formbook | e15347eeeba6fb5f12440c9c2720d8055747cd973fde267d7e159f40efa62ab5

Analysis

max time kernel
157s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/11/2022, 21:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Inv #CI-OMG200196.exe
Size 692KB
Sample221102-1srv6acah4
SHA256 e15347eeeba6fb5f12440c9c2720d8055747cd973fde267d7e159f40efa62ab5
MD5 cb73677fbf4069cbc3d383302399f964
SHA1 1983ba634f0c9c5bc1e214a29e7c2f7b04ec17fc
SHA512 db93735830674f28e5d031cd617974c87a5798d4c2b72edc8cfce9933c1e368550243ed7ed3ae86b646331ac68c5ffadc056804ca0c32a5e72c1270d4f673dd1
SSDEEP 12288:8WJ6chAJioBNSmTFSPVqcaO6D7zkoT+lqp/7Iu/O2ybZx9Y9rl7jjGHQ:8WJ6cToBPFSPVaZlT+lQTD/O3BArRCHQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook nf35 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

nf35

Decoy

tBnrD3YKFOOZL5Y=
iDWqMmvFXWdPjwrVyg==
Mi+2XYdTddDZjOFylYbC75w=
0CngqOrR1wIPvRDlxffi5ow=
0A/A3EXbosXuAiXn0w==
B/vQ9VhlqkveYLN3WSyC9KhVaVLC
jDG6d+p8NVnbSKM3k9X49qKGmmA8rOg=
D0Ph2f5O/+Ubmg/nyg==
Virrs5Ryq0nmaeTXw9/T9JU=
B8l/lfoUXwS6/fvczt/T9JU=
bYcGzDhAixEnGR7zcO2JF79VaVLC
JwcApzyrhEtKIQ==
PS4USZ9kULjr4KpwpNEn8w==
jdV+IANzTFXuYOPgz/fi5ow=
Vv2tgOmx4lZlPybYj9hj
t+qr3Eq1TfBDC/nq1Q==
jKk21gjq81fDf3ll
o8tyfKj+n4Yu+y8hl+crD+W3WU/K
kO+vd4HbxIyEOg==
o3E0Q6S7+V9pV1E+rZ3LU//SfkWCOFS+Xw==
Z13onsnfvQkg
50UfXL1YnoEefe7V0g==
XoF0nO/BxA1r1x/s2w==
s7mEPiX9M9lzFHcgyFLQ3Ig=
ue2F9hRnTY3Df3ll
hjDFmwFSwaNUzRfrTq/4vnVi
EmLMlPpJ5u+MFsptYzY=
p1lIVsbglcLB2bht
sLKTvigvY9Do79zOuRl9/+3EPw==
2tFZCieVhEtKIQ==
3YEEyAZrW4/Df3ll
0LWPRFzuk4bDSZw=
kDHtrZOwmg8x
zcW20gHcpQMs
g1nCXziQV1lnPqMiQ68i7A==
l/GwcrWZmc/5zSyyht/T9JU=
Z4sv8+p5f8fuAiXn0w==
ukbKktIcwakxmeOz3GCb2ZE=
1YZPgLud+H4/Qg/uxA==
ghX60s5hc7e61evZbO8x9w==
zJlPEwoHcSCkPKNXNy1lZUr2dickqug=
u2Hpo9gn9yIt2ltS/Koj7g==
W2jlqh0sdAEsKyrYj9hj
/ivIeF+8k+8L1Z1WxxJgnYYe7+o=
4hvTisCf+fru0a163TOzGbdVaVLC
RGfqrB/45UBgPybYj9hj
eIkAiLBjH0wWhQbpw9/T9JU=
0ScMIXVgfA0x
S7eFkbgC3BchPS8Hamnvyn9gIIYEjw==
/+lU4RTnEZcSUB/fULD4vnVi
NhyaSTabhxIwAiXn0w==
DRaPSr/XIMdc3FpC/Koj7g==
d034mskbqMXuAiXn0w==
WKNZIj+pPFNZPybYj9hj
Uhe1tN3RSzZ6DoE=
1TX0vKX6r6GZmuTZyg==
oL1KP4rVc3h8O5J6URVUloYe7+o=
/yG7XS5b+O3fmAuKIeUn8w==
6AvV1aFsnEc/Qg/uxA==
b1kMpoeWD93jshv0xt/T9JU=
en/1tyH5DbBitZ535OQw4JRoII75hQ==
TpZRCepFIWd9lINwUbc3Dr6aJOpzOFS+Xw==
WO11JkMnQ8z75i8b+FLU3oo=
1Y8+UHhOmSRGQBfbSH119Ztt
dark.gold

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Executes dropped EXE 2 IoCs

pid	Process
4244	zbvyijlae.exe
928	zbvyijlae.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	zbvyijlae.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4244 set thread context of 928	4244	zbvyijlae.exe	80
PID 928 set thread context of 376	928	zbvyijlae.exe	26
PID 4612 set thread context of 376	4612	rundll32.exe	26

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	rundll32.exe

Suspicious behavior: EnumeratesProcesses 62 IoCs

pid	Process
928	zbvyijlae.exe
928	zbvyijlae.exe
928	zbvyijlae.exe
928	zbvyijlae.exe
928	zbvyijlae.exe
928	zbvyijlae.exe
928	zbvyijlae.exe
928	zbvyijlae.exe
4612	rundll32.exe
4612	rundll32.exe
4612	rundll32.exe
4612	rundll32.exe
4612	rundll32.exe
4612	rundll32.exe
4612	rundll32.exe
4612	rundll32.exe
4612	rundll32.exe
4612	rundll32.exe
4612	rundll32.exe
4612	rundll32.exe
4612	rundll32.exe
4612	rundll32.exe
4612	rundll32.exe
4612	rundll32.exe
4612	rundll32.exe
4612	rundll32.exe
4612	rundll32.exe
4612	rundll32.exe
4612	rundll32.exe
4612	rundll32.exe
4612	rundll32.exe
4612	rundll32.exe
4612	rundll32.exe
4612	rundll32.exe
4612	rundll32.exe
4612	rundll32.exe
4612	rundll32.exe
4612	rundll32.exe
4612	rundll32.exe
4612	rundll32.exe
4612	rundll32.exe
4612	rundll32.exe
4612	rundll32.exe
4612	rundll32.exe
4612	rundll32.exe
4612	rundll32.exe
4612	rundll32.exe
4612	rundll32.exe
4612	rundll32.exe
4612	rundll32.exe
4612	rundll32.exe
4612	rundll32.exe
4612	rundll32.exe
4612	rundll32.exe
4612	rundll32.exe
4612	rundll32.exe
4612	rundll32.exe
4612	rundll32.exe
4612	rundll32.exe
4612	rundll32.exe
4612	rundll32.exe
4612	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
376	Explorer.EXE

Suspicious behavior: MapViewOfSection 9 IoCs

pid	Process
4244	zbvyijlae.exe
4244	zbvyijlae.exe
928	zbvyijlae.exe
928	zbvyijlae.exe
928	zbvyijlae.exe
4612	rundll32.exe
4612	rundll32.exe
4612	rundll32.exe
4612	rundll32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	928	zbvyijlae.exe
Token: SeDebugPrivilege	4612	rundll32.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4244	zbvyijlae.exe
4244	zbvyijlae.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4244	zbvyijlae.exe
4244	zbvyijlae.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 628 wrote to memory of 4244	628	Inv #CI-OMG200196.exe	79
PID 628 wrote to memory of 4244	628	Inv #CI-OMG200196.exe	79
PID 628 wrote to memory of 4244	628	Inv #CI-OMG200196.exe	79
PID 4244 wrote to memory of 928	4244	zbvyijlae.exe	80
PID 4244 wrote to memory of 928	4244	zbvyijlae.exe	80
PID 4244 wrote to memory of 928	4244	zbvyijlae.exe	80
PID 4244 wrote to memory of 928	4244	zbvyijlae.exe	80
PID 376 wrote to memory of 4612	376	Explorer.EXE	82
PID 376 wrote to memory of 4612	376	Explorer.EXE	82
PID 376 wrote to memory of 4612	376	Explorer.EXE	82
PID 4612 wrote to memory of 4188	4612	rundll32.exe	90
PID 4612 wrote to memory of 4188	4612	rundll32.exe	90
PID 4612 wrote to memory of 4188	4612	rundll32.exe	90

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:376
- C:\Users\Admin\AppData\Local\Temp\Inv #CI-OMG200196.exe
  "C:\Users\Admin\AppData\Local\Temp\Inv #CI-OMG200196.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:628
- - C:\Users\Admin\AppData\Local\Temp\zbvyijlae.exe
    "C:\Users\Admin\AppData\Local\Temp\zbvyijlae.exe" "C:\Users\Admin\AppData\Local\Temp\nstlkcxt.au3"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4244
  - - C:\Users\Admin\AppData\Local\Temp\zbvyijlae.exe
      "C:\Users\Admin\AppData\Local\Temp\zbvyijlae.exe" "C:\Users\Admin\AppData\Local\Temp\nstlkcxt.au3"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:928
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:4600
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\SysWOW64\rundll32.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4612
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:4188

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dfxiqnijo.it

Path C:\Users\Admin\AppData\Local\Temp\dfxiqnijo.it
Size 44KB
SHA256 1dad26a94275bb69db95d73eb4bdcaad5f2fdbc6fe247988e76550b3ab32e147
MD5 d3dee11cf773c9273f85828a9c412547
SHA1 5a68f466db4f64bd11b1731b1d3e4ff610fb3d4f
SHA512 517b66ce17bf2c6fd8e4d4038e4f11075570d763e31e1558f06e8506d36b396138febc6b90eba00ff69d0b79f0e09241517dc8eedb334f99b8b623953be5a716
SSDEEP 192:1DjDlTyCNhFpQPPlGf4xioKDneZqYfM04p1z6+DFTKLnBGsg+NUOacEVzI6V+CC5:1DjDlTywmPPlKPYUNfq/4xIkdsJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

nstlkcxt.au3

Path C:\Users\Admin\AppData\Local\Temp\nstlkcxt.au3
Size 6KB
SHA256 72b9ede23dc9db8da58ce23fbff037107ac8f11d6472646d0680776ecf7414ff
MD5 b9272ed77061ddc15c4464185d644042
SHA1 b26d27fe78e5a0e631b933e368c2b7a1a1ee6ca8
SHA512 9712364a82096e93f782bd4f6f14eedf4a26fdd9fd0244b3cb88e0265352299077560c75a8ee0d477ab801cacfeabc6fa6c580aab2b95ff97651fbb2347345d7
SSDEEP 96:eePPd0gyplgd0fgWeLg6ePPd0gyplgAyfLgNePPALPOCPfj7f+C5LyF8fM0gyC5j:etg93baWQ6g
MD5 SHA1 SHA512 SSDEEP

Submit Download

qpjhxohnlr.qrc

Path C:\Users\Admin\AppData\Local\Temp\qpjhxohnlr.qrc
Size 185KB
SHA256 24057991e89b0dad023c1c4fbeada36c0743486ce8e1d793ea6d5486fa1123c6
MD5 e32994907cffbda07947ddfc1aec961f
SHA1 1a2ee3ec94d31e151210f3eeade694ab8e667771
SHA512 8f9d1f50cfae9a24170fa79eea3ccb2588780c0068ff3313c0b1e4cf9c52a23a3078bd70b1e06a59c61325e8e61fbd61828c269f0e749e54e4c4f87084bf1d13
SSDEEP 3072:+AVLzPiraKBxB/Yx9w3BeKvSiXQbCTXNFMpZTx+Efui8SscVgRJu/R:+wvirv/1PvSigCTXN2dx+Emi8SHVqJ+R
MD5 SHA1 SHA512 SSDEEP

Submit Download

zbvyijlae.exe

Path C:\Users\Admin\AppData\Local\Temp\zbvyijlae.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zbvyijlae.exe

Path C:\Users\Admin\AppData\Local\Temp\zbvyijlae.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zbvyijlae.exe

Path C:\Users\Admin\AppData\Local\Temp\zbvyijlae.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/376-142-0x0000000002780000-0x0000000002843000-memory.dmp

Download

memory/376-153-0x0000000008020000-0x00000000080EE000-memory.dmp

Download

memory/376-151-0x0000000008020000-0x00000000080EE000-memory.dmp

Download

memory/376-149-0x0000000002780000-0x0000000002843000-memory.dmp

Download

memory/928-144-0x0000000001480000-0x00000000014AF000-memory.dmp

Download

memory/928-141-0x0000000001600000-0x0000000001610000-memory.dmp

Download

memory/928-140-0x0000000001BF0000-0x0000000001F3A000-memory.dmp

Download

memory/928-139-0x0000000001480000-0x00000000014AF000-memory.dmp

Download

memory/4612-147-0x00000000012E0000-0x000000000130D000-memory.dmp

Download

memory/4612-148-0x0000000003170000-0x00000000034BA000-memory.dmp

Download

memory/4612-146-0x0000000000700000-0x0000000000714000-memory.dmp

Download

memory/4612-150-0x00000000034C0000-0x000000000354F000-memory.dmp

Download

memory/4612-152-0x00000000012E0000-0x000000000130D000-memory.dmp

Download