formbook | d08bd114dd8a6575cd15bfad46b2216cc25c8fa8f6e46c7d0b4c4cb2fa27b47b

Analysis

max time kernel
170s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
09/11/2022, 00:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
New Purchase Order.exe
Size 832KB
Sample221109-abf48acdb6
SHA256 d08bd114dd8a6575cd15bfad46b2216cc25c8fa8f6e46c7d0b4c4cb2fa27b47b
MD5 a4f2129dd334274ed78955365d8faa0f
SHA1 2d21c5944133053b31542f999a426012009b699b
SHA512 cfbcac7fabe057f0842341065993c4eeea6ee79e8bc4000efceeca9cbef6063e3c1995803a08ca0a8406b06fe4f2e16abca86d1b985dbdb6daaa51d17454877b
SSDEEP 24576:f6r1qaHMtYAfpUS55CQZH4FBdqV+qDmtUlta:yrgQ2UM5CQZH2Bdpa1lta
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook sq02 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

sq02

Decoy

3Jp3NoUyd0k5yoU=
DhSGjBYHlFyNLt9nm84C
FVfx4axcqDpkTTUWdQ==
OziDS4ozcew4ymYURM7abJeRP68k
pFQo1uFJakbogCi06h4/1/I=
svyJgYUiblD8TTUWdQ==
1QlRFGcZUjf1lGu34FiNrw==
oddcQg2717DQ7g==
bVmcdOnWYC2O5LEI
9Oc08iXmXyeO5LEI
7d4r9zfzXOgLoyeNre0l1Wjg
5qdyLmkbj2VQ3Ic=
bqL3wYaK1ZLM7A==
ZXni0M+9/9nz/Q==
N8CWT+lunHEJHd0dVwlW7W7g
h8RJWmtX0oouulMvkNtQePc=
frYPy2XpNLTi952/KmbnU6no
3gxJ9T4FZfQnw778Le4=
hr4RzZEzggYvUhASQWvnU6no
xzwBwYU/gVkHIdlnm84C
9dYs4ZVNl5jF5A==
trL3o4hPn6xO9pg=
pX3Pm2H3JOgRm2P3aRd0ff0=
va3qwP3BXTGO5LEI
SAcKAxwPT70=
JKVyPgX5BeoruUBnlXaTJfQaAUM=
Nr+YScdWj5TPCp0=
Zyw9ScRLmn8WHtpnm84C
Ttveo+/wPQzE
trcBhfGT5111+3Xjz9MI
U/LHZ76HAZIcK8n4UpatJZkSrNmkUg==
DFy2ZO9wup4jN9SQfjJ0pw==
P0WWQ1A9rzNnkkpWtzJwjZgSrNmkUg==
kgEQEqkqTiuO5LEI
owa5dzvrJ5iO5LEI
drL4oFoRgDdpTTUWdQ==
Pj+UTXolc0k5yoU=
QwrYfo0UUyu3X2S2FAof
l9RLRlE4wIS10W1Jrx8wM3Q+6EKuRQ==
7nxZH6xgUL/8JtAA
DbXSz0jNFwKy1GVSnx5NftYQZhAAs9Y=
j30H9PV3riFP3L78Le4=
yr5lXSbxaewTFp6GtO0Uho1ZOV4=
Q7Z07eao2cZm75tXfQ==
cOmkXeC3PQyvxNTyWKKxrw==
jRZWF1WAj5TPCp0=
mUwdvdPLSuojBQMFaA==
Iyy9oHMgcGAVJtVnm84C
bZ48Ly8XiRw9aU6/IOw=
Uji7sqsfRR5oTTUWdQ==
NmKtX3JJq0J3ejFqlJKvN6AWrNmkUg==
S7NyN/mh7XyVaUX3IJi1rw==
sdYe2JZc+L1V9I40mhd0ff0=
KfcB8CvqaEk5yoU=
EteH9nv2/9Hv+Q==
86TLuRWz4LxY65ervz1I4PU=
Elvcz9RObCnBWPnQRMZDL3JKpEs=
CkTT3eHLVRUOdiAPdw==
hXLaiBOO5YJbc3bdQ/c=
dSwqIGQZeUk5yoU=
rIOYf5Fac1Vwh590Thd0ff0=
4VtsauvWdVgOKt5nm84C
sbcuNGFcWDbZ
R7CURkvwm4tX/LwO
exchange-xmr.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	New Purchase Order.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1084 set thread context of 2332	1084	New Purchase Order.exe	85
PID 2332 set thread context of 2212	2332	New Purchase Order.exe	54
PID 4440 set thread context of 2212	4440	rundll32.exe	54

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	rundll32.exe

Suspicious behavior: EnumeratesProcesses 40 IoCs

pid	Process
2332	New Purchase Order.exe
2332	New Purchase Order.exe
2332	New Purchase Order.exe
2332	New Purchase Order.exe
2332	New Purchase Order.exe
2332	New Purchase Order.exe
2332	New Purchase Order.exe
2332	New Purchase Order.exe
4440	rundll32.exe
4440	rundll32.exe
4440	rundll32.exe
4440	rundll32.exe
4440	rundll32.exe
4440	rundll32.exe
4440	rundll32.exe
4440	rundll32.exe
4440	rundll32.exe
4440	rundll32.exe
4440	rundll32.exe
4440	rundll32.exe
4440	rundll32.exe
4440	rundll32.exe
4440	rundll32.exe
4440	rundll32.exe
4440	rundll32.exe
4440	rundll32.exe
4440	rundll32.exe
4440	rundll32.exe
4440	rundll32.exe
4440	rundll32.exe
4440	rundll32.exe
4440	rundll32.exe
4440	rundll32.exe
4440	rundll32.exe
4440	rundll32.exe
4440	rundll32.exe
4440	rundll32.exe
4440	rundll32.exe
4440	rundll32.exe
4440	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2212	Explorer.EXE

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
2332	New Purchase Order.exe
2332	New Purchase Order.exe
2332	New Purchase Order.exe
4440	rundll32.exe
4440	rundll32.exe
4440	rundll32.exe
4440	rundll32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2332	New Purchase Order.exe
Token: SeDebugPrivilege	4440	rundll32.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1084 wrote to memory of 2332	1084	New Purchase Order.exe	85
PID 1084 wrote to memory of 2332	1084	New Purchase Order.exe	85
PID 1084 wrote to memory of 2332	1084	New Purchase Order.exe	85
PID 1084 wrote to memory of 2332	1084	New Purchase Order.exe	85
PID 1084 wrote to memory of 2332	1084	New Purchase Order.exe	85
PID 1084 wrote to memory of 2332	1084	New Purchase Order.exe	85
PID 2212 wrote to memory of 4440	2212	Explorer.EXE	92
PID 2212 wrote to memory of 4440	2212	Explorer.EXE	92
PID 2212 wrote to memory of 4440	2212	Explorer.EXE	92
PID 4440 wrote to memory of 1884	4440	rundll32.exe	97
PID 4440 wrote to memory of 1884	4440	rundll32.exe	97
PID 4440 wrote to memory of 1884	4440	rundll32.exe	97

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Users\Admin\AppData\Local\Temp\New Purchase Order.exe
  "C:\Users\Admin\AppData\Local\Temp\New Purchase Order.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1084
- - C:\Users\Admin\AppData\Local\Temp\New Purchase Order.exe
    "C:\Users\Admin\AppData\Local\Temp\New Purchase Order.exe"
    3⤵
    - Checks computer location settings
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:2332
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:260
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:232
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:324
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:4804
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:1004
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:532
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\SysWOW64\rundll32.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4440
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:1884

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1084-132-0x0000000000EC0000-0x0000000000F96000-memory.dmp

Download

memory/1084-133-0x0000000005F80000-0x0000000006524000-memory.dmp

Download

memory/1084-134-0x0000000005910000-0x00000000059A2000-memory.dmp

Download

memory/1084-135-0x00000000059E0000-0x00000000059EA000-memory.dmp

Download

memory/1084-136-0x00000000098E0000-0x000000000997C000-memory.dmp

Download

memory/2212-156-0x0000000008570000-0x00000000086E1000-memory.dmp

Download

memory/2212-155-0x0000000008570000-0x00000000086E1000-memory.dmp

Download

memory/2212-146-0x0000000008440000-0x000000000856E000-memory.dmp

Download

memory/2332-144-0x0000000000422000-0x0000000000424000-memory.dmp

Download

memory/2332-149-0x0000000000401000-0x000000000042E000-memory.dmp

Download

memory/2332-141-0x0000000000401000-0x000000000042E000-memory.dmp

Download

memory/2332-145-0x0000000001400000-0x0000000001410000-memory.dmp

Download

memory/2332-140-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2332-148-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2332-143-0x0000000001790000-0x0000000001ADA000-memory.dmp

Download

memory/2332-138-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4440-150-0x0000000000980000-0x0000000000994000-memory.dmp

Download

memory/4440-152-0x0000000002800000-0x0000000002B4A000-memory.dmp

Download

memory/4440-153-0x0000000002720000-0x00000000027AF000-memory.dmp

Download

memory/4440-154-0x00000000008E0000-0x000000000090D000-memory.dmp

Download

memory/4440-151-0x00000000008E0000-0x000000000090D000-memory.dmp

Download