formbook | d6ed44f8974685e43802fae6ce9a8aed3e2bdcf8c8bb71b9d5922025f07647e6

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Win32.PWSX-gen.16902.13840.exe
Size 273KB
Sample221121-e79hvsfg6z
SHA256 d6ed44f8974685e43802fae6ce9a8aed3e2bdcf8c8bb71b9d5922025f07647e6
MD5 f49b4aae171771dbeebd2684a628063c
SHA1 cf3f068f8b96bdceb40df188dd3e2a4ff02c5d4a
SHA512 ab6ecdfe85954b09735ca326f54417424da33a474b8dc7e9d9c070c0369658acf3a37eec52856ab5c4657b14eae8e620b0c005944db28517e2896d4d7930ea9b
SSDEEP 6144:MEa0NSQK0dH2/L68GPlPHbUGc0+DwnA+cJzDxB48IbZPCV0ytSig0ZFSpyNRa4y:XSQxH2/LdGtP7ELDwnLcJzDvrPg0ZFfS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook xloader fqsu loader rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

fqsu

Decoy

GhfTqaOqC4FsyoQRW/8=
kbPIpd/8k1C6zJz5mYYdK90ZUA==
VIdg/CoNGeYJHA==
KhzoqndOhw1j43z0ew==
wv8mTDcsX2wJN/Q=
MqBgt6S+3BgGKBQHLZy7Ucg=
GyhOb++nZDi39NPK7dbaKapf
pBtD1UoSTdo3eSp9H7OhRqMV0TAuKMU=
WTzTg1w+fP4fMO0oPPM=
NS/tpGdUwkiMwqmgkxoSzjrQATAuKMU=
MnoSdM1hYn4tdwxjB2fX
3EUfH2EJY17mMf4=
V9/wg2yCQruVszm7V+4=
aNL8pZCGYW4Ej2LD
1Bif9VkmdgVfrJqRvl1GtlTZq1M=
9wHIgmB8EOB2uUVcUfk=
1Fdn15qem+fL1qhrY9xdQmAnVg==
Y32ThttYUUr6PsuRmozlNP74RD+uBz7dOQ==
f5HKyoWNAJLM2qjnZlizsvXDKFs=
mRfaGezap6ZyvJqthZvf
XE1gb9BDOSjo
a9OJ2b2kjstszoza
9btSLokhpHEBONENG+A=
1oAKNwX+AlQ4RiqbCKr3/A==
CXyeL6Bef+sHEOohAWbW
LIB9lHUdfinrMPw=
X7dIczoX7/WDk2a0P4P42iAqXA==
1AosTUdOqyZn43z0ew==
w4kh92EUqSnrMPw=
X9mR59TIpqmQ3MRW3dHaKapf
KW8vtcGOicqbG6P1y0bE5w==
vkxt6aqmRoxJWDaaKoHs+c7R2RWuug==
djf3H/3eGlnoHf4=
QcvffHSEZVsaWTg6K5y7Ucg=
/kfWf0w9mxRGn1uybA==
b8lWfUMY2+E9opoOvdTaKapf
4ifWgGxC54S499ZNmE/F5Q==
7AP9JgUOCEUfL/5LmE/F5Q==
42soE+T1jmG3vkVcUfk=
2AssSCkCPo5ji3athZvf
sNMB+T7ij5hvrZLJiX7V
HR01IYJZMBiUzai563i+Z9E=
4Fd9D4pjthkFCt5RmE/F5Q==
6yu5FXMXHiy7zqGthZvf
cO+UduB23nibvKmTiwbzQmAnVg==
vXETR/2rOfRETvrbmE/F5Q==
ic+XHc6whH7sfccPmE/F5Q==
DSc+LHk1A/5szoza
JTFNQgUfvHjj4Kb8os3aKapf
YxDG7ce0Ers3TB1s39HaKapf
j+eurPutWiCeDmathZvf
XQcvovGUtwkHTB519CFlQmAnVg==
1HmuRaRp15cZQQbZ7hFlQmAnVg==
tPmYAWoWGUY6SPhMmE/F5Q==
EFryTMuzz5HJ9OU=
G135x5VKYpuQ43z0ew==
CTnVhWd74nOZ43z0ew==
sJ+03smn9npsyoQRW/8=
JJRan1oWtqJ2vJiNVpWT9KBZ
Qj9Pa11v7KkTUSfp46OeQcZK/W0PZLdr
FjVWTQ8bqinrMPw=
rdVfEergTeAkTAXemE/F5Q==
55jA4cQafSnrMPw=
kIcp2ZZgh9jlEgn7D6KNKHID70AOvlxj
mtvglobalmusic.com

Extracted

Family

xloader

Version

Campaign

fqsu

Decoy

GhfTqaOqC4FsyoQRW/8=
kbPIpd/8k1C6zJz5mYYdK90ZUA==
VIdg/CoNGeYJHA==
KhzoqndOhw1j43z0ew==
wv8mTDcsX2wJN/Q=
MqBgt6S+3BgGKBQHLZy7Ucg=
GyhOb++nZDi39NPK7dbaKapf
pBtD1UoSTdo3eSp9H7OhRqMV0TAuKMU=
WTzTg1w+fP4fMO0oPPM=
NS/tpGdUwkiMwqmgkxoSzjrQATAuKMU=
MnoSdM1hYn4tdwxjB2fX
3EUfH2EJY17mMf4=
V9/wg2yCQruVszm7V+4=
aNL8pZCGYW4Ej2LD
1Bif9VkmdgVfrJqRvl1GtlTZq1M=
9wHIgmB8EOB2uUVcUfk=
1Fdn15qem+fL1qhrY9xdQmAnVg==
Y32ThttYUUr6PsuRmozlNP74RD+uBz7dOQ==
f5HKyoWNAJLM2qjnZlizsvXDKFs=
mRfaGezap6ZyvJqthZvf
XE1gb9BDOSjo
a9OJ2b2kjstszoza
9btSLokhpHEBONENG+A=
1oAKNwX+AlQ4RiqbCKr3/A==
CXyeL6Bef+sHEOohAWbW
LIB9lHUdfinrMPw=
X7dIczoX7/WDk2a0P4P42iAqXA==
1AosTUdOqyZn43z0ew==
w4kh92EUqSnrMPw=
X9mR59TIpqmQ3MRW3dHaKapf
KW8vtcGOicqbG6P1y0bE5w==
vkxt6aqmRoxJWDaaKoHs+c7R2RWuug==
djf3H/3eGlnoHf4=
QcvffHSEZVsaWTg6K5y7Ucg=
/kfWf0w9mxRGn1uybA==
b8lWfUMY2+E9opoOvdTaKapf
4ifWgGxC54S499ZNmE/F5Q==
7AP9JgUOCEUfL/5LmE/F5Q==
42soE+T1jmG3vkVcUfk=
2AssSCkCPo5ji3athZvf
sNMB+T7ij5hvrZLJiX7V
HR01IYJZMBiUzai563i+Z9E=
4Fd9D4pjthkFCt5RmE/F5Q==
6yu5FXMXHiy7zqGthZvf
cO+UduB23nibvKmTiwbzQmAnVg==
vXETR/2rOfRETvrbmE/F5Q==
ic+XHc6whH7sfccPmE/F5Q==
DSc+LHk1A/5szoza
JTFNQgUfvHjj4Kb8os3aKapf
YxDG7ce0Ers3TB1s39HaKapf
j+eurPutWiCeDmathZvf
XQcvovGUtwkHTB519CFlQmAnVg==
1HmuRaRp15cZQQbZ7hFlQmAnVg==
tPmYAWoWGUY6SPhMmE/F5Q==
EFryTMuzz5HJ9OU=
G135x5VKYpuQ43z0ew==
CTnVhWd74nOZ43z0ew==
sJ+03smn9npsyoQRW/8=
JJRan1oWtqJ2vJiNVpWT9KBZ
Qj9Pa11v7KkTUSfp46OeQcZK/W0PZLdr
FjVWTQ8bqinrMPw=
rdVfEergTeAkTAXemE/F5Q==
55jA4cQafSnrMPw=
kIcp2ZZgh9jlEgn7D6KNKHID70AOvlxj
mtvglobalmusic.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Executes dropped EXE 2 IoCs

pid	Process
4792	bngwkfhf.exe
680	bngwkfhf.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	bngwkfhf.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4792 set thread context of 680	4792	bngwkfhf.exe	81
PID 680 set thread context of 3024	680	bngwkfhf.exe	39
PID 2160 set thread context of 3024	2160	cmd.exe	39

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	cmd.exe

Suspicious behavior: EnumeratesProcesses 62 IoCs

pid	Process
680	bngwkfhf.exe
680	bngwkfhf.exe
680	bngwkfhf.exe
680	bngwkfhf.exe
680	bngwkfhf.exe
680	bngwkfhf.exe
680	bngwkfhf.exe
680	bngwkfhf.exe
2160	cmd.exe
2160	cmd.exe
2160	cmd.exe
2160	cmd.exe
2160	cmd.exe
2160	cmd.exe
2160	cmd.exe
2160	cmd.exe
2160	cmd.exe
2160	cmd.exe
2160	cmd.exe
2160	cmd.exe
2160	cmd.exe
2160	cmd.exe
2160	cmd.exe
2160	cmd.exe
2160	cmd.exe
2160	cmd.exe
2160	cmd.exe
2160	cmd.exe
2160	cmd.exe
2160	cmd.exe
2160	cmd.exe
2160	cmd.exe
2160	cmd.exe
2160	cmd.exe
2160	cmd.exe
2160	cmd.exe
2160	cmd.exe
2160	cmd.exe
2160	cmd.exe
2160	cmd.exe
2160	cmd.exe
2160	cmd.exe
2160	cmd.exe
2160	cmd.exe
2160	cmd.exe
2160	cmd.exe
2160	cmd.exe
2160	cmd.exe
2160	cmd.exe
2160	cmd.exe
2160	cmd.exe
2160	cmd.exe
2160	cmd.exe
2160	cmd.exe
2160	cmd.exe
2160	cmd.exe
2160	cmd.exe
2160	cmd.exe
2160	cmd.exe
2160	cmd.exe
2160	cmd.exe
2160	cmd.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3024	Explorer.EXE

Suspicious behavior: MapViewOfSection 8 IoCs

pid	Process
4792	bngwkfhf.exe
680	bngwkfhf.exe
680	bngwkfhf.exe
680	bngwkfhf.exe
2160	cmd.exe
2160	cmd.exe
2160	cmd.exe
2160	cmd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	680	bngwkfhf.exe
Token: SeDebugPrivilege	2160	cmd.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 4792	2952	SecuriteInfo.com.Win32.PWSX-gen.16902.13840.exe	80
PID 2952 wrote to memory of 4792	2952	SecuriteInfo.com.Win32.PWSX-gen.16902.13840.exe	80
PID 2952 wrote to memory of 4792	2952	SecuriteInfo.com.Win32.PWSX-gen.16902.13840.exe	80
PID 4792 wrote to memory of 680	4792	bngwkfhf.exe	81
PID 4792 wrote to memory of 680	4792	bngwkfhf.exe	81
PID 4792 wrote to memory of 680	4792	bngwkfhf.exe	81
PID 4792 wrote to memory of 680	4792	bngwkfhf.exe	81
PID 3024 wrote to memory of 2160	3024	Explorer.EXE	82
PID 3024 wrote to memory of 2160	3024	Explorer.EXE	82
PID 3024 wrote to memory of 2160	3024	Explorer.EXE	82
PID 2160 wrote to memory of 2264	2160	cmd.exe	90
PID 2160 wrote to memory of 2264	2160	cmd.exe	90
PID 2160 wrote to memory of 2264	2160	cmd.exe	90

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.16902.13840.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.16902.13840.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2952
- - C:\Users\Admin\AppData\Local\Temp\bngwkfhf.exe
    "C:\Users\Admin\AppData\Local\Temp\bngwkfhf.exe" C:\Users\Admin\AppData\Local\Temp\egepmsicmgt.gd
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:4792
  - - C:\Users\Admin\AppData\Local\Temp\bngwkfhf.exe
      "C:\Users\Admin\AppData\Local\Temp\bngwkfhf.exe" C:\Users\Admin\AppData\Local\Temp\egepmsicmgt.gd
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:680
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\SysWOW64\cmd.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2160
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:2264

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bjpgehmoo.nqt

Path C:\Users\Admin\AppData\Local\Temp\bjpgehmoo.nqt
Size 185KB
SHA256 54e83694fd3b2c5ba69955819c0e99ea4e32d27598760c9c9f7d776a0c3d9ad5
MD5 2b772a6d13ade5a0238d3324d871ef7e
SHA1 11cb33f66d4297ef0a121c64507228eef366ee0e
SHA512 7b0fefb6270a76a1f8779e175a16327ab4dee3b4ca462e7d0763720128701a6108fff3f76502c9f83332bfffaa6c32eead72bc9a627630431ed1887e49256bdb
SSDEEP 3072:7YAc6MhBVyM9HOCGFcGWBJqWHTu7i8Zle9e6GD396x2oobRZ5TH8jb+v7:71c6MhBVyM9HOfiFBJq6T4Yuz9VjVOK
MD5 SHA1 SHA512 SSDEEP

Submit Download

bngwkfhf.exe

Path C:\Users\Admin\AppData\Local\Temp\bngwkfhf.exe
Size 92KB
SHA256 1f7b3cd24bb876c898f032708cbc391e6ae0409536a9393d87203eff61919e20
MD5 3ea28e7ad25d00df3aa84c20cef95e3a
SHA1 229e47312beacc0336d06cf5ad7624f27128acef
SHA512 1dead65717039ec4c0ec618b930077a71c757886c45dad27c8d3b4ed7e36326df6a27bd7b443877c27f0f2e0edac2ab94088cf80431794f989a4089a5d176b7e
SSDEEP 1536:6mEouMv+iWLqnn7P73rvSijPMEGmQiD4EMxiNNJr6073W9uoYiPVW34msWZcdHnT:HUY7P73TzBDlMxiQ0C9uoYiP434/HpIW
MD5 SHA1 SHA512 SSDEEP

Submit Download

bngwkfhf.exe

Path C:\Users\Admin\AppData\Local\Temp\bngwkfhf.exe
Size 92KB
SHA256 1f7b3cd24bb876c898f032708cbc391e6ae0409536a9393d87203eff61919e20
MD5 3ea28e7ad25d00df3aa84c20cef95e3a
SHA1 229e47312beacc0336d06cf5ad7624f27128acef
SHA512 1dead65717039ec4c0ec618b930077a71c757886c45dad27c8d3b4ed7e36326df6a27bd7b443877c27f0f2e0edac2ab94088cf80431794f989a4089a5d176b7e
SSDEEP 1536:6mEouMv+iWLqnn7P73rvSijPMEGmQiD4EMxiNNJr6073W9uoYiPVW34msWZcdHnT:HUY7P73TzBDlMxiQ0C9uoYiP434/HpIW
MD5 SHA1 SHA512 SSDEEP

Submit Download

bngwkfhf.exe

Path C:\Users\Admin\AppData\Local\Temp\bngwkfhf.exe
Size 92KB
SHA256 1f7b3cd24bb876c898f032708cbc391e6ae0409536a9393d87203eff61919e20
MD5 3ea28e7ad25d00df3aa84c20cef95e3a
SHA1 229e47312beacc0336d06cf5ad7624f27128acef
SHA512 1dead65717039ec4c0ec618b930077a71c757886c45dad27c8d3b4ed7e36326df6a27bd7b443877c27f0f2e0edac2ab94088cf80431794f989a4089a5d176b7e
SSDEEP 1536:6mEouMv+iWLqnn7P73rvSijPMEGmQiD4EMxiNNJr6073W9uoYiPVW34msWZcdHnT:HUY7P73TzBDlMxiQ0C9uoYiP434/HpIW
MD5 SHA1 SHA512 SSDEEP

Submit Download

egepmsicmgt.gd

Path C:\Users\Admin\AppData\Local\Temp\egepmsicmgt.gd
Size 5KB
SHA256 ea9b1e5e2a95207f3ef0a320a98433fd5bf37802824e9b27b159ae79bd0986ad
MD5 db6c9b9ed962079da848850b2bc78272
SHA1 480e9adca60bd93a579b8c6aab8d996486ac533f
SHA512 b92e535b0c6e63e6bf39337b1ef808d4877c89654f796bfd473bd9e5780256cfb8fc9513000323f3b22a732d80e78a56a3958fafedfd06fa2aff91cb11128634
SSDEEP 96:/5jYnGXE4vp9dUw6x7kRDPIo49b/VXCkvL30iDFhaJrMvN3otvHV8GI:SnL4vKw64DPLwzVJgl6v9418GI
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/680-142-0x00000000004D0000-0x00000000004E0000-memory.dmp

Download

memory/680-139-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/680-140-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/680-141-0x0000000000A80000-0x0000000000DCA000-memory.dmp

Download

memory/680-145-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2160-146-0x0000000000250000-0x00000000002AA000-memory.dmp

Download

memory/2160-147-0x0000000001270000-0x00000000015BA000-memory.dmp

Download

memory/2160-148-0x0000000000A00000-0x0000000000A2D000-memory.dmp

Download

memory/2160-149-0x00000000010C0000-0x000000000114F000-memory.dmp

Download

memory/2160-151-0x0000000000A00000-0x0000000000A2D000-memory.dmp

Download

memory/3024-143-0x0000000002CA0000-0x0000000002E31000-memory.dmp

Download

memory/3024-150-0x0000000007EC0000-0x0000000008043000-memory.dmp

Download

memory/3024-152-0x0000000007EC0000-0x0000000008043000-memory.dmp

Download