formbook | d6ed44f8974685e43802fae6ce9a8aed3e2bdcf8c8bb71b9d5922025f07647e6

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
21/11/2022, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Win32.PWSX-gen.16902.13840.exe
Size 273KB
Sample221121-e79hvsfg6z
SHA256 d6ed44f8974685e43802fae6ce9a8aed3e2bdcf8c8bb71b9d5922025f07647e6
MD5 f49b4aae171771dbeebd2684a628063c
SHA1 cf3f068f8b96bdceb40df188dd3e2a4ff02c5d4a
SHA512 ab6ecdfe85954b09735ca326f54417424da33a474b8dc7e9d9c070c0369658acf3a37eec52856ab5c4657b14eae8e620b0c005944db28517e2896d4d7930ea9b
SSDEEP 6144:MEa0NSQK0dH2/L68GPlPHbUGc0+DwnA+cJzDxB48IbZPCV0ytSig0ZFSpyNRa4y:XSQxH2/LdGtP7ELDwnLcJzDvrPg0ZFfS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook fqsu rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

fqsu

Decoy

GhfTqaOqC4FsyoQRW/8=
kbPIpd/8k1C6zJz5mYYdK90ZUA==
VIdg/CoNGeYJHA==
KhzoqndOhw1j43z0ew==
wv8mTDcsX2wJN/Q=
MqBgt6S+3BgGKBQHLZy7Ucg=
GyhOb++nZDi39NPK7dbaKapf
pBtD1UoSTdo3eSp9H7OhRqMV0TAuKMU=
WTzTg1w+fP4fMO0oPPM=
NS/tpGdUwkiMwqmgkxoSzjrQATAuKMU=
MnoSdM1hYn4tdwxjB2fX
3EUfH2EJY17mMf4=
V9/wg2yCQruVszm7V+4=
aNL8pZCGYW4Ej2LD
1Bif9VkmdgVfrJqRvl1GtlTZq1M=
9wHIgmB8EOB2uUVcUfk=
1Fdn15qem+fL1qhrY9xdQmAnVg==
Y32ThttYUUr6PsuRmozlNP74RD+uBz7dOQ==
f5HKyoWNAJLM2qjnZlizsvXDKFs=
mRfaGezap6ZyvJqthZvf
XE1gb9BDOSjo
a9OJ2b2kjstszoza
9btSLokhpHEBONENG+A=
1oAKNwX+AlQ4RiqbCKr3/A==
CXyeL6Bef+sHEOohAWbW
LIB9lHUdfinrMPw=
X7dIczoX7/WDk2a0P4P42iAqXA==
1AosTUdOqyZn43z0ew==
w4kh92EUqSnrMPw=
X9mR59TIpqmQ3MRW3dHaKapf
KW8vtcGOicqbG6P1y0bE5w==
vkxt6aqmRoxJWDaaKoHs+c7R2RWuug==
djf3H/3eGlnoHf4=
QcvffHSEZVsaWTg6K5y7Ucg=
/kfWf0w9mxRGn1uybA==
b8lWfUMY2+E9opoOvdTaKapf
4ifWgGxC54S499ZNmE/F5Q==
7AP9JgUOCEUfL/5LmE/F5Q==
42soE+T1jmG3vkVcUfk=
2AssSCkCPo5ji3athZvf
sNMB+T7ij5hvrZLJiX7V
HR01IYJZMBiUzai563i+Z9E=
4Fd9D4pjthkFCt5RmE/F5Q==
6yu5FXMXHiy7zqGthZvf
cO+UduB23nibvKmTiwbzQmAnVg==
vXETR/2rOfRETvrbmE/F5Q==
ic+XHc6whH7sfccPmE/F5Q==
DSc+LHk1A/5szoza
JTFNQgUfvHjj4Kb8os3aKapf
YxDG7ce0Ers3TB1s39HaKapf
j+eurPutWiCeDmathZvf
XQcvovGUtwkHTB519CFlQmAnVg==
1HmuRaRp15cZQQbZ7hFlQmAnVg==
tPmYAWoWGUY6SPhMmE/F5Q==
EFryTMuzz5HJ9OU=
G135x5VKYpuQ43z0ew==
CTnVhWd74nOZ43z0ew==
sJ+03smn9npsyoQRW/8=
JJRan1oWtqJ2vJiNVpWT9KBZ
Qj9Pa11v7KkTUSfp46OeQcZK/W0PZLdr
FjVWTQ8bqinrMPw=
rdVfEergTeAkTAXemE/F5Q==
55jA4cQafSnrMPw=
kIcp2ZZgh9jlEgn7D6KNKHID70AOvlxj
mtvglobalmusic.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Executes dropped EXE 2 IoCs

pid	Process
1292	bngwkfhf.exe
604	bngwkfhf.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Control Panel\International\Geo\Nation	bngwkfhf.exe

Loads dropped DLL 3 IoCs

pid	Process
1308	SecuriteInfo.com.Win32.PWSX-gen.16902.13840.exe
1292	bngwkfhf.exe
776	mstsc.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1292 set thread context of 604	1292	bngwkfhf.exe	29
PID 604 set thread context of 1296	604	bngwkfhf.exe	11
PID 776 set thread context of 1296	776	mstsc.exe	11

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-3406023954-474543476-3319432036-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	mstsc.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
604	bngwkfhf.exe
604	bngwkfhf.exe
604	bngwkfhf.exe
604	bngwkfhf.exe
776	mstsc.exe
776	mstsc.exe
776	mstsc.exe
776	mstsc.exe
776	mstsc.exe
776	mstsc.exe
776	mstsc.exe
776	mstsc.exe
776	mstsc.exe
776	mstsc.exe
776	mstsc.exe
776	mstsc.exe
776	mstsc.exe
776	mstsc.exe
776	mstsc.exe
776	mstsc.exe
776	mstsc.exe
776	mstsc.exe
776	mstsc.exe
776	mstsc.exe
776	mstsc.exe
776	mstsc.exe
776	mstsc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1296	Explorer.EXE

Suspicious behavior: MapViewOfSection 8 IoCs

pid	Process
1292	bngwkfhf.exe
604	bngwkfhf.exe
604	bngwkfhf.exe
604	bngwkfhf.exe
776	mstsc.exe
776	mstsc.exe
776	mstsc.exe
776	mstsc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	604	bngwkfhf.exe
Token: SeDebugPrivilege	776	mstsc.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1296	Explorer.EXE
1296	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1296	Explorer.EXE
1296	Explorer.EXE

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 1292	1308	SecuriteInfo.com.Win32.PWSX-gen.16902.13840.exe	28
PID 1308 wrote to memory of 1292	1308	SecuriteInfo.com.Win32.PWSX-gen.16902.13840.exe	28
PID 1308 wrote to memory of 1292	1308	SecuriteInfo.com.Win32.PWSX-gen.16902.13840.exe	28
PID 1308 wrote to memory of 1292	1308	SecuriteInfo.com.Win32.PWSX-gen.16902.13840.exe	28
PID 1292 wrote to memory of 604	1292	bngwkfhf.exe	29
PID 1292 wrote to memory of 604	1292	bngwkfhf.exe	29
PID 1292 wrote to memory of 604	1292	bngwkfhf.exe	29
PID 1292 wrote to memory of 604	1292	bngwkfhf.exe	29
PID 1292 wrote to memory of 604	1292	bngwkfhf.exe	29
PID 1296 wrote to memory of 776	1296	Explorer.EXE	30
PID 1296 wrote to memory of 776	1296	Explorer.EXE	30
PID 1296 wrote to memory of 776	1296	Explorer.EXE	30
PID 1296 wrote to memory of 776	1296	Explorer.EXE	30
PID 776 wrote to memory of 800	776	mstsc.exe	33
PID 776 wrote to memory of 800	776	mstsc.exe	33
PID 776 wrote to memory of 800	776	mstsc.exe	33
PID 776 wrote to memory of 800	776	mstsc.exe	33
PID 776 wrote to memory of 800	776	mstsc.exe	33

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.16902.13840.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.16902.13840.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1308
- - C:\Users\Admin\AppData\Local\Temp\bngwkfhf.exe
    "C:\Users\Admin\AppData\Local\Temp\bngwkfhf.exe" C:\Users\Admin\AppData\Local\Temp\egepmsicmgt.gd
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:1292
  - - C:\Users\Admin\AppData\Local\Temp\bngwkfhf.exe
      "C:\Users\Admin\AppData\Local\Temp\bngwkfhf.exe" C:\Users\Admin\AppData\Local\Temp\egepmsicmgt.gd
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:604
- C:\Windows\SysWOW64\mstsc.exe
  "C:\Windows\SysWOW64\mstsc.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:776
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:800

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bjpgehmoo.nqt

Path C:\Users\Admin\AppData\Local\Temp\bjpgehmoo.nqt
Size 185KB
SHA256 54e83694fd3b2c5ba69955819c0e99ea4e32d27598760c9c9f7d776a0c3d9ad5
MD5 2b772a6d13ade5a0238d3324d871ef7e
SHA1 11cb33f66d4297ef0a121c64507228eef366ee0e
SHA512 7b0fefb6270a76a1f8779e175a16327ab4dee3b4ca462e7d0763720128701a6108fff3f76502c9f83332bfffaa6c32eead72bc9a627630431ed1887e49256bdb
SSDEEP 3072:7YAc6MhBVyM9HOCGFcGWBJqWHTu7i8Zle9e6GD396x2oobRZ5TH8jb+v7:71c6MhBVyM9HOfiFBJq6T4Yuz9VjVOK
MD5 SHA1 SHA512 SSDEEP

Submit Download

bngwkfhf.exe

Path C:\Users\Admin\AppData\Local\Temp\bngwkfhf.exe
Size 92KB
SHA256 1f7b3cd24bb876c898f032708cbc391e6ae0409536a9393d87203eff61919e20
MD5 3ea28e7ad25d00df3aa84c20cef95e3a
SHA1 229e47312beacc0336d06cf5ad7624f27128acef
SHA512 1dead65717039ec4c0ec618b930077a71c757886c45dad27c8d3b4ed7e36326df6a27bd7b443877c27f0f2e0edac2ab94088cf80431794f989a4089a5d176b7e
SSDEEP 1536:6mEouMv+iWLqnn7P73rvSijPMEGmQiD4EMxiNNJr6073W9uoYiPVW34msWZcdHnT:HUY7P73TzBDlMxiQ0C9uoYiP434/HpIW
MD5 SHA1 SHA512 SSDEEP

Submit Download

bngwkfhf.exe

Path C:\Users\Admin\AppData\Local\Temp\bngwkfhf.exe
Size 92KB
SHA256 1f7b3cd24bb876c898f032708cbc391e6ae0409536a9393d87203eff61919e20
MD5 3ea28e7ad25d00df3aa84c20cef95e3a
SHA1 229e47312beacc0336d06cf5ad7624f27128acef
SHA512 1dead65717039ec4c0ec618b930077a71c757886c45dad27c8d3b4ed7e36326df6a27bd7b443877c27f0f2e0edac2ab94088cf80431794f989a4089a5d176b7e
SSDEEP 1536:6mEouMv+iWLqnn7P73rvSijPMEGmQiD4EMxiNNJr6073W9uoYiPVW34msWZcdHnT:HUY7P73TzBDlMxiQ0C9uoYiP434/HpIW
MD5 SHA1 SHA512 SSDEEP

Submit Download

bngwkfhf.exe

Path C:\Users\Admin\AppData\Local\Temp\bngwkfhf.exe
Size 92KB
SHA256 1f7b3cd24bb876c898f032708cbc391e6ae0409536a9393d87203eff61919e20
MD5 3ea28e7ad25d00df3aa84c20cef95e3a
SHA1 229e47312beacc0336d06cf5ad7624f27128acef
SHA512 1dead65717039ec4c0ec618b930077a71c757886c45dad27c8d3b4ed7e36326df6a27bd7b443877c27f0f2e0edac2ab94088cf80431794f989a4089a5d176b7e
SSDEEP 1536:6mEouMv+iWLqnn7P73rvSijPMEGmQiD4EMxiNNJr6073W9uoYiPVW34msWZcdHnT:HUY7P73TzBDlMxiQ0C9uoYiP434/HpIW
MD5 SHA1 SHA512 SSDEEP

Submit Download

egepmsicmgt.gd

Path C:\Users\Admin\AppData\Local\Temp\egepmsicmgt.gd
Size 5KB
SHA256 ea9b1e5e2a95207f3ef0a320a98433fd5bf37802824e9b27b159ae79bd0986ad
MD5 db6c9b9ed962079da848850b2bc78272
SHA1 480e9adca60bd93a579b8c6aab8d996486ac533f
SHA512 b92e535b0c6e63e6bf39337b1ef808d4877c89654f796bfd473bd9e5780256cfb8fc9513000323f3b22a732d80e78a56a3958fafedfd06fa2aff91cb11128634
SSDEEP 96:/5jYnGXE4vp9dUw6x7kRDPIo49b/VXCkvL30iDFhaJrMvN3otvHV8GI:SnL4vKw64DPLwzVJgl6v9418GI
MD5 SHA1 SHA512 SSDEEP

Submit Download

bngwkfhf.exe

Path \Users\Admin\AppData\Local\Temp\bngwkfhf.exe
Size 92KB
SHA256 1f7b3cd24bb876c898f032708cbc391e6ae0409536a9393d87203eff61919e20
MD5 3ea28e7ad25d00df3aa84c20cef95e3a
SHA1 229e47312beacc0336d06cf5ad7624f27128acef
SHA512 1dead65717039ec4c0ec618b930077a71c757886c45dad27c8d3b4ed7e36326df6a27bd7b443877c27f0f2e0edac2ab94088cf80431794f989a4089a5d176b7e
SSDEEP 1536:6mEouMv+iWLqnn7P73rvSijPMEGmQiD4EMxiNNJr6073W9uoYiPVW34msWZcdHnT:HUY7P73TzBDlMxiQ0C9uoYiP434/HpIW
MD5 SHA1 SHA512 SSDEEP

Submit Download

bngwkfhf.exe

Path \Users\Admin\AppData\Local\Temp\bngwkfhf.exe
Size 92KB
SHA256 1f7b3cd24bb876c898f032708cbc391e6ae0409536a9393d87203eff61919e20
MD5 3ea28e7ad25d00df3aa84c20cef95e3a
SHA1 229e47312beacc0336d06cf5ad7624f27128acef
SHA512 1dead65717039ec4c0ec618b930077a71c757886c45dad27c8d3b4ed7e36326df6a27bd7b443877c27f0f2e0edac2ab94088cf80431794f989a4089a5d176b7e
SSDEEP 1536:6mEouMv+iWLqnn7P73rvSijPMEGmQiD4EMxiNNJr6073W9uoYiPVW34msWZcdHnT:HUY7P73TzBDlMxiQ0C9uoYiP434/HpIW
MD5 SHA1 SHA512 SSDEEP

Submit Download

sqlite3.dll

Path \Users\Admin\AppData\Local\Temp\sqlite3.dll
Size 837KB
SHA256 1b98c006231d38524e2278a474c49274fe42e0bb1a31bcfda02e6e32f559b777
MD5 e1b58e0aa1b377a1d0e940660ad1ace1
SHA1 5afc7291b26855b1252b26381ebc85ed3cca218f
SHA512 9ce778bcb586638662b090910c4ceab3b64e16dfaf905a7581c1d349fecdf186995b3cc0dc8c6fc6e9761ea2831d7b14ac1619c2bd5ebc6d18015842e5d94aa2
SSDEEP 24576:ATtmtnhKqK75YJ4+X8NLXBIXcgVMU//GV:Ashc84y8NLXBUjQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/604-67-0x0000000000830000-0x0000000000B33000-memory.dmp

Download

memory/604-65-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/604-66-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/604-68-0x0000000000270000-0x0000000000280000-memory.dmp

Download

memory/776-72-0x0000000000620000-0x0000000000724000-memory.dmp

Download

memory/776-73-0x0000000000080000-0x00000000000AD000-memory.dmp

Download

memory/776-74-0x0000000002220000-0x0000000002523000-memory.dmp

Download

memory/776-75-0x00000000003E0000-0x000000000046F000-memory.dmp

Download

memory/1296-69-0x0000000006B60000-0x0000000006CBB000-memory.dmp

Download

memory/1296-76-0x0000000004D90000-0x0000000004E4E000-memory.dmp

Download

memory/1296-77-0x0000000004D90000-0x0000000004E4E000-memory.dmp

Download

memory/1308-54-0x0000000075531000-0x0000000075533000-memory.dmp

Download