formbook | e13e08e3de1d9fa5a1fee56048118bf59a11ebbadbe2b38af4f10fecb6d29796

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
31/10/2022, 23:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Inquiry.exe
Size 572KB
Sample221031-3xvtqaech4
SHA256 e13e08e3de1d9fa5a1fee56048118bf59a11ebbadbe2b38af4f10fecb6d29796
MD5 82fc4f99deab2396aa0d090fe2fdb243
SHA1 32de8de06538f2160a40bdc39ccb761a27fbd3b3
SHA512 d83527dd1aebbc671a668dbbe355d2008e62bdf3f9226ece8f76bc7f5e177ded9485de9f6a7598729486002c3cb049e5e049e1e4acf18318c6a71f31ca6ec897
SSDEEP 12288:0h7eU/qSNAo7hNlRXWiy7eR158pGloF38cm7DEyLL4:1UJb1MiIe35gG3EyL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook oi05 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

oi05

Decoy

fluidavail.online
blchain.tech
kyocera.website
sangmine.xyz
thepolicyjacket.info
ssvhelpman.net
y-t-design.com
eminentabroad.com
codingcamp.store
bester.capital
tanjiya23.site
bheniamyn.dev
top5monitor.com
bit-prim.trade
airstreamsocialclub.com
darkwarspod.com
zazisalesdistribution.com
vivolentlo.online
daftburo.net
elemangelsin.xyz
chasewildfire.buzz
olioubnajo.buzz
agoura.dental
ky4352.com
finechoice.mobi
studioarchadroit.com
5009townesouth.com
tik454register.xyz
divaresesaat.xyz
projektwrestling.com
krystalclearmemories.net
vinaychhaparia.com
sodexosupplychain.info
uudai.store
demontya.site
cloudydad.cloud
mewzom.online
20010906.xyz
epuken.link
saludaldia.tech
generto.com
mbenzmotorsport.com
voidssl.life
elbetolacakbirgece10.com
cdncleaningservices.com
kuzs248.top
verus.website
wisefocus.net
xn--nergie-de-gaia-9jb.com
wowsportsbet.com
vhkopiu.top
shopify-postmaster15.info
lysiimmobilier.site
princess.express
betebrands.com
6tldsuoacvrlwc1g4i.top
labucarimini.net
hogushinotakumi.com
turnhappy.shop
geenpaii.xyz
pyrrhadev.xyz
minhasaudeelevada.com
oblk.pics
recursosdijitales.com
vivencie.shop

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 6 IoCs

rat

resource	yara_rule
behavioral1/memory/1812-67-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1812-68-0x000000000041F100-mapping.dmp	formbook
behavioral1/memory/1812-70-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1812-80-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1580-82-0x0000000000080000-0x00000000000AF000-memory.dmp	formbook
behavioral1/memory/1580-87-0x0000000000080000-0x00000000000AF000-memory.dmp	formbook

Deletes itself 1 IoCs

pid	Process
1948	cmd.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1976 set thread context of 1812	1976	Inquiry.exe	32
PID 1812 set thread context of 1284	1812	Inquiry.exe	13
PID 1812 set thread context of 1284	1812	Inquiry.exe	13
PID 1580 set thread context of 1284	1580	systray.exe	13

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1392	schtasks.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
1976	Inquiry.exe
1976	Inquiry.exe
1812	Inquiry.exe
1812	Inquiry.exe
1488	powershell.exe
1812	Inquiry.exe
1580	systray.exe
1580	systray.exe
1580	systray.exe
1580	systray.exe
1580	systray.exe
1580	systray.exe
1580	systray.exe
1580	systray.exe
1580	systray.exe
1580	systray.exe
1580	systray.exe
1580	systray.exe
1580	systray.exe
1580	systray.exe
1580	systray.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
1812	Inquiry.exe
1812	Inquiry.exe
1812	Inquiry.exe
1812	Inquiry.exe
1580	systray.exe
1580	systray.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1976	Inquiry.exe
Token: SeDebugPrivilege	1812	Inquiry.exe
Token: SeDebugPrivilege	1488	powershell.exe
Token: SeDebugPrivilege	1580	systray.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1284	Explorer.EXE
1284	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1284	Explorer.EXE
1284	Explorer.EXE

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 1488	1976	Inquiry.exe	26
PID 1976 wrote to memory of 1488	1976	Inquiry.exe	26
PID 1976 wrote to memory of 1488	1976	Inquiry.exe	26
PID 1976 wrote to memory of 1488	1976	Inquiry.exe	26
PID 1976 wrote to memory of 1392	1976	Inquiry.exe	28
PID 1976 wrote to memory of 1392	1976	Inquiry.exe	28
PID 1976 wrote to memory of 1392	1976	Inquiry.exe	28
PID 1976 wrote to memory of 1392	1976	Inquiry.exe	28
PID 1976 wrote to memory of 980	1976	Inquiry.exe	30
PID 1976 wrote to memory of 980	1976	Inquiry.exe	30
PID 1976 wrote to memory of 980	1976	Inquiry.exe	30
PID 1976 wrote to memory of 980	1976	Inquiry.exe	30
PID 1976 wrote to memory of 1768	1976	Inquiry.exe	31
PID 1976 wrote to memory of 1768	1976	Inquiry.exe	31
PID 1976 wrote to memory of 1768	1976	Inquiry.exe	31
PID 1976 wrote to memory of 1768	1976	Inquiry.exe	31
PID 1976 wrote to memory of 1812	1976	Inquiry.exe	32
PID 1976 wrote to memory of 1812	1976	Inquiry.exe	32
PID 1976 wrote to memory of 1812	1976	Inquiry.exe	32
PID 1976 wrote to memory of 1812	1976	Inquiry.exe	32
PID 1976 wrote to memory of 1812	1976	Inquiry.exe	32
PID 1976 wrote to memory of 1812	1976	Inquiry.exe	32
PID 1976 wrote to memory of 1812	1976	Inquiry.exe	32
PID 1812 wrote to memory of 1580	1812	Inquiry.exe	33
PID 1812 wrote to memory of 1580	1812	Inquiry.exe	33
PID 1812 wrote to memory of 1580	1812	Inquiry.exe	33
PID 1812 wrote to memory of 1580	1812	Inquiry.exe	33
PID 1580 wrote to memory of 1948	1580	systray.exe	34
PID 1580 wrote to memory of 1948	1580	systray.exe	34
PID 1580 wrote to memory of 1948	1580	systray.exe	34
PID 1580 wrote to memory of 1948	1580	systray.exe	34

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1284
- C:\Users\Admin\AppData\Local\Temp\Inquiry.exe
  "C:\Users\Admin\AppData\Local\Temp\Inquiry.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1976
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\DZpUCDvjKYZme.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1488
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DZpUCDvjKYZme" /XML "C:\Users\Admin\AppData\Local\Temp\tmp658.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:1392
- - C:\Users\Admin\AppData\Local\Temp\Inquiry.exe
    "C:\Users\Admin\AppData\Local\Temp\Inquiry.exe"
    3⤵
    PID:980
- - C:\Users\Admin\AppData\Local\Temp\Inquiry.exe
    "C:\Users\Admin\AppData\Local\Temp\Inquiry.exe"
    3⤵
    PID:1768
- - C:\Users\Admin\AppData\Local\Temp\Inquiry.exe
    "C:\Users\Admin\AppData\Local\Temp\Inquiry.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1812
  - - C:\Windows\SysWOW64\systray.exe
      "C:\Windows\SysWOW64\systray.exe"
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1580
    - - C:\Windows\SysWOW64\cmd.exe
        
        /c del "C:\Users\Admin\AppData\Local\Temp\Inquiry.exe"
        5⤵
        Deletes itself
        
        PID:1948

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp658.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp658.tmp
Size 1KB
SHA256 dc55aafdf7bb3d8a2386f55f088f0b22451b3812e2b3e62a5a99000fb50abb79
MD5 38c9918575d326a0ca0d658da6377806
SHA1 456e8a5c31f70b79d35cb1e9bd608950331a6466
SHA512 9726b34dc3085c74328077d27411d1e307eb34f81f8c1d11fd4e417ceb48c1583e727d5f15526ec2fe8c770b816330d8c1ef13befaf2dd91a5978bf372b36077
MD5 SHA1 SHA512

Submit Download

memory/1284-88-0x0000000003CA0000-0x0000000003D9D000-memory.dmp

Download

memory/1284-86-0x0000000003CA0000-0x0000000003D9D000-memory.dmp

Download

memory/1284-78-0x0000000004A00000-0x0000000004AE3000-memory.dmp

Download

memory/1284-74-0x0000000004410000-0x00000000044F2000-memory.dmp

Download

memory/1488-72-0x000000006BB00000-0x000000006C0AB000-memory.dmp

Download

memory/1488-75-0x000000006BB00000-0x000000006C0AB000-memory.dmp

Download

memory/1580-81-0x0000000000DF0000-0x0000000000DF5000-memory.dmp

Download

memory/1580-82-0x0000000000080000-0x00000000000AF000-memory.dmp

Download

memory/1580-84-0x0000000002200000-0x0000000002503000-memory.dmp

Download

memory/1580-85-0x0000000000990000-0x0000000000A23000-memory.dmp

Download

memory/1580-87-0x0000000000080000-0x00000000000AF000-memory.dmp

Download

memory/1812-73-0x0000000000450000-0x0000000000464000-memory.dmp

Download

memory/1812-64-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1812-71-0x0000000000A00000-0x0000000000D03000-memory.dmp

Download

memory/1812-70-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1812-77-0x0000000000490000-0x00000000004A4000-memory.dmp

Download

memory/1812-65-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1812-80-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1812-67-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1976-54-0x00000000000A0000-0x0000000000136000-memory.dmp

Download

memory/1976-57-0x0000000000330000-0x000000000033C000-memory.dmp

Download

memory/1976-58-0x0000000007340000-0x00000000073B0000-memory.dmp

Download

memory/1976-56-0x0000000000460000-0x0000000000478000-memory.dmp

Download

memory/1976-63-0x00000000020E0000-0x0000000002116000-memory.dmp

Download

memory/1976-55-0x0000000074D81000-0x0000000074D83000-memory.dmp

Download