formbook | cbbdd11f3c10442270e55644139bb1b4a7917393b2b7084df6057151470e2bbc

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
14/11/2022, 10:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
shipment airway bill_pdf.exe
Size 222KB
Sample221114-mr866agg73
SHA256 071b55748a4bf8024c8db0de1a1e0201eb18bac7def0ceb902f0ff18039dfb2e
MD5 cb8241dbfc0c15ca8618989f04b55bed
SHA1 bc23abe2afe3d59c58ef90fdf93037d1187aade2
SHA512 6bc9e10cf69234a8d03013574a0ca5157b9254039adb9af2df1ef0f090a733ac7f31c53cccc95227822f8bd02087958da18f0a88c9211903f0c1ef7d94dcf9c7
SSDEEP 6144:MEa0Nq+TfDPxVQGQfdJKeRVLJuBMCfjXMKs4oi:Xq+TfDPYGQVfLJCL0i
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook sy01 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

sy01

Decoy

aeria.life
jotted.community
mozarspalace.com
bfkoxoih.work
doganmuzik.com
ljsq.shop
vitalitycook.store
74574575.xyz
infiniteuniverse.site
storkrv.com
amendmentsymmetrical.top
adevodigital.com
renammsac.com
tptretry.info
ninfainacquerello.com
25038.top
httpsthothub.lol
yvxbt.com
72028.top
vzxtopi.xyz
abw273.com
torqueandtension.com
topwawa24.site
omsaienterprise.info
remodelergarland.com
blackdogartco.net
mdeb.net
clickbests.net
yoody.xyz
campgreed.com
bazemorecontacts.com
daokes.top
jennyrossidesign.com
pinkroses.store
tentepergola.xyz
mrm2c.com
669.homes
catlettauto.com
distancepencilmarried.email
psg-ukraine.com
fasinixiaoribenguizi038.com
imperialwealthplanning.ltd
futa.gay
prod-lw-audience-builder.xyz
bestventureoffering.click
dentalsolution.store
320.productions
jzslime.com
ciciiceove.com
tuasolea.com
rhsallclass.net
yiersan.fun
myvipsuperapp.sbs
kalakaargraphics.com
trackmyapp.xyz
star138.com
metiswanderer.com
suv-cars.site
irofulaunc.sbs
transcendexperiences.com
25cse.xyz
peloporproperti.xyz
advertisementgallery25.monster
nordwandpartners.com
25800.biz

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/4964-144-0x0000000000620000-0x000000000064F000-memory.dmp	formbook
behavioral2/memory/4964-147-0x0000000000620000-0x000000000064F000-memory.dmp	formbook

Executes dropped EXE 2 IoCs

pid	Process
3036	fjkwvufp.exe
5052	fjkwvufp.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3036 set thread context of 5052	3036	fjkwvufp.exe	83
PID 5052 set thread context of 744	5052	fjkwvufp.exe	73
PID 4964 set thread context of 744	4964	cmmon32.exe	73

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 60 IoCs

pid	Process
5052	fjkwvufp.exe
5052	fjkwvufp.exe
5052	fjkwvufp.exe
5052	fjkwvufp.exe
4964	cmmon32.exe
4964	cmmon32.exe
4964	cmmon32.exe
4964	cmmon32.exe
4964	cmmon32.exe
4964	cmmon32.exe
4964	cmmon32.exe
4964	cmmon32.exe
4964	cmmon32.exe
4964	cmmon32.exe
4964	cmmon32.exe
4964	cmmon32.exe
4964	cmmon32.exe
4964	cmmon32.exe
4964	cmmon32.exe
4964	cmmon32.exe
4964	cmmon32.exe
4964	cmmon32.exe
4964	cmmon32.exe
4964	cmmon32.exe
4964	cmmon32.exe
4964	cmmon32.exe
4964	cmmon32.exe
4964	cmmon32.exe
4964	cmmon32.exe
4964	cmmon32.exe
4964	cmmon32.exe
4964	cmmon32.exe
4964	cmmon32.exe
4964	cmmon32.exe
4964	cmmon32.exe
4964	cmmon32.exe
4964	cmmon32.exe
4964	cmmon32.exe
4964	cmmon32.exe
4964	cmmon32.exe
4964	cmmon32.exe
4964	cmmon32.exe
4964	cmmon32.exe
4964	cmmon32.exe
4964	cmmon32.exe
4964	cmmon32.exe
4964	cmmon32.exe
4964	cmmon32.exe
4964	cmmon32.exe
4964	cmmon32.exe
4964	cmmon32.exe
4964	cmmon32.exe
4964	cmmon32.exe
4964	cmmon32.exe
4964	cmmon32.exe
4964	cmmon32.exe
4964	cmmon32.exe
4964	cmmon32.exe
4964	cmmon32.exe
4964	cmmon32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
744	Explorer.EXE

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
3036	fjkwvufp.exe
3036	fjkwvufp.exe
5052	fjkwvufp.exe
5052	fjkwvufp.exe
5052	fjkwvufp.exe
4964	cmmon32.exe
4964	cmmon32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5052	fjkwvufp.exe
Token: SeDebugPrivilege	4964	cmmon32.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 716 wrote to memory of 3036	716	shipment airway bill_pdf.exe	82
PID 716 wrote to memory of 3036	716	shipment airway bill_pdf.exe	82
PID 716 wrote to memory of 3036	716	shipment airway bill_pdf.exe	82
PID 3036 wrote to memory of 5052	3036	fjkwvufp.exe	83
PID 3036 wrote to memory of 5052	3036	fjkwvufp.exe	83
PID 3036 wrote to memory of 5052	3036	fjkwvufp.exe	83
PID 3036 wrote to memory of 5052	3036	fjkwvufp.exe	83
PID 744 wrote to memory of 4964	744	Explorer.EXE	84
PID 744 wrote to memory of 4964	744	Explorer.EXE	84
PID 744 wrote to memory of 4964	744	Explorer.EXE	84
PID 4964 wrote to memory of 4020	4964	cmmon32.exe	85
PID 4964 wrote to memory of 4020	4964	cmmon32.exe	85
PID 4964 wrote to memory of 4020	4964	cmmon32.exe	85

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:744
- C:\Users\Admin\AppData\Local\Temp\shipment airway bill_pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\shipment airway bill_pdf.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:716
- - C:\Users\Admin\AppData\Local\Temp\fjkwvufp.exe
    "C:\Users\Admin\AppData\Local\Temp\fjkwvufp.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:3036
  - - C:\Users\Admin\AppData\Local\Temp\fjkwvufp.exe
      "C:\Users\Admin\AppData\Local\Temp\fjkwvufp.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:5052
- C:\Windows\SysWOW64\cmmon32.exe
  "C:\Windows\SysWOW64\cmmon32.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4964
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\fjkwvufp.exe"
    3⤵
    PID:4020

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dgfrjtjhbe.i

Path C:\Users\Admin\AppData\Local\Temp\dgfrjtjhbe.i
Size 5KB
SHA256 690a8a264b8f4222486bb89f1bb01aa46da938fe842a55ec7dd221f50d9b6587
MD5 ab18d4a19793dbc5d045a862734df1a1
SHA1 21365f9ee5f0a4ebdaeb25986ea52f2393e3cdb4
SHA512 374627e43e9c3b9f3c756ae70e96561e0cd9197f38ed8ccbdc1e8cc3c319add769158951db2d5b77f04a3e88c4880ef5c782443de053e0f15be65fa5dccb679b
SSDEEP 96:gKHc1JHT6yCIexZPW7zBkBwMJw75rJgul2txUwcXWFQWK3Am+6kUSSF2nR:gWyCIexBW7zKwIw1rycXWiMUz2R
MD5 SHA1 SHA512 SSDEEP

Submit Download

fjkwvufp.exe

Path C:\Users\Admin\AppData\Local\Temp\fjkwvufp.exe
Size 6KB
SHA256 01e7b04dfb0964502ecd51af0603142a718e193dc1a62d0c0d8e81729a362990
MD5 ebbd81f5c7bac1eba47df26799acafc7
SHA1 0aac5f310f381f808ec35be7997e434da7041b85
SHA512 8a8d7c8a0ca3bbf472729e474e6126f269c79c46a1da4f44c1fef1949a72749ef66c737f8001150e96753593c1f8ff6b3f24ccaa462d3ef034ce30cb4faa4186
SSDEEP 96:kPNJuoz/phMhntGt8jNn71W8VmoynFnva6JHt2xEU:kruozsbhn7pVmoyntva6JHj
MD5 SHA1 SHA512 SSDEEP

Submit Download

fjkwvufp.exe

Path C:\Users\Admin\AppData\Local\Temp\fjkwvufp.exe
Size 6KB
SHA256 01e7b04dfb0964502ecd51af0603142a718e193dc1a62d0c0d8e81729a362990
MD5 ebbd81f5c7bac1eba47df26799acafc7
SHA1 0aac5f310f381f808ec35be7997e434da7041b85
SHA512 8a8d7c8a0ca3bbf472729e474e6126f269c79c46a1da4f44c1fef1949a72749ef66c737f8001150e96753593c1f8ff6b3f24ccaa462d3ef034ce30cb4faa4186
SSDEEP 96:kPNJuoz/phMhntGt8jNn71W8VmoynFnva6JHt2xEU:kruozsbhn7pVmoyntva6JHj
MD5 SHA1 SHA512 SSDEEP

Submit Download

fjkwvufp.exe

Path C:\Users\Admin\AppData\Local\Temp\fjkwvufp.exe
Size 6KB
SHA256 01e7b04dfb0964502ecd51af0603142a718e193dc1a62d0c0d8e81729a362990
MD5 ebbd81f5c7bac1eba47df26799acafc7
SHA1 0aac5f310f381f808ec35be7997e434da7041b85
SHA512 8a8d7c8a0ca3bbf472729e474e6126f269c79c46a1da4f44c1fef1949a72749ef66c737f8001150e96753593c1f8ff6b3f24ccaa462d3ef034ce30cb4faa4186
SSDEEP 96:kPNJuoz/phMhntGt8jNn71W8VmoynFnva6JHt2xEU:kruozsbhn7pVmoyntva6JHj
MD5 SHA1 SHA512 SSDEEP

Submit Download

qwkyuwcxh.t

Path C:\Users\Admin\AppData\Local\Temp\qwkyuwcxh.t
Size 185KB
SHA256 2d6c5d1eb349a936cc9be73a9f18c0c2709d20d41e728f15872d4f644bb0b04e
MD5 40b781f41343993b6c17026280d2e897
SHA1 f0d00145259e3fff8a7cd8807a56f4f810a5c300
SHA512 c2d9a8ae3a261585af12714c674a59c6de8cf2990e251cd67d044004a749693dd5d2bdc1e273057a37465f9890a2325ecf0b823732509332f65d50cd28e62917
SSDEEP 3072:E8sRxE04gVLTu9BUY9uzHayDhSCb8CrcHj+mfvBYzBdTD8lXOiwSf7cFxgCBT:E8WEU1rY9uzLhlHMaIvEBdTDMcbT
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/744-150-0x0000000002B20000-0x0000000002BBB000-memory.dmp

Download

memory/744-149-0x0000000002B20000-0x0000000002BBB000-memory.dmp

Download

memory/744-141-0x0000000007C80000-0x0000000007DA6000-memory.dmp

Download

memory/4964-144-0x0000000000620000-0x000000000064F000-memory.dmp

Download

memory/4964-143-0x00000000001A0000-0x00000000001AC000-memory.dmp

Download

memory/4964-146-0x00000000025F0000-0x000000000293A000-memory.dmp

Download

memory/4964-147-0x0000000000620000-0x000000000064F000-memory.dmp

Download

memory/4964-148-0x0000000002330000-0x00000000023C3000-memory.dmp

Download

memory/5052-140-0x0000000000EF0000-0x0000000000F04000-memory.dmp

Download

memory/5052-139-0x0000000000A70000-0x0000000000DBA000-memory.dmp

Download