formbook | cbbdd11f3c10442270e55644139bb1b4a7917393b2b7084df6057151470e2bbc

Analysis

max time kernel
151s
max time network
139s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
14/11/2022, 10:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
shipment airway bill_pdf.exe
Size 222KB
Sample221114-mr866agg73
SHA256 071b55748a4bf8024c8db0de1a1e0201eb18bac7def0ceb902f0ff18039dfb2e
MD5 cb8241dbfc0c15ca8618989f04b55bed
SHA1 bc23abe2afe3d59c58ef90fdf93037d1187aade2
SHA512 6bc9e10cf69234a8d03013574a0ca5157b9254039adb9af2df1ef0f090a733ac7f31c53cccc95227822f8bd02087958da18f0a88c9211903f0c1ef7d94dcf9c7
SSDEEP 6144:MEa0Nq+TfDPxVQGQfdJKeRVLJuBMCfjXMKs4oi:Xq+TfDPYGQVfLJCL0i
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook sy01 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

sy01

Decoy

aeria.life
jotted.community
mozarspalace.com
bfkoxoih.work
doganmuzik.com
ljsq.shop
vitalitycook.store
74574575.xyz
infiniteuniverse.site
storkrv.com
amendmentsymmetrical.top
adevodigital.com
renammsac.com
tptretry.info
ninfainacquerello.com
25038.top
httpsthothub.lol
yvxbt.com
72028.top
vzxtopi.xyz
abw273.com
torqueandtension.com
topwawa24.site
omsaienterprise.info
remodelergarland.com
blackdogartco.net
mdeb.net
clickbests.net
yoody.xyz
campgreed.com
bazemorecontacts.com
daokes.top
jennyrossidesign.com
pinkroses.store
tentepergola.xyz
mrm2c.com
669.homes
catlettauto.com
distancepencilmarried.email
psg-ukraine.com
fasinixiaoribenguizi038.com
imperialwealthplanning.ltd
futa.gay
prod-lw-audience-builder.xyz
bestventureoffering.click
dentalsolution.store
320.productions
jzslime.com
ciciiceove.com
tuasolea.com
rhsallclass.net
yiersan.fun
myvipsuperapp.sbs
kalakaargraphics.com
trackmyapp.xyz
star138.com
metiswanderer.com
suv-cars.site
irofulaunc.sbs
transcendexperiences.com
25cse.xyz
peloporproperti.xyz
advertisementgallery25.monster
nordwandpartners.com
25800.biz

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/972-65-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/956-72-0x0000000000080000-0x00000000000AF000-memory.dmp	formbook
behavioral1/memory/956-76-0x0000000000080000-0x00000000000AF000-memory.dmp	formbook

Executes dropped EXE 2 IoCs

pid	Process
1120	fjkwvufp.exe
972	fjkwvufp.exe

Loads dropped DLL 2 IoCs

pid	Process
1488	shipment airway bill_pdf.exe
1120	fjkwvufp.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1120 set thread context of 972	1120	fjkwvufp.exe	28
PID 972 set thread context of 1284	972	fjkwvufp.exe	15
PID 956 set thread context of 1284	956	chkdsk.exe	15

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	chkdsk.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
972	fjkwvufp.exe
972	fjkwvufp.exe
956	chkdsk.exe
956	chkdsk.exe
956	chkdsk.exe
956	chkdsk.exe
956	chkdsk.exe
956	chkdsk.exe
956	chkdsk.exe
956	chkdsk.exe
956	chkdsk.exe
956	chkdsk.exe
956	chkdsk.exe
956	chkdsk.exe
956	chkdsk.exe
956	chkdsk.exe
956	chkdsk.exe
956	chkdsk.exe
956	chkdsk.exe
956	chkdsk.exe
956	chkdsk.exe
956	chkdsk.exe
956	chkdsk.exe
956	chkdsk.exe
956	chkdsk.exe
956	chkdsk.exe
956	chkdsk.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
1120	fjkwvufp.exe
972	fjkwvufp.exe
972	fjkwvufp.exe
972	fjkwvufp.exe
956	chkdsk.exe
956	chkdsk.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	972	fjkwvufp.exe
Token: SeDebugPrivilege	956	chkdsk.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1284	Explorer.EXE
1284	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1284	Explorer.EXE
1284	Explorer.EXE

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 1120	1488	shipment airway bill_pdf.exe	27
PID 1488 wrote to memory of 1120	1488	shipment airway bill_pdf.exe	27
PID 1488 wrote to memory of 1120	1488	shipment airway bill_pdf.exe	27
PID 1488 wrote to memory of 1120	1488	shipment airway bill_pdf.exe	27
PID 1120 wrote to memory of 972	1120	fjkwvufp.exe	28
PID 1120 wrote to memory of 972	1120	fjkwvufp.exe	28
PID 1120 wrote to memory of 972	1120	fjkwvufp.exe	28
PID 1120 wrote to memory of 972	1120	fjkwvufp.exe	28
PID 1120 wrote to memory of 972	1120	fjkwvufp.exe	28
PID 1284 wrote to memory of 956	1284	Explorer.EXE	29
PID 1284 wrote to memory of 956	1284	Explorer.EXE	29
PID 1284 wrote to memory of 956	1284	Explorer.EXE	29
PID 1284 wrote to memory of 956	1284	Explorer.EXE	29
PID 956 wrote to memory of 1416	956	chkdsk.exe	30
PID 956 wrote to memory of 1416	956	chkdsk.exe	30
PID 956 wrote to memory of 1416	956	chkdsk.exe	30
PID 956 wrote to memory of 1416	956	chkdsk.exe	30

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Users\Admin\AppData\Local\Temp\shipment airway bill_pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\shipment airway bill_pdf.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1488
- - C:\Users\Admin\AppData\Local\Temp\fjkwvufp.exe
    "C:\Users\Admin\AppData\Local\Temp\fjkwvufp.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:1120
  - - C:\Users\Admin\AppData\Local\Temp\fjkwvufp.exe
      "C:\Users\Admin\AppData\Local\Temp\fjkwvufp.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:972
- C:\Windows\SysWOW64\chkdsk.exe
  "C:\Windows\SysWOW64\chkdsk.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:956
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\fjkwvufp.exe"
    3⤵
    PID:1416

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dgfrjtjhbe.i

Path C:\Users\Admin\AppData\Local\Temp\dgfrjtjhbe.i
Size 5KB
SHA256 690a8a264b8f4222486bb89f1bb01aa46da938fe842a55ec7dd221f50d9b6587
MD5 ab18d4a19793dbc5d045a862734df1a1
SHA1 21365f9ee5f0a4ebdaeb25986ea52f2393e3cdb4
SHA512 374627e43e9c3b9f3c756ae70e96561e0cd9197f38ed8ccbdc1e8cc3c319add769158951db2d5b77f04a3e88c4880ef5c782443de053e0f15be65fa5dccb679b
SSDEEP 96:gKHc1JHT6yCIexZPW7zBkBwMJw75rJgul2txUwcXWFQWK3Am+6kUSSF2nR:gWyCIexBW7zKwIw1rycXWiMUz2R
MD5 SHA1 SHA512 SSDEEP

Submit Download

fjkwvufp.exe

Path C:\Users\Admin\AppData\Local\Temp\fjkwvufp.exe
Size 6KB
SHA256 01e7b04dfb0964502ecd51af0603142a718e193dc1a62d0c0d8e81729a362990
MD5 ebbd81f5c7bac1eba47df26799acafc7
SHA1 0aac5f310f381f808ec35be7997e434da7041b85
SHA512 8a8d7c8a0ca3bbf472729e474e6126f269c79c46a1da4f44c1fef1949a72749ef66c737f8001150e96753593c1f8ff6b3f24ccaa462d3ef034ce30cb4faa4186
SSDEEP 96:kPNJuoz/phMhntGt8jNn71W8VmoynFnva6JHt2xEU:kruozsbhn7pVmoyntva6JHj
MD5 SHA1 SHA512 SSDEEP

Submit Download

fjkwvufp.exe

Path C:\Users\Admin\AppData\Local\Temp\fjkwvufp.exe
Size 6KB
SHA256 01e7b04dfb0964502ecd51af0603142a718e193dc1a62d0c0d8e81729a362990
MD5 ebbd81f5c7bac1eba47df26799acafc7
SHA1 0aac5f310f381f808ec35be7997e434da7041b85
SHA512 8a8d7c8a0ca3bbf472729e474e6126f269c79c46a1da4f44c1fef1949a72749ef66c737f8001150e96753593c1f8ff6b3f24ccaa462d3ef034ce30cb4faa4186
SSDEEP 96:kPNJuoz/phMhntGt8jNn71W8VmoynFnva6JHt2xEU:kruozsbhn7pVmoyntva6JHj
MD5 SHA1 SHA512 SSDEEP

Submit Download

fjkwvufp.exe

Path C:\Users\Admin\AppData\Local\Temp\fjkwvufp.exe
Size 6KB
SHA256 01e7b04dfb0964502ecd51af0603142a718e193dc1a62d0c0d8e81729a362990
MD5 ebbd81f5c7bac1eba47df26799acafc7
SHA1 0aac5f310f381f808ec35be7997e434da7041b85
SHA512 8a8d7c8a0ca3bbf472729e474e6126f269c79c46a1da4f44c1fef1949a72749ef66c737f8001150e96753593c1f8ff6b3f24ccaa462d3ef034ce30cb4faa4186
SSDEEP 96:kPNJuoz/phMhntGt8jNn71W8VmoynFnva6JHt2xEU:kruozsbhn7pVmoyntva6JHj
MD5 SHA1 SHA512 SSDEEP

Submit Download

qwkyuwcxh.t

Path C:\Users\Admin\AppData\Local\Temp\qwkyuwcxh.t
Size 185KB
SHA256 2d6c5d1eb349a936cc9be73a9f18c0c2709d20d41e728f15872d4f644bb0b04e
MD5 40b781f41343993b6c17026280d2e897
SHA1 f0d00145259e3fff8a7cd8807a56f4f810a5c300
SHA512 c2d9a8ae3a261585af12714c674a59c6de8cf2990e251cd67d044004a749693dd5d2bdc1e273057a37465f9890a2325ecf0b823732509332f65d50cd28e62917
SSDEEP 3072:E8sRxE04gVLTu9BUY9uzHayDhSCb8CrcHj+mfvBYzBdTD8lXOiwSf7cFxgCBT:E8WEU1rY9uzLhlHMaIvEBdTDMcbT
MD5 SHA1 SHA512 SSDEEP

Submit Download

fjkwvufp.exe

Path \Users\Admin\AppData\Local\Temp\fjkwvufp.exe
Size 6KB
SHA256 01e7b04dfb0964502ecd51af0603142a718e193dc1a62d0c0d8e81729a362990
MD5 ebbd81f5c7bac1eba47df26799acafc7
SHA1 0aac5f310f381f808ec35be7997e434da7041b85
SHA512 8a8d7c8a0ca3bbf472729e474e6126f269c79c46a1da4f44c1fef1949a72749ef66c737f8001150e96753593c1f8ff6b3f24ccaa462d3ef034ce30cb4faa4186
SSDEEP 96:kPNJuoz/phMhntGt8jNn71W8VmoynFnva6JHt2xEU:kruozsbhn7pVmoyntva6JHj
MD5 SHA1 SHA512 SSDEEP

Submit Download

fjkwvufp.exe

Path \Users\Admin\AppData\Local\Temp\fjkwvufp.exe
Size 6KB
SHA256 01e7b04dfb0964502ecd51af0603142a718e193dc1a62d0c0d8e81729a362990
MD5 ebbd81f5c7bac1eba47df26799acafc7
SHA1 0aac5f310f381f808ec35be7997e434da7041b85
SHA512 8a8d7c8a0ca3bbf472729e474e6126f269c79c46a1da4f44c1fef1949a72749ef66c737f8001150e96753593c1f8ff6b3f24ccaa462d3ef034ce30cb4faa4186
SSDEEP 96:kPNJuoz/phMhntGt8jNn71W8VmoynFnva6JHt2xEU:kruozsbhn7pVmoyntva6JHj
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/956-76-0x0000000000080000-0x00000000000AF000-memory.dmp

Download

memory/956-74-0x0000000001D60000-0x0000000001DF3000-memory.dmp

Download

memory/956-73-0x0000000002030000-0x0000000002333000-memory.dmp

Download

memory/956-71-0x00000000003B0000-0x00000000003B7000-memory.dmp

Download

memory/956-72-0x0000000000080000-0x00000000000AF000-memory.dmp

Download

memory/972-65-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/972-67-0x0000000000120000-0x0000000000134000-memory.dmp

Download

memory/972-66-0x0000000000770000-0x0000000000A73000-memory.dmp

Download

memory/1284-68-0x0000000004B50000-0x0000000004C69000-memory.dmp

Download

memory/1284-75-0x0000000004EA0000-0x0000000004FB6000-memory.dmp

Download

memory/1284-77-0x0000000004EA0000-0x0000000004FB6000-memory.dmp

Download

memory/1488-54-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Download