0e04c577528849b4400d8b1ff44e9589
SHA512 f9af2c0bc3b420a04436436e1ba6816882e6204a242b58e519b3dfa8c272572e247c858fb108e4fab5c5acb355d17db49ecfe759c6c5db5de674314b28301b0c
SSDEEP 1536:nsOsBnobqPGAgPbjppql6ZW4mmE19UzEWDG6EwmagksWGsicdPCTm5RGFt:nsOWxPzyfppLOmE19UzEWvm3xsDPCTmM
MD5 SHA1 SHA512 SSDEEP

Submit Download

psyfho.exe

Path \Users\Admin\AppData\Local\Temp\psyfho.exe
Size 77KB
SHA256 5dbe88158dd2f1913f67b98a9505c38e370846583cadcb668c759a4b60e5cb48
MD5 6e99b51b6533fe7a1ed56fa1ea553b82
SHA1 fb422cda0e04c577528849b4400d8b1ff44e9589
SHA512 f9af2c0bc3b420a04436436e1ba6816882e6204a242b58e519b3dfa8c272572e247c858fb108e4fab5c5acb355d17db49ecfe759c6c5db5de674314b28301b0c
SSDEEP 1536:nsOsBnobqPGAgPbjppql6ZW4mmE19UzEWDG6EwmagksWGsicdPCTm5RGFt:nsOWxPzyfppLOmE19UzEWvm3xsDPCTmM
MD5 SHA1 SHA512 SSDEEP

Submit Download

psyfho.exe

Path \Users\Admin\AppData\Local\Temp\psyfho.exe
Size 77KB
SHA256 5dbe88158dd2f1913f67b98a9505c38e370846583cadcb668c759a4b60e5cb48
MD5 6e99b51b6533fe7a1ed56fa1ea553b82
SHA1 fb422cda0e04c577528849b4400d8b1ff44e9589
SHA512 f9af2c0bc3b420a04436436e1ba6816882e6204a242b58e519b3dfa8c272572e247c858fb108e4fab5c5acb355d17db49ecfe759c6c5db5de674314b28301b0c
SSDEEP 1536:nsOsBnobqPGAgPbjppql6ZW4mmE19UzEWDG6EwmagksWGsicdPCTm5RGFt:nsOWxPzyfppLOmE19UzEWvm3xsDPCTmM
MD5 SHA1 SHA512 SSDEEP

Submit Download

psyfho.exe

Path \Users\Admin\AppData\Local\Temp\psyfho.exe
Size 77KB
SHA256 5dbe88158dd2f1913f67b98a9505c38e370846583cadcb668c759a4b60e5cb48
MD5 6e99b51b6533fe7a1ed56fa1ea553b82
SHA1 fb422cda0e04c577528849b4400d8b1ff44e9589
SHA512 f9af2c0bc3b420a04436436e1ba6816882e6204a242b58e519b3dfa8c272572e247c858fb108e4fab5c5acb355d17db49ecfe759c6c5db5de674314b28301b0c
SSDEEP 1536:nsOsBnobqPGAgPbjppql6ZW4mmE19UzEWDG6EwmagksWGsicdPCTm5RGFt:nsOWxPzyfppLOmE19UzEWvm3xsDPCTmM
MD5 SHA1 SHA512 SSDEEP

Submit Download

sqlite3.dll

Path \Users\Admin\AppData\Local\Temp\sqlite3.dll
Size 895KB
SHA256 a5ef3a78eb333b0e6dca194ea711dcbb036119a788ecfe125f05176fb0fb70a3
MD5 1eb6acf76a15b74b38333af47dc1218d
SHA1 a3fbc817f59b6a8899dc338cc15a75cdd17dfff1
SHA512 717931aa928de150abbb70d523c7dbd472bfa6c511ab55e0b50df8d9661d33635156ed7b750285fa383cdd4064f225ea022f0bead3e066ee2beba84ef5731c15
SSDEEP 24576:uY80dlS9SDd59YfRAbaJJs1E8NIGG6lmd//V:uY8iSa2RAbaJJsO8NIGGoG
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1132-54-0x0000000075931000-0x0000000075933000-memory.dmp

Download

memory/1216-70-0x00000000067A0000-0x00000000068D2000-memory.dmp

Download

memory/1216-79-0x0000000004840000-0x000000000490E000-memory.dmp

Download

memory/1216-76-0x0000000004840000-0x000000000490E000-memory.dmp

Download

memory/1600-67-0x0000000000401000-0x000000000042F000-memory.dmp

Download

memory/1600-69-0x0000000000110000-0x0000000000120000-memory.dmp

Download

memory/1600-68-0x0000000000C10000-0x0000000000F13000-memory.dmp

Download

memory/1600-66-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1608-72-0x0000000000A80000-0x0000000000A87000-memory.dmp

Download

memory/1608-73-0x00000000000E0000-0x000000000010D000-memory.dmp

Download

memory/1608-74-0x0000000002020000-0x0000000002323000-memory.dmp

Download

memory/1608-75-0x0000000000950000-0x00000000009DF000-memory.dmp

Download

memory/1608-77-0x00000000000E0000-0x000000000010D000-memory.dmp

Download