formbook | 7a16dce8bd82a023e48ceed80a37c70de9859cba4764686bf41b2b14df81ce3a

Analysis

max time kernel
148s
max time network
152s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
17/11/2022, 16:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
New-Order1722.exe
Size 660KB
Sample221117-vgtygsfa55
SHA256 7a16dce8bd82a023e48ceed80a37c70de9859cba4764686bf41b2b14df81ce3a
MD5 24f643d1db7526b1afa97a78c2716a1f
SHA1 f86f8736b9eac17b776f14654ad5cceed4dda4e4
SHA512 ef4d7b11ac9e701a6d0f0abf985f540757309379c44f455c697bb47f3d25d9d3c0acdbcd056810521556c16d03d2b718200c4601d422c59845b654e6ecd5e94c
SSDEEP 12288:Eh/U/5s5BtogpfyIa8eH4KfRXvaG/ZHjd57x0C3voj6QX/38ocjZnbCkI:T/5zBMKBvX/5jd59PAeQkxjZnbCkI
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook keb5 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

keb5

Decoy

franktrichards.mobi
teahxy.com
topmallset.com
gajah77.info
sweetncliffjr.com
alliancegh.com
cue-track.com
lifecreditsystem.com
disegno-creativo.com
pelabuhanratu.com
cristidesign.com
heimeier-executive.com
cliphitech.net
n1663.com
applehelpp.store
rachelmurphygardens.com
angelstylesy.com
qhfkw.club
onesportsnetwork.com
thesuperiorbaths.com
gemasbisuteriacr.com
jjie.info
tczs69.com
paperarte.com
myjvsecret.com
lastword.store
unduordinary.com
trimyhomes.com
jiuhudui.com
sdlnjj.com
championelec-de.com
obatest.online
gc3rsretailspecialty.com
pmna.net
dsfuygo4w87g.com
createdskateshop.com
akfisyab.com
ljtsem.com
mdly817.xyz
daonhatchinhhang-aw.com
oljzfju.online
shopnatchezpilgrimage.com
takepride.construction
starconphoto.com
doubleplaycages.com
sioniant.com
marsspaceships.com
lowrylaw-llc.com
pressonenews.com
minifaceliftshop.life
redfin-tacklearea.com
davestravelphotos.com
metromaangementdev.com
naturaldrinkingstraws.com
unic-tec.com
massagetheapy.com
123link.site
qdfsgs.com
gastries.info
universidademicrotec.com
sht-galaxy.com
yangjilf.com
cxetf.com
crashavenger.com
jaegarhc.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 6 IoCs

rat

resource	yara_rule
behavioral1/memory/2020-63-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/2020-64-0x000000000041F0A0-mapping.dmp	formbook
behavioral1/memory/2020-66-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/2020-74-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1940-76-0x00000000000C0000-0x00000000000EF000-memory.dmp	formbook
behavioral1/memory/1940-81-0x00000000000C0000-0x00000000000EF000-memory.dmp	formbook

Deletes itself 1 IoCs

pid	Process
1956	cmd.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1088 set thread context of 2020	1088	New-Order1722.exe	29
PID 2020 set thread context of 1256	2020	New-Order1722.exe	16
PID 2020 set thread context of 1256	2020	New-Order1722.exe	16
PID 1940 set thread context of 1256	1940	help.exe	16

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1088	New-Order1722.exe
2020	New-Order1722.exe
2020	New-Order1722.exe
2020	New-Order1722.exe
1940	help.exe
1940	help.exe
1940	help.exe
1940	help.exe
1940	help.exe
1940	help.exe
1940	help.exe
1940	help.exe
1940	help.exe
1940	help.exe
1940	help.exe
1940	help.exe
1940	help.exe
1940	help.exe
1940	help.exe
1940	help.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
2020	New-Order1722.exe
2020	New-Order1722.exe
2020	New-Order1722.exe
2020	New-Order1722.exe
1940	help.exe
1940	help.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1088	New-Order1722.exe
Token: SeDebugPrivilege	2020	New-Order1722.exe
Token: SeDebugPrivilege	1940	help.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1256	Explorer.EXE
1256	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1256	Explorer.EXE
1256	Explorer.EXE

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 2016	1088	New-Order1722.exe	28
PID 1088 wrote to memory of 2016	1088	New-Order1722.exe	28
PID 1088 wrote to memory of 2016	1088	New-Order1722.exe	28
PID 1088 wrote to memory of 2016	1088	New-Order1722.exe	28
PID 1088 wrote to memory of 2020	1088	New-Order1722.exe	29
PID 1088 wrote to memory of 2020	1088	New-Order1722.exe	29
PID 1088 wrote to memory of 2020	1088	New-Order1722.exe	29
PID 1088 wrote to memory of 2020	1088	New-Order1722.exe	29
PID 1088 wrote to memory of 2020	1088	New-Order1722.exe	29
PID 1088 wrote to memory of 2020	1088	New-Order1722.exe	29
PID 1088 wrote to memory of 2020	1088	New-Order1722.exe	29
PID 1256 wrote to memory of 1940	1256	Explorer.EXE	56
PID 1256 wrote to memory of 1940	1256	Explorer.EXE	56
PID 1256 wrote to memory of 1940	1256	Explorer.EXE	56
PID 1256 wrote to memory of 1940	1256	Explorer.EXE	56
PID 1940 wrote to memory of 1956	1940	help.exe	57
PID 1940 wrote to memory of 1956	1940	help.exe	57
PID 1940 wrote to memory of 1956	1940	help.exe	57
PID 1940 wrote to memory of 1956	1940	help.exe	57

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Users\Admin\AppData\Local\Temp\New-Order1722.exe
  "C:\Users\Admin\AppData\Local\Temp\New-Order1722.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1088
- - C:\Users\Admin\AppData\Local\Temp\New-Order1722.exe
    "C:\Users\Admin\AppData\Local\Temp\New-Order1722.exe"
    3⤵
    PID:2016
- - C:\Users\Admin\AppData\Local\Temp\New-Order1722.exe
    "C:\Users\Admin\AppData\Local\Temp\New-Order1722.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:2020
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:956
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:996
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:952
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:1924
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:368
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:908
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:904
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:1764
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:1136
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:584
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:1436
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:1200
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:1328
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:1180
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:1132
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:828
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:856
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:1168
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:1384
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:1816
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:1712
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:1184
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:268
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:1912
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:524
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:928
- C:\Windows\SysWOW64\help.exe
  "C:\Windows\SysWOW64\help.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\New-Order1722.exe"
    3⤵
    - Deletes itself
    PID:1956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1088-55-0x0000000075241000-0x0000000075243000-memory.dmp

Download

memory/1088-56-0x0000000000790000-0x00000000007A8000-memory.dmp

Download

memory/1088-57-0x0000000000700000-0x000000000070C000-memory.dmp

Download

memory/1088-58-0x0000000004F10000-0x0000000004F80000-memory.dmp

Download

memory/1088-59-0x0000000004400000-0x0000000004434000-memory.dmp

Download

memory/1088-54-0x0000000000B20000-0x0000000000BCC000-memory.dmp

Download

memory/1256-69-0x0000000004C70000-0x0000000004DD1000-memory.dmp

Download

memory/1256-82-0x0000000006B20000-0x0000000006C55000-memory.dmp

Download

memory/1256-72-0x0000000004EE0000-0x0000000004FC5000-memory.dmp

Download

memory/1256-80-0x0000000006B20000-0x0000000006C55000-memory.dmp

Download

memory/1940-81-0x00000000000C0000-0x00000000000EF000-memory.dmp

Download

memory/1940-78-0x00000000009B0000-0x0000000000CB3000-memory.dmp

Download

memory/1940-79-0x0000000000520000-0x00000000005B4000-memory.dmp

Download

memory/1940-76-0x00000000000C0000-0x00000000000EF000-memory.dmp

Download

memory/1940-75-0x00000000009A0000-0x00000000009A6000-memory.dmp

Download

memory/2020-60-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2020-74-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2020-71-0x00000000002C0000-0x00000000002D5000-memory.dmp

Download

memory/2020-68-0x0000000000280000-0x0000000000295000-memory.dmp

Download

memory/2020-67-0x0000000000BD0000-0x0000000000ED3000-memory.dmp

Download

memory/2020-66-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2020-63-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2020-61-0x0000000000400000-0x000000000042F000-memory.dmp

Download