formbook | 3a61280726d90b185f70884c4f7ff84af52be06f7fa2ceebf16065e8aee4feb6

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
21/11/2022, 15:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 316KB
Sample221121-stk51afd39
SHA256 3a61280726d90b185f70884c4f7ff84af52be06f7fa2ceebf16065e8aee4feb6
MD5 8a88f6951b33405cca72d1ccd0097080
SHA1 7cef2c99909535a924dbe074550972d16d771ae7
SHA512 b51e871f1f038ae6bb971a2c5a1276ec8416c1d8f4e34807ce3d4d670811b67566235690c1c9569397fc12247dcb987e0c4cd097238872400acd74c35f3043ba
SSDEEP 6144:8Ne01BTZmBtXKpUvGnX+TDhCV6oRPhPfaN74Vn3guvM5KVEe:semBTZTpUU6oRhKyVQuvM5KVEe
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook xloader pgnt loader rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

pgnt

Decoy

0WG18LbM4lR9iqMRa4nlBzTb
jcfGYzPgZTqFZVO9FV2yIw==
laIfrdSC8/4CNg==
Q73ilev5GIWuOrAAFV2yIw==
Q2u/pMw7pv4sPA==
TbqvIUHwlQscPo0HFV2yIw==
8PNWfGPyE8n0IQ==
WtgROxXzvY2L
PryaRBNjm4eP
Y9Hdi06Cry1um9Sj68YAu1o=
3Gulyp7CMQtR78jvLkk=
JJ3GasTVTCRQT6Tfz6S6GlI=
RnS42bhb9tI0R6UpD6wOxriNxw==
he1mi2sOGfzTRGHnuA==
eaYjCtjxVjdU5XLRtBMBLKk9quA=
k9rTeEqYzzw8WaTfz6S6GlI=
5luVQwe2vJWKEAiMdF4=
MGW14L9OVk5Y5TaR6w/DqdhYxXVY
mAsYz6k6sQkDC0/DoHj9t1RPWLSgFQ==
y5klhuMbE8n0IQ==
u/NKcEKARatNn/dT
ZJaHJQCvzDWRuPPmMsEVxriNxw==
nRhddlcPOegWrv5R
/njA0TJ1U+osPA==
pi8az6AySKlNn/dT
e/k+YjN+U+osPA==
kMAZ36lMWa3gRGHnuA==
wfX0nGsGE1yUJb1Jq33LoDdDWLSgFQ==
wfk35UJcfeHoRGHnuA==
dbzljekZ3ka2QYCYOP1I
Nq3kDeMNNJWDMnWYOP1I
Sa0SN/04cNje8xbaJLgUxriNxw==
yDejyZiQ/X/BQYiYOP1I
UIPN7ckznp2W
s/HtqJNKdmtv88jvLkk=
KanG2bhM0CsdiNrNF0E=
QLrtp3svzjcsTaJ9y5kPopyQzQ==
syhbC2iJZ8obK2Y7nHSa7CmdUuA=
HZXK676zo5OV
5WFoCWeuxqekcHx5YkE=
PbX1H/gmE8n0IQ==
3HTB6Asznp2W
9HGhWLLyrJXPcq4FRecyGU247XBS
/oW437jofmJ8DQiMdF4=
sh415lJ8q3cL3XJvaEA=
XucfBGWzVEg=
PKWeQgpB1cUHprue4sYAu1o=
MXFzDmuO/nBtmjc6g5elIVMbQeWFjyMN
q+v2lgI9Vb0rC2juug==
WYvkDdX8kEjU73U=
6BJjmWGiizGT
fLHageH29Ex1m8jvLkk=
3D+hsVkFtIyr5WI=
ntIbRgolp0jU73U=
GGGJMpC3pJPdQ8ZGkpxA
8FtjHvNDiICP
L63yFOor5uMdLqnrNNblBzTb
Gav/MgU4AByfuddW
xek7Tm3lhlY=
n2sDng5BBdtNn/dT
LZsINfoQH6dNn/dT
Io+SQh7ak0Ti7Gg=
T8Xci1oCP63aRGHnuA==
bZX0DnWMqxcyQ39hzOH+7U0BvmhP
hf9blwwuwpx7j8k.live

Extracted

Family

xloader

Version

3.�E

Campaign

pgnt

Decoy

0WG18LbM4lR9iqMRa4nlBzTb
jcfGYzPgZTqFZVO9FV2yIw==
laIfrdSC8/4CNg==
Q73ilev5GIWuOrAAFV2yIw==
Q2u/pMw7pv4sPA==
TbqvIUHwlQscPo0HFV2yIw==
8PNWfGPyE8n0IQ==
WtgROxXzvY2L
PryaRBNjm4eP
Y9Hdi06Cry1um9Sj68YAu1o=
3Gulyp7CMQtR78jvLkk=
JJ3GasTVTCRQT6Tfz6S6GlI=
RnS42bhb9tI0R6UpD6wOxriNxw==
he1mi2sOGfzTRGHnuA==
eaYjCtjxVjdU5XLRtBMBLKk9quA=
k9rTeEqYzzw8WaTfz6S6GlI=
5luVQwe2vJWKEAiMdF4=
MGW14L9OVk5Y5TaR6w/DqdhYxXVY
mAsYz6k6sQkDC0/DoHj9t1RPWLSgFQ==
y5klhuMbE8n0IQ==
u/NKcEKARatNn/dT
ZJaHJQCvzDWRuPPmMsEVxriNxw==
nRhddlcPOegWrv5R
/njA0TJ1U+osPA==
pi8az6AySKlNn/dT
e/k+YjN+U+osPA==
kMAZ36lMWa3gRGHnuA==
wfX0nGsGE1yUJb1Jq33LoDdDWLSgFQ==
wfk35UJcfeHoRGHnuA==
dbzljekZ3ka2QYCYOP1I
Nq3kDeMNNJWDMnWYOP1I
Sa0SN/04cNje8xbaJLgUxriNxw==
yDejyZiQ/X/BQYiYOP1I
UIPN7ckznp2W
s/HtqJNKdmtv88jvLkk=
KanG2bhM0CsdiNrNF0E=
QLrtp3svzjcsTaJ9y5kPopyQzQ==
syhbC2iJZ8obK2Y7nHSa7CmdUuA=
HZXK676zo5OV
5WFoCWeuxqekcHx5YkE=
PbX1H/gmE8n0IQ==
3HTB6Asznp2W
9HGhWLLyrJXPcq4FRecyGU247XBS
/oW437jofmJ8DQiMdF4=
sh415lJ8q3cL3XJvaEA=
XucfBGWzVEg=
PKWeQgpB1cUHprue4sYAu1o=
MXFzDmuO/nBtmjc6g5elIVMbQeWFjyMN
q+v2lgI9Vb0rC2juug==
WYvkDdX8kEjU73U=
6BJjmWGiizGT
fLHageH29Ex1m8jvLkk=
3D+hsVkFtIyr5WI=
ntIbRgolp0jU73U=
GGGJMpC3pJPdQ8ZGkpxA
8FtjHvNDiICP
L63yFOor5uMdLqnrNNblBzTb
Gav/MgU4AByfuddW
xek7Tm3lhlY=
n2sDng5BBdtNn/dT
LZsINfoQH6dNn/dT
Io+SQh7ak0Ti7Gg=
T8Xci1oCP63aRGHnuA==
bZX0DnWMqxcyQ39hzOH+7U0BvmhP
hf9blwwuwpx7j8k.live

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Loads dropped DLL 1 IoCs

pid	Process
1728	msdt.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2016 set thread context of 1288	2016	file.exe	27
PID 1288 set thread context of 1368	1288	regsvcs.exe	16
PID 1728 set thread context of 1368	1728	msdt.exe	16

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	msdt.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
2016	file.exe
1288	regsvcs.exe
1288	regsvcs.exe
1288	regsvcs.exe
1288	regsvcs.exe
1728	msdt.exe
1728	msdt.exe
1728	msdt.exe
1728	msdt.exe
1728	msdt.exe
1728	msdt.exe
1728	msdt.exe
1728	msdt.exe
1728	msdt.exe
1728	msdt.exe
1728	msdt.exe
1728	msdt.exe
1728	msdt.exe
1728	msdt.exe
1728	msdt.exe
1728	msdt.exe
1728	msdt.exe
1728	msdt.exe
1728	msdt.exe
1728	msdt.exe
1728	msdt.exe
1728	msdt.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1368	Explorer.EXE

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
1288	regsvcs.exe
1288	regsvcs.exe
1288	regsvcs.exe
1728	msdt.exe
1728	msdt.exe
1728	msdt.exe
1728	msdt.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2016	file.exe
Token: SeDebugPrivilege	1288	regsvcs.exe
Token: SeDebugPrivilege	1728	msdt.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1368	Explorer.EXE
1368	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1368	Explorer.EXE
1368	Explorer.EXE

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 2020	2016	file.exe	26
PID 2016 wrote to memory of 2020	2016	file.exe	26
PID 2016 wrote to memory of 2020	2016	file.exe	26
PID 2016 wrote to memory of 2020	2016	file.exe	26
PID 2016 wrote to memory of 2020	2016	file.exe	26
PID 2016 wrote to memory of 2020	2016	file.exe	26
PID 2016 wrote to memory of 2020	2016	file.exe	26
PID 2016 wrote to memory of 1288	2016	file.exe	27
PID 2016 wrote to memory of 1288	2016	file.exe	27
PID 2016 wrote to memory of 1288	2016	file.exe	27
PID 2016 wrote to memory of 1288	2016	file.exe	27
PID 2016 wrote to memory of 1288	2016	file.exe	27
PID 2016 wrote to memory of 1288	2016	file.exe	27
PID 2016 wrote to memory of 1288	2016	file.exe	27
PID 2016 wrote to memory of 1288	2016	file.exe	27
PID 2016 wrote to memory of 1288	2016	file.exe	27
PID 2016 wrote to memory of 1288	2016	file.exe	27
PID 1368 wrote to memory of 1728	1368	Explorer.EXE	28
PID 1368 wrote to memory of 1728	1368	Explorer.EXE	28
PID 1368 wrote to memory of 1728	1368	Explorer.EXE	28
PID 1368 wrote to memory of 1728	1368	Explorer.EXE	28
PID 1728 wrote to memory of 1928	1728	msdt.exe	31
PID 1728 wrote to memory of 1928	1728	msdt.exe	31
PID 1728 wrote to memory of 1928	1728	msdt.exe	31
PID 1728 wrote to memory of 1928	1728	msdt.exe	31
PID 1728 wrote to memory of 1928	1728	msdt.exe	31

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
  2⤵
  PID:2020
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:1288

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\SysWOW64\msdt.exe
  "C:\Windows\SysWOW64\msdt.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1728
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:1928

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sqlite3.dll

Path \Users\Admin\AppData\Local\Temp\sqlite3.dll
Size 849KB
SHA256 7705b87603e0d772e1753441001fcf1ac2643ee41bf14a8177de2c056628665c
MD5 87f9e5a6318ac1ec5ee05aa94a919d7a
SHA1 7a9956e8de89603dba99772da29493d3fd0fe37d
SHA512 c45c03176142918e34f746711e83384572bd6a8ed0a005600aa4a18cf22eade06c76eda190b37db49ec1971c4649e086affd19eee108c5f405df27c0c8cb23d2
SSDEEP 24576:sBEJPplYq6r/6hllzJ6Ic01re2g+b60/17:s6JPIiDJJ6Ic0JTgZo
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1288-66-0x0000000000950000-0x0000000000C53000-memory.dmp

Download

memory/1288-72-0x0000000000401000-0x000000000042F000-memory.dmp

Download

memory/1288-58-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1288-60-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1288-57-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1288-63-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1288-64-0x0000000000401000-0x000000000042F000-memory.dmp

Download

memory/1288-68-0x0000000000140000-0x0000000000150000-memory.dmp

Download

memory/1288-71-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1288-67-0x0000000000422000-0x0000000000424000-memory.dmp

Download

memory/1368-80-0x0000000004DF0000-0x0000000004EF8000-memory.dmp

Download

memory/1368-78-0x0000000004DF0000-0x0000000004EF8000-memory.dmp

Download

memory/1368-83-0x000007FEF93B0000-0x000007FEF93BA000-memory.dmp

Download

memory/1368-82-0x000007FEF6600000-0x000007FEF6743000-memory.dmp

Download

memory/1368-69-0x0000000007020000-0x00000000071AA000-memory.dmp

Download

memory/1728-79-0x0000000000080000-0x00000000000AD000-memory.dmp

Download

memory/1728-75-0x0000000000080000-0x00000000000AD000-memory.dmp

Download

memory/1728-73-0x0000000075A71000-0x0000000075A73000-memory.dmp

Download

memory/1728-77-0x0000000001F70000-0x0000000001FFF000-memory.dmp

Download

memory/1728-74-0x0000000000860000-0x0000000000954000-memory.dmp

Download

memory/1728-76-0x00000000021F0000-0x00000000024F3000-memory.dmp

Download

memory/2016-56-0x00000000002D0000-0x00000000002DA000-memory.dmp

Download

memory/2016-54-0x0000000000FF0000-0x0000000001046000-memory.dmp

Download

memory/2016-55-0x0000000000A70000-0x0000000000AB6000-memory.dmp

Download