formbook | dbce03f15432cc04590885ae7e6a8397a210ffd4848e792c467dd2329a3a666c

Analysis

max time kernel
55s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
16/11/2022, 09:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
078aa4cb8d8a3ab887ed8539b0d6c580.exe
Size 785KB
Sample221116-ll2z8aea21
SHA256 dbce03f15432cc04590885ae7e6a8397a210ffd4848e792c467dd2329a3a666c
MD5 078aa4cb8d8a3ab887ed8539b0d6c580
SHA1 be5841274f4b19a95bc26ccfddce8a7d7d8fe2b3
SHA512 43eb0b205e648703ec92a9c94385465a669056403794e704048858c47da5f11167abdbdc7686d16565a1ee27128e5e1fae006e4161d4015a1f741f7b64a4f140
SSDEEP 12288:PVITqcSpFKguZCOXgi5YwmyTokdc1lG47BLBJoJKbcYdmrBL:PVnc4FpOXgkXmSov1lV7BFJEKbc8mtL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook pgnt rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

pgnt

Decoy

0WG18LbM4lR9iqMRa4nlBzTb
jcfGYzPgZTqFZVO9FV2yIw==
laIfrdSC8/4CNg==
Q73ilev5GIWuOrAAFV2yIw==
Q2u/pMw7pv4sPA==
TbqvIUHwlQscPo0HFV2yIw==
8PNWfGPyE8n0IQ==
WtgROxXzvY2L
PryaRBNjm4eP
Y9Hdi06Cry1um9Sj68YAu1o=
3Gulyp7CMQtR78jvLkk=
JJ3GasTVTCRQT6Tfz6S6GlI=
RnS42bhb9tI0R6UpD6wOxriNxw==
he1mi2sOGfzTRGHnuA==
eaYjCtjxVjdU5XLRtBMBLKk9quA=
k9rTeEqYzzw8WaTfz6S6GlI=
5luVQwe2vJWKEAiMdF4=
MGW14L9OVk5Y5TaR6w/DqdhYxXVY
mAsYz6k6sQkDC0/DoHj9t1RPWLSgFQ==
y5klhuMbE8n0IQ==
u/NKcEKARatNn/dT
ZJaHJQCvzDWRuPPmMsEVxriNxw==
nRhddlcPOegWrv5R
/njA0TJ1U+osPA==
pi8az6AySKlNn/dT
e/k+YjN+U+osPA==
kMAZ36lMWa3gRGHnuA==
wfX0nGsGE1yUJb1Jq33LoDdDWLSgFQ==
wfk35UJcfeHoRGHnuA==
dbzljekZ3ka2QYCYOP1I
Nq3kDeMNNJWDMnWYOP1I
Sa0SN/04cNje8xbaJLgUxriNxw==
yDejyZiQ/X/BQYiYOP1I
UIPN7ckznp2W
s/HtqJNKdmtv88jvLkk=
KanG2bhM0CsdiNrNF0E=
QLrtp3svzjcsTaJ9y5kPopyQzQ==
syhbC2iJZ8obK2Y7nHSa7CmdUuA=
HZXK676zo5OV
5WFoCWeuxqekcHx5YkE=
PbX1H/gmE8n0IQ==
3HTB6Asznp2W
9HGhWLLyrJXPcq4FRecyGU247XBS
/oW437jofmJ8DQiMdF4=
sh415lJ8q3cL3XJvaEA=
XucfBGWzVEg=
PKWeQgpB1cUHprue4sYAu1o=
MXFzDmuO/nBtmjc6g5elIVMbQeWFjyMN
q+v2lgI9Vb0rC2juug==
WYvkDdX8kEjU73U=
6BJjmWGiizGT
fLHageH29Ex1m8jvLkk=
3D+hsVkFtIyr5WI=
ntIbRgolp0jU73U=
GGGJMpC3pJPdQ8ZGkpxA
8FtjHvNDiICP
L63yFOor5uMdLqnrNNblBzTb
Gav/MgU4AByfuddW
xek7Tm3lhlY=
n2sDng5BBdtNn/dT
LZsINfoQH6dNn/dT
Io+SQh7ak0Ti7Gg=
T8Xci1oCP63aRGHnuA==
bZX0DnWMqxcyQ39hzOH+7U0BvmhP
hf9blwwuwpx7j8k.live

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1204 set thread context of 1784	1204	078aa4cb8d8a3ab887ed8539b0d6c580.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
596	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1204	078aa4cb8d8a3ab887ed8539b0d6c580.exe
1784	078aa4cb8d8a3ab887ed8539b0d6c580.exe
1536	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1204	078aa4cb8d8a3ab887ed8539b0d6c580.exe
Token: SeDebugPrivilege	1536	powershell.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 1536	1204	078aa4cb8d8a3ab887ed8539b0d6c580.exe	27
PID 1204 wrote to memory of 1536	1204	078aa4cb8d8a3ab887ed8539b0d6c580.exe	27
PID 1204 wrote to memory of 1536	1204	078aa4cb8d8a3ab887ed8539b0d6c580.exe	27
PID 1204 wrote to memory of 1536	1204	078aa4cb8d8a3ab887ed8539b0d6c580.exe	27
PID 1204 wrote to memory of 596	1204	078aa4cb8d8a3ab887ed8539b0d6c580.exe	29
PID 1204 wrote to memory of 596	1204	078aa4cb8d8a3ab887ed8539b0d6c580.exe	29
PID 1204 wrote to memory of 596	1204	078aa4cb8d8a3ab887ed8539b0d6c580.exe	29
PID 1204 wrote to memory of 596	1204	078aa4cb8d8a3ab887ed8539b0d6c580.exe	29
PID 1204 wrote to memory of 1336	1204	078aa4cb8d8a3ab887ed8539b0d6c580.exe	31
PID 1204 wrote to memory of 1336	1204	078aa4cb8d8a3ab887ed8539b0d6c580.exe	31
PID 1204 wrote to memory of 1336	1204	078aa4cb8d8a3ab887ed8539b0d6c580.exe	31
PID 1204 wrote to memory of 1336	1204	078aa4cb8d8a3ab887ed8539b0d6c580.exe	31
PID 1204 wrote to memory of 1784	1204	078aa4cb8d8a3ab887ed8539b0d6c580.exe	32
PID 1204 wrote to memory of 1784	1204	078aa4cb8d8a3ab887ed8539b0d6c580.exe	32
PID 1204 wrote to memory of 1784	1204	078aa4cb8d8a3ab887ed8539b0d6c580.exe	32
PID 1204 wrote to memory of 1784	1204	078aa4cb8d8a3ab887ed8539b0d6c580.exe	32
PID 1204 wrote to memory of 1784	1204	078aa4cb8d8a3ab887ed8539b0d6c580.exe	32
PID 1204 wrote to memory of 1784	1204	078aa4cb8d8a3ab887ed8539b0d6c580.exe	32
PID 1204 wrote to memory of 1784	1204	078aa4cb8d8a3ab887ed8539b0d6c580.exe	32

C:\Users\Admin\AppData\Local\Temp\078aa4cb8d8a3ab887ed8539b0d6c580.exe
"C:\Users\Admin\AppData\Local\Temp\078aa4cb8d8a3ab887ed8539b0d6c580.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wlctOUHJjvnKU.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1536
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wlctOUHJjvnKU" /XML "C:\Users\Admin\AppData\Local\Temp\tmpED7B.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:596
- C:\Users\Admin\AppData\Local\Temp\078aa4cb8d8a3ab887ed8539b0d6c580.exe
  "C:\Users\Admin\AppData\Local\Temp\078aa4cb8d8a3ab887ed8539b0d6c580.exe"
  2⤵
  PID:1336
- C:\Users\Admin\AppData\Local\Temp\078aa4cb8d8a3ab887ed8539b0d6c580.exe
  "C:\Users\Admin\AppData\Local\Temp\078aa4cb8d8a3ab887ed8539b0d6c580.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1784

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmpED7B.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpED7B.tmp
Size 1KB
SHA256 0a05eb11a23b9b2e60a3ed5c221d8ce8be6e2d113e6f89028393900f2cef7ae4
MD5 9229e15e25ac70414606cc0d5e428552
SHA1 b8b2b49cd9fd978e0b88d17708480f2f33002dde
SHA512 35032c296f8ef648aafbc97ee043e20b4c814f48ac7c0388e131d050f47d1c99031c9f2b08b0539e717348ff8b2768b7ec8bd850daf00aed81364366cb6a41ca
MD5 SHA1 SHA512

Submit Download

memory/1204-63-0x0000000000F50000-0x0000000000F96000-memory.dmp

Download

memory/1204-58-0x0000000004F80000-0x0000000005000000-memory.dmp

Download

memory/1204-56-0x0000000000340000-0x0000000000358000-memory.dmp

Download

memory/1204-55-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Download

memory/1204-54-0x0000000001130000-0x00000000011FA000-memory.dmp

Download

memory/1204-57-0x0000000000220000-0x000000000022C000-memory.dmp

Download

memory/1536-71-0x000000006E580000-0x000000006EB2B000-memory.dmp

Download

memory/1536-74-0x000000006E580000-0x000000006EB2B000-memory.dmp

Download

memory/1784-64-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1784-70-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1784-67-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1784-72-0x0000000000401000-0x000000000042F000-memory.dmp

Download

memory/1784-73-0x0000000000A80000-0x0000000000D83000-memory.dmp

Download

memory/1784-65-0x0000000000400000-0x000000000042F000-memory.dmp

Download