formbook | 4422661ccc0d1ca90ea0427fbe9eacc398d819ef1f557c163a686fa127444c3a

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2022, 08:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Original Inv_pdf.gz.exe
Size 224KB
Sample221122-kceynaag3w
SHA256 4422661ccc0d1ca90ea0427fbe9eacc398d819ef1f557c163a686fa127444c3a
MD5 528dda2fb65f094c420a81707fe5a8a9
SHA1 b1ddf9185a39edcf1c24df6b97a5ed89d1d2930e
SHA512 51a7f4d4b9ecb1ba4c6eb7a156268663b701df41d16621748d1655b53fad823e894e35b50b2fdb22acdb691fa1538e3718d5ec09ca0d6a1bc2016874aa55b4d0
SSDEEP 6144:qEa0isjvuZhvGJ2qbIUn6sofacpfey4EVtm:6zDvGJ/sUGf/WBEVtm
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook sy01 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

sy01

Decoy

aeria.life
jotted.community
mozarspalace.com
bfkoxoih.work
doganmuzik.com
ljsq.shop
vitalitycook.store
74574575.xyz
infiniteuniverse.site
storkrv.com
amendmentsymmetrical.top
adevodigital.com
renammsac.com
tptretry.info
ninfainacquerello.com
25038.top
httpsthothub.lol
yvxbt.com
72028.top
vzxtopi.xyz
abw273.com
torqueandtension.com
topwawa24.site
omsaienterprise.info
remodelergarland.com
blackdogartco.net
mdeb.net
clickbests.net
yoody.xyz
campgreed.com
bazemorecontacts.com
daokes.top
jennyrossidesign.com
pinkroses.store
tentepergola.xyz
mrm2c.com
669.homes
catlettauto.com
distancepencilmarried.email
psg-ukraine.com
fasinixiaoribenguizi038.com
imperialwealthplanning.ltd
futa.gay
prod-lw-audience-builder.xyz
bestventureoffering.click
dentalsolution.store
320.productions
jzslime.com
ciciiceove.com
tuasolea.com
rhsallclass.net
yiersan.fun
myvipsuperapp.sbs
kalakaargraphics.com
trackmyapp.xyz
star138.com
metiswanderer.com
suv-cars.site
irofulaunc.sbs
transcendexperiences.com
25cse.xyz
peloporproperti.xyz
advertisementgallery25.monster
nordwandpartners.com
25800.biz

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/2312-145-0x00000000012F0000-0x000000000131F000-memory.dmp	formbook
behavioral2/memory/2312-149-0x00000000012F0000-0x000000000131F000-memory.dmp	formbook

Executes dropped EXE 2 IoCs

pid	Process
3644	welgaf.exe
1512	welgaf.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3644 set thread context of 1512	3644	welgaf.exe	81
PID 1512 set thread context of 3076	1512	welgaf.exe	32
PID 2312 set thread context of 3076	2312	colorcpl.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 62 IoCs

pid	Process
1512	welgaf.exe
1512	welgaf.exe
1512	welgaf.exe
1512	welgaf.exe
2312	colorcpl.exe
2312	colorcpl.exe
2312	colorcpl.exe
2312	colorcpl.exe
2312	colorcpl.exe
2312	colorcpl.exe
2312	colorcpl.exe
2312	colorcpl.exe
2312	colorcpl.exe
2312	colorcpl.exe
2312	colorcpl.exe
2312	colorcpl.exe
2312	colorcpl.exe
2312	colorcpl.exe
2312	colorcpl.exe
2312	colorcpl.exe
2312	colorcpl.exe
2312	colorcpl.exe
2312	colorcpl.exe
2312	colorcpl.exe
2312	colorcpl.exe
2312	colorcpl.exe
2312	colorcpl.exe
2312	colorcpl.exe
2312	colorcpl.exe
2312	colorcpl.exe
2312	colorcpl.exe
2312	colorcpl.exe
2312	colorcpl.exe
2312	colorcpl.exe
2312	colorcpl.exe
2312	colorcpl.exe
2312	colorcpl.exe
2312	colorcpl.exe
2312	colorcpl.exe
2312	colorcpl.exe
2312	colorcpl.exe
2312	colorcpl.exe
2312	colorcpl.exe
2312	colorcpl.exe
2312	colorcpl.exe
2312	colorcpl.exe
2312	colorcpl.exe
2312	colorcpl.exe
2312	colorcpl.exe
2312	colorcpl.exe
2312	colorcpl.exe
2312	colorcpl.exe
2312	colorcpl.exe
2312	colorcpl.exe
2312	colorcpl.exe
2312	colorcpl.exe
2312	colorcpl.exe
2312	colorcpl.exe
2312	colorcpl.exe
2312	colorcpl.exe
2312	colorcpl.exe
2312	colorcpl.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3076	Explorer.EXE

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
3644	welgaf.exe
3644	welgaf.exe
1512	welgaf.exe
1512	welgaf.exe
1512	welgaf.exe
2312	colorcpl.exe
2312	colorcpl.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1512	welgaf.exe
Token: SeDebugPrivilege	2312	colorcpl.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 3644	4932	Original Inv_pdf.gz.exe	79
PID 4932 wrote to memory of 3644	4932	Original Inv_pdf.gz.exe	79
PID 4932 wrote to memory of 3644	4932	Original Inv_pdf.gz.exe	79
PID 3644 wrote to memory of 1512	3644	welgaf.exe	81
PID 3644 wrote to memory of 1512	3644	welgaf.exe	81
PID 3644 wrote to memory of 1512	3644	welgaf.exe	81
PID 3644 wrote to memory of 1512	3644	welgaf.exe	81
PID 3076 wrote to memory of 2312	3076	Explorer.EXE	82
PID 3076 wrote to memory of 2312	3076	Explorer.EXE	82
PID 3076 wrote to memory of 2312	3076	Explorer.EXE	82
PID 2312 wrote to memory of 2184	2312	colorcpl.exe	83
PID 2312 wrote to memory of 2184	2312	colorcpl.exe	83
PID 2312 wrote to memory of 2184	2312	colorcpl.exe	83

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3076
- C:\Users\Admin\AppData\Local\Temp\Original Inv_pdf.gz.exe
  "C:\Users\Admin\AppData\Local\Temp\Original Inv_pdf.gz.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4932
- - C:\Users\Admin\AppData\Local\Temp\welgaf.exe
    "C:\Users\Admin\AppData\Local\Temp\welgaf.exe" C:\Users\Admin\AppData\Local\Temp\rkargfomjj.e
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:3644
  - - C:\Users\Admin\AppData\Local\Temp\welgaf.exe
      "C:\Users\Admin\AppData\Local\Temp\welgaf.exe" C:\Users\Admin\AppData\Local\Temp\rkargfomjj.e
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:1512
- C:\Windows\SysWOW64\colorcpl.exe
  "C:\Windows\SysWOW64\colorcpl.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2312
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\welgaf.exe"
    3⤵
    PID:2184

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

iqmtfmhmoy.j

Path C:\Users\Admin\AppData\Local\Temp\iqmtfmhmoy.j
Size 185KB
SHA256 f46cdb94ab6015f4d9c263c8f316dd52b45b9681140f98d3fbf2b075160c0dde
MD5 ebe6926e7d1ccd49068fec662a3c044d
SHA1 8491e4afb15757c34168a91a1b19781fd6466af6
SHA512 03021b6c22e80c5c9298fc48788d2dfb4df56ccc04041b63a0263990f26bf7edc2a7bf42593ba2d76ab1f268161d4fe392384560d28ee87b48d448b474b8206f
SSDEEP 3072:/c6aE6q5Mg9FXB3afMnaT6SOp7GVmNsnhE0zU1PhDvEJ/TcwWjFm0:06aEX5//B32wRpMheSU1Ph7EJgTjFv
MD5 SHA1 SHA512 SSDEEP

Submit Download

rkargfomjj.e

Path C:\Users\Admin\AppData\Local\Temp\rkargfomjj.e
Size 5KB
SHA256 f3dd8a7c87f5af82ef18a87dfc190a40742b4e28ea4318e3e2fdd1f8b01eb50c
MD5 069ff60ecbbfa90fd146ab77ccc03344
SHA1 8fa625fc8cc91a2577d70aea426f4e151cc8284a
SHA512 4e799580177719b278b79939c446abbbae9e871afd4aba6068905ad181f527a5729a536aa4c72be3ed4ec57a47ae928f0b217efe23f1e31ec5c013cce4de9016
SSDEEP 96:gE36eYjXDvY7xB5nQsqmArYiogaoLovnug/pQICgmKkkH9RXsDle4zrexM3a:BgLY3ug/2wmU9RsDlTY
MD5 SHA1 SHA512 SSDEEP

Submit Download

welgaf.exe

Path C:\Users\Admin\AppData\Local\Temp\welgaf.exe
Size 7KB
SHA256 3ce6cfa05e1c5e7fff0b88bf9dc268467e55132cf52d72ce3c65000190d852d5
MD5 42bf61cc5d86fa1eb5e0f68a87e20061
SHA1 23396657143c0bb29073b75776ce87fb8737070e
SHA512 c82aa2bbd0ef0666510e01e04f7ae46c39dcadcc3bb4719b4572464bb1ce77569151976c79ec0242e37eb1234a36d1126bcf60df7e754f1e54aa8247ab7e9376
SSDEEP 96:s8K8VVj9tSqlkpVKqlLPOoynfdcc3w7IbxT9:s8fCfpQ2POoynlcIw7IJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

welgaf.exe

Path C:\Users\Admin\AppData\Local\Temp\welgaf.exe
Size 7KB
SHA256 3ce6cfa05e1c5e7fff0b88bf9dc268467e55132cf52d72ce3c65000190d852d5
MD5 42bf61cc5d86fa1eb5e0f68a87e20061
SHA1 23396657143c0bb29073b75776ce87fb8737070e
SHA512 c82aa2bbd0ef0666510e01e04f7ae46c39dcadcc3bb4719b4572464bb1ce77569151976c79ec0242e37eb1234a36d1126bcf60df7e754f1e54aa8247ab7e9376
SSDEEP 96:s8K8VVj9tSqlkpVKqlLPOoynfdcc3w7IbxT9:s8fCfpQ2POoynlcIw7IJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

welgaf.exe

Path C:\Users\Admin\AppData\Local\Temp\welgaf.exe
Size 7KB
SHA256 3ce6cfa05e1c5e7fff0b88bf9dc268467e55132cf52d72ce3c65000190d852d5
MD5 42bf61cc5d86fa1eb5e0f68a87e20061
SHA1 23396657143c0bb29073b75776ce87fb8737070e
SHA512 c82aa2bbd0ef0666510e01e04f7ae46c39dcadcc3bb4719b4572464bb1ce77569151976c79ec0242e37eb1234a36d1126bcf60df7e754f1e54aa8247ab7e9376
SSDEEP 96:s8K8VVj9tSqlkpVKqlLPOoynfdcc3w7IbxT9:s8fCfpQ2POoynlcIw7IJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1512-140-0x00000000003E0000-0x00000000003F4000-memory.dmp

Download

memory/1512-139-0x0000000000C10000-0x0000000000F5A000-memory.dmp

Download

memory/2312-147-0x00000000030B0000-0x0000000003143000-memory.dmp

Download

memory/2312-144-0x0000000000340000-0x0000000000359000-memory.dmp

Download

memory/2312-145-0x00000000012F0000-0x000000000131F000-memory.dmp

Download

memory/2312-146-0x0000000003240000-0x000000000358A000-memory.dmp

Download

memory/2312-149-0x00000000012F0000-0x000000000131F000-memory.dmp

Download

memory/3076-141-0x00000000082B0000-0x00000000083B8000-memory.dmp

Download

memory/3076-148-0x00000000083C0000-0x0000000008474000-memory.dmp

Download

memory/3076-150-0x00000000083C0000-0x0000000008474000-memory.dmp

Download