formbook | 2eeea519e17a33aeece43a9157b2e2caede5b6b34a9afa424d324030cbac48aa

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
17/11/2022, 14:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HSBC Payment Advice_pdf.exe
Size 298KB
Sample221117-sa1rcaef85
SHA256 2eeea519e17a33aeece43a9157b2e2caede5b6b34a9afa424d324030cbac48aa
MD5 5c65f102aeb8b30e62964f58423b2378
SHA1 1c9d548c8d746f0338456f8ed79e7ceb5561c2d8
SHA512 664778d450b612477546cd01fc60e3531296964ec390918299b61a6447620c3fc97da5e8b608bd8747e921a4fb721c80ffcbb84f2ef9df5e5c01dd68c260dadd
SSDEEP 6144:fEa0YGA7vZ+IlQ4qc6qAeER1ImpALwIdG9IM1gdCIV5R:pNv3ScmeyImpFIuvgc0R
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook figc rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

figc

Decoy

47NW9KXrL+jgHgkaH/SBm7e9+eE=
ZiDP2+PQatbRpw==
McLVGasjijBUTSo=
7pCDHTcZBQCyFKFSb/4E
YwIKwvCFzlnbzcNqDNZ3WH77
yFJV/xjTQINSFzg=
HJb3EiH2afruNRSvM8UmOTJszaNv
vpTsJ8xRpExCgnlkzaoM
hUfQlYHe4Qb+DVchQM/mlOM2kjVisoJUMQ==
0URByQED2NCVrO2x5w==
0rjp8oD4ZRKfuI9GPlhwJA==
dxYJqqoonh7bHhMqMNIxXJnL5biDg2uv
N8ICb2IiuRdOx0dgucigiZ0DBA==
xmZ3s1jrZPStPdn5PlhwJA==
UxQyYwqi37V3q59to3PU5ZOZtoEGTcin
SpBGRe06ITs14S8=
spVKc4gldemrMNzf
6IBwrjx2XTs14S8=
FOp6CqjQtLdXT25kzaoM
P/O46RkpqQ8Uvw==
ky4t4R/xYuxdUXVkzaoM
VvVr5YfjxMAqhQPG5mw/5j8MI/g=
a+pFYGDbkR/nvX0+dQQDCgtIwZZl
tW2y7He3xvLluEp13Jzvaa4=
MgTK9CICUduRX+q+hAaUIQ==
CZaMFivjRfrAbtmHjSh3WH77
WQByCJSCCbaj27tYz5/C0bX3GOk=
HN2eGsENvTPjZJ43w5/C0bX3GOk=
ul9T5wfLlJSE9V9y7w==
YStggTiRZpdR1k6fLr4=
sIxhB67Dho4OmdyhUttIwJhMd1R9hKD1OQ==
I66oQy0AwlC+
624EQmEEX7dqX4jB
E/+WRoGOatbRpw==
8rXXZ4de9W8tiZ21t1ytBar2I+4=
O+tmTwaN9Ts14S8=
z0rSgQoORhGrp8LZ
LxS0XQtROWYYr2yRDgWUIQ==
nxqJD6e9lMZOtzLpH+m8fb4FEw==
k/pg+XhFqD0ndH9G68PSWKw=
8cSDk56Se3V2B5ifMr4=
vVxeqjy4t6Mjt0KjL7Y=
E4oLvGyRf41LdDb3FN53WH77
6bRX6Wf8ze0=
Bpqs83OrnK43u11f7Jv0BvsBQeo/ew==
GLCbxUuNkrIus0KjL7Y=
SQFIiiRa60HtFwcRGqCu9MBSg3OIhKD1OQ==
noFIgotFuHQhLga1136JkI8QUSiWqPq+
Rd690WG5sbydrO2x5w==
NLLDeJVHpkfp50ojIr8=
zYLyOtwB39iWrO2x5w==
At0Gnb9ZmUkHvy8/ypp7KLe9+eE=
BJe1a4AajRS1Ntv4i18vvyvzFPg=
ikWQzjeEW2Vfq7N9Ibc=
Cl+up0yUZzs14S8=
PA4ryveT744aLPmakyR3WH77
lnKD3xqP8m4sdXlkzaoM
yD9MkQpFJlAUuUKjL7Y=
LrxXFcsXuQAKt7x1E7A=
hx4FGtysJcCi1r1sFNZ3WH77
blIRPUzyCqWsdZnH
33ZacRmjEbdCT3RkzaoM
3F48XdkN8ybtJUKjL7Y=
xJb1FaEfiTwpc3tkzaoM
artglass.shop

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Executes dropped EXE 2 IoCs

pid	Process
2456	nkxzijxtvo.exe
3236	nkxzijxtvo.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	nkxzijxtvo.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2456 set thread context of 3236	2456	nkxzijxtvo.exe	84
PID 3236 set thread context of 2648	3236	nkxzijxtvo.exe	21
PID 2984 set thread context of 2648	2984	wscript.exe	21

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	wscript.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3236	nkxzijxtvo.exe
3236	nkxzijxtvo.exe
3236	nkxzijxtvo.exe
3236	nkxzijxtvo.exe
3236	nkxzijxtvo.exe
3236	nkxzijxtvo.exe
3236	nkxzijxtvo.exe
3236	nkxzijxtvo.exe
2984	wscript.exe
2984	wscript.exe
2984	wscript.exe
2984	wscript.exe
2984	wscript.exe
2984	wscript.exe
2984	wscript.exe
2984	wscript.exe
2984	wscript.exe
2984	wscript.exe
2984	wscript.exe
2984	wscript.exe
2984	wscript.exe
2984	wscript.exe
2984	wscript.exe
2984	wscript.exe
2984	wscript.exe
2984	wscript.exe
2984	wscript.exe
2984	wscript.exe
2984	wscript.exe
2984	wscript.exe
2984	wscript.exe
2984	wscript.exe
2984	wscript.exe
2984	wscript.exe
2984	wscript.exe
2984	wscript.exe
2984	wscript.exe
2984	wscript.exe
2984	wscript.exe
2984	wscript.exe
2984	wscript.exe
2984	wscript.exe
2984	wscript.exe
2984	wscript.exe
2984	wscript.exe
2984	wscript.exe
2984	wscript.exe
2984	wscript.exe
2984	wscript.exe
2984	wscript.exe
2984	wscript.exe
2984	wscript.exe
2984	wscript.exe
2984	wscript.exe
2984	wscript.exe
2984	wscript.exe
2984	wscript.exe
2984	wscript.exe
2984	wscript.exe
2984	wscript.exe
2984	wscript.exe
2984	wscript.exe
2984	wscript.exe
2984	wscript.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2648	Explorer.EXE

Suspicious behavior: MapViewOfSection 8 IoCs

pid	Process
2456	nkxzijxtvo.exe
3236	nkxzijxtvo.exe
3236	nkxzijxtvo.exe
3236	nkxzijxtvo.exe
2984	wscript.exe
2984	wscript.exe
2984	wscript.exe
2984	wscript.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3236	nkxzijxtvo.exe
Token: SeDebugPrivilege	2984	wscript.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3460 wrote to memory of 2456	3460	HSBC Payment Advice_pdf.exe	83
PID 3460 wrote to memory of 2456	3460	HSBC Payment Advice_pdf.exe	83
PID 3460 wrote to memory of 2456	3460	HSBC Payment Advice_pdf.exe	83
PID 2456 wrote to memory of 3236	2456	nkxzijxtvo.exe	84
PID 2456 wrote to memory of 3236	2456	nkxzijxtvo.exe	84
PID 2456 wrote to memory of 3236	2456	nkxzijxtvo.exe	84
PID 2456 wrote to memory of 3236	2456	nkxzijxtvo.exe	84
PID 2648 wrote to memory of 2984	2648	Explorer.EXE	85
PID 2648 wrote to memory of 2984	2648	Explorer.EXE	85
PID 2648 wrote to memory of 2984	2648	Explorer.EXE	85
PID 2984 wrote to memory of 4376	2984	wscript.exe	86
PID 2984 wrote to memory of 4376	2984	wscript.exe	86
PID 2984 wrote to memory of 4376	2984	wscript.exe	86

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Users\Admin\AppData\Local\Temp\HSBC Payment Advice_pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\HSBC Payment Advice_pdf.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3460
- - C:\Users\Admin\AppData\Local\Temp\nkxzijxtvo.exe
    "C:\Users\Admin\AppData\Local\Temp\nkxzijxtvo.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2456
  - - C:\Users\Admin\AppData\Local\Temp\nkxzijxtvo.exe
      "C:\Users\Admin\AppData\Local\Temp\nkxzijxtvo.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:3236
- C:\Windows\SysWOW64\wscript.exe
  "C:\Windows\SysWOW64\wscript.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:4376

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

gxwhpjoq.gx

Path C:\Users\Admin\AppData\Local\Temp\gxwhpjoq.gx
Size 185KB
SHA256 4962f9c7d3545452b9935b3177296bb8152c9a90556c1f58a565f065633edb6c
MD5 38f34593c8ab5c8f0fe7b8492db1c77e
SHA1 a0a60095cca41733ce5b30bed552ba5c88e04359
SHA512 733ef4279428fae0f88cefd120a9be00c70a57a2d0c69224249ddd8f7626b081f993483c337190da100d444be09edbb36454e4d5203eb4086a5539499616b8c8
SSDEEP 3072:3fKS+PEqUOfHl8cxpaLuAzysnz9r0Q8ATVSW/O6a3z0dJr4Bn01naz+LPrlDDsrK:vKS+dHeYpaLBysneQ8ATVSW/T6E/JY+l
MD5 SHA1 SHA512 SSDEEP

Submit Download

nbquab.us

Path C:\Users\Admin\AppData\Local\Temp\nbquab.us
Size 5KB
SHA256 d8dc9fd37789def3be5e65b4438bd75a70a21eddd6a498041bf6360cdc7259a2
MD5 661d485501fc459b8732a876e4da4dd2
SHA1 a2159591177268c79588a1257b7de4b4f624a7e6
SHA512 9d036e7b387b0340a20b5b680c5ffd644ef7dcfc870bd45b451291265e6e41c0ba2a5ecd116bd5524085ee875f742ab8e4995b9b1610793b3fa359825af4156b
SSDEEP 96:SyjwimXlIFTdpmFdtqiz2sfuH63X0P/19pFDOCxTYc3eJWqr2KQ7idv1lmb6v2Ng:hjjMlI3oLdWH63XePxj6fru7ip1w22Ng
MD5 SHA1 SHA512 SSDEEP

Submit Download

nkxzijxtvo.exe

Path C:\Users\Admin\AppData\Local\Temp\nkxzijxtvo.exe
Size 100KB
SHA256 22e1376bd4656135d8d019cd7fa2c498d33b3aca93d10cff3d5ebc979dfdee37
MD5 dc3f5f4f3a4c90b3c83d2723ad96c67b
SHA1 57293f8cef4201244da7a89ba94929d76ddacce8
SHA512 ac1c71a54d5ca9e1e248ae9fc8464d7555d5bb646aa6e53cdb241704ef0f9ac0598ff8dcfa60a6ed2192e440583d50548bab2e8b3494975f23c64902fc5e1366
SSDEEP 3072:B1ONFzHqdMr7sFXGiOmHPE7bV9lxeqxt66F4fWJXPoURy:QMCskiPEXiq+3
MD5 SHA1 SHA512 SSDEEP

Submit Download

nkxzijxtvo.exe

Path C:\Users\Admin\AppData\Local\Temp\nkxzijxtvo.exe
Size 100KB
SHA256 22e1376bd4656135d8d019cd7fa2c498d33b3aca93d10cff3d5ebc979dfdee37
MD5 dc3f5f4f3a4c90b3c83d2723ad96c67b
SHA1 57293f8cef4201244da7a89ba94929d76ddacce8
SHA512 ac1c71a54d5ca9e1e248ae9fc8464d7555d5bb646aa6e53cdb241704ef0f9ac0598ff8dcfa60a6ed2192e440583d50548bab2e8b3494975f23c64902fc5e1366
SSDEEP 3072:B1ONFzHqdMr7sFXGiOmHPE7bV9lxeqxt66F4fWJXPoURy:QMCskiPEXiq+3
MD5 SHA1 SHA512 SSDEEP

Submit Download

nkxzijxtvo.exe

Path C:\Users\Admin\AppData\Local\Temp\nkxzijxtvo.exe
Size 100KB
SHA256 22e1376bd4656135d8d019cd7fa2c498d33b3aca93d10cff3d5ebc979dfdee37
MD5 dc3f5f4f3a4c90b3c83d2723ad96c67b
SHA1 57293f8cef4201244da7a89ba94929d76ddacce8
SHA512 ac1c71a54d5ca9e1e248ae9fc8464d7555d5bb646aa6e53cdb241704ef0f9ac0598ff8dcfa60a6ed2192e440583d50548bab2e8b3494975f23c64902fc5e1366
SSDEEP 3072:B1ONFzHqdMr7sFXGiOmHPE7bV9lxeqxt66F4fWJXPoURy:QMCskiPEXiq+3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2648-150-0x0000000008960000-0x0000000008AA4000-memory.dmp

Download

memory/2648-152-0x0000000008960000-0x0000000008AA4000-memory.dmp

Download

memory/2648-148-0x0000000008800000-0x000000000895C000-memory.dmp

Download

memory/2648-143-0x0000000008800000-0x000000000895C000-memory.dmp

Download

memory/2984-151-0x0000000000370000-0x000000000039D000-memory.dmp

Download

memory/2984-149-0x00000000025D0000-0x000000000265F000-memory.dmp

Download

memory/2984-145-0x0000000000B00000-0x0000000000B27000-memory.dmp

Download

memory/2984-146-0x0000000000370000-0x000000000039D000-memory.dmp

Download

memory/2984-147-0x0000000002830000-0x0000000002B7A000-memory.dmp

Download

memory/3236-142-0x00000000018D0000-0x00000000018E0000-memory.dmp

Download

memory/3236-141-0x00000000018F0000-0x0000000001C3A000-memory.dmp

Download

memory/3236-139-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3236-140-0x0000000000401000-0x000000000042F000-memory.dmp

Download