Analysis
-
max time kernel
189s -
max time network
194s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
29-11-2022 07:56
Static task
static1
Behavioral task
behavioral1
Sample
formbook1.exe
Resource
win7-20221111-en
General
-
Target
formbook1.exe
-
Size
433KB
-
MD5
9672b2beca3027b6f008dfc291d21777
-
SHA1
9dfa2b2cc3d1f04fd715068e9eee238d6b1ca5a7
-
SHA256
ba10a45e13a79398a5802c91636684e54e53f26409feed99e7c89bbbe0c720d3
-
SHA512
6396c39d4b9da16e541bb29659737d9841c5841c808c58a7d88accb35715d673820d63679ea0e0ff7642cd952158e11029b5fd689b0588cff8987816df3ccb2e
-
SSDEEP
6144:6bE/HUrUAGxkcrTRkHqqZMWq1cD8YGMOsPEF75noWa4zbzDp/TkLNlkDfkDSDr0x:6bkxJkKqx4rB75HpALLkD0SMx
Malware Config
Extracted
formbook
nrln
IG7zJSm49UqTTuu/N/oTCIg=
CVLdAPgw0CRSMuZnRRU=
PiA5Z3umP2NyX81VGQhjWyS59nFYhXiG
5i6p4GeQqtBgNRfGNQ==
5984keYswxh8mGZHz4ipAHtQ
VNJaK4Gh0CrOvHpW/p353A==
71rEtrL2icToyKGhcWrTxjsFU5T98zeO
r3q1sy1iZaL+2XIUAob7yw==
9+83Qkrk/vV/jVXsDvoTCIg=
aMFAgYF1prov8/UErH/Y1A==
Alqtx/0rxwEbCLdudftl
ImCbnglBSUHF0mv2tTSP40bPeYao
s4DFNvAJ4GIJ+g==
phOa6mtS8QQICuZnRRU=
7TSu5vqRtB45EZtf4WDSTBHPeYao
ImPWqwUUIVWMQLyMbUab7tmspvNCcT8=
HF7jKjbGox2SAffTPw==
yAM3mOQot5l+cD0ikR5MGp8=
UYzW0/8z70JcQenVLidu1kLPeYao
OoCznp5UWz+hT9OBFXbfVhXPeYao
RZAWUeouUqpRAffTPw==
qQZsaG6uSqBRXS0J4PoTCIg=
idE3YO0X4GIJ+g==
NZQvYOWIBkHd4Z7AmQwAslxY
1KTdRR1OPJb88A==
8iap4OQKp/C3gQludftl
9Tyi5kaIC/Dk7JRTK/5lx1LLzRi53w==
3Lbm4soAuhRHLuZnRRU=
F4rw7+2RqgQp3urIPPoTCIg=
WcAxntfwcZZxHdfbgtoL1FbLzRi53w==
Cb4Mn+LGQzI=
v6zC+zJc9ggtoRfSUKT5VgjPeYao
8SNotqm7G3gx
zkfYBpVE7kZy6Z1eRBc=
fGC3taUlU5/grJFa/p353A==
guxOQaxAp/H3/7hudftl
1ySVyYygrPSWgzsz5voTCIg=
kgzOYyfN4GIJ+g==
uI3MyBlFYb9zLp9O/p353A==
LiJEdPqeLRv/dUMZph0=
P44MT+MPGVCfAffTPw==
92zQztuUoOD397dudftl
KAIeV2q7G3gx
16rd9Lv/EDB9NuZnRRU=
Zq8rUUtzFDYhDLdudftl
0TzN9nwSt9Ld5oQMz8oX7KcwExI=
8C4/Zed9GAoGCuZnRRU=
0R6HvJ+vT2pZMuZnRRU=
PXCroG2LPYhB92PmoRh6SNSmrvNCcT8=
jcoShE+OVbsoB4Vm
XKDr2FEDkRYoA6F7B3bfVhXPeYao
lxlqoFqiNTE=
gth+8scYHF4q9oJM/p353A==
kV6UlVdWZM+9b/WfNw==
mMkJeLvrdq91ULk=
Nxw5ckJtib7+oGdQ/p353A==
K4vu5D5UecNAxJtKPxM=
abYdRE3u8iYkqH9x
KnPrFJC5zSp1V9mCQbIDbiMamCw7zg==
DXEGJOvxscsrAcaZBs0qfqcwExI=
JxA3dYsfQKRsEMqqNrMQekNL0+MJaAkWNg==
Q4dtrcgmnb1BThr40YjqkyMQ3A==
7l7NPgxGZMGfhgludftl
MYT9Mshe6ejKfvG1lYXezH0WmCo61w==
sincewordsmatter.com
Extracted
xloader
3.8
nrln
IG7zJSm49UqTTuu/N/oTCIg=
CVLdAPgw0CRSMuZnRRU=
PiA5Z3umP2NyX81VGQhjWyS59nFYhXiG
5i6p4GeQqtBgNRfGNQ==
5984keYswxh8mGZHz4ipAHtQ
VNJaK4Gh0CrOvHpW/p353A==
71rEtrL2icToyKGhcWrTxjsFU5T98zeO
r3q1sy1iZaL+2XIUAob7yw==
9+83Qkrk/vV/jVXsDvoTCIg=
aMFAgYF1prov8/UErH/Y1A==
Alqtx/0rxwEbCLdudftl
ImCbnglBSUHF0mv2tTSP40bPeYao
s4DFNvAJ4GIJ+g==
phOa6mtS8QQICuZnRRU=
7TSu5vqRtB45EZtf4WDSTBHPeYao
ImPWqwUUIVWMQLyMbUab7tmspvNCcT8=
HF7jKjbGox2SAffTPw==
yAM3mOQot5l+cD0ikR5MGp8=
UYzW0/8z70JcQenVLidu1kLPeYao
OoCznp5UWz+hT9OBFXbfVhXPeYao
RZAWUeouUqpRAffTPw==
qQZsaG6uSqBRXS0J4PoTCIg=
idE3YO0X4GIJ+g==
NZQvYOWIBkHd4Z7AmQwAslxY
1KTdRR1OPJb88A==
8iap4OQKp/C3gQludftl
9Tyi5kaIC/Dk7JRTK/5lx1LLzRi53w==
3Lbm4soAuhRHLuZnRRU=
F4rw7+2RqgQp3urIPPoTCIg=
WcAxntfwcZZxHdfbgtoL1FbLzRi53w==
Cb4Mn+LGQzI=
v6zC+zJc9ggtoRfSUKT5VgjPeYao
8SNotqm7G3gx
zkfYBpVE7kZy6Z1eRBc=
fGC3taUlU5/grJFa/p353A==
guxOQaxAp/H3/7hudftl
1ySVyYygrPSWgzsz5voTCIg=
kgzOYyfN4GIJ+g==
uI3MyBlFYb9zLp9O/p353A==
LiJEdPqeLRv/dUMZph0=
P44MT+MPGVCfAffTPw==
92zQztuUoOD397dudftl
KAIeV2q7G3gx
16rd9Lv/EDB9NuZnRRU=
Zq8rUUtzFDYhDLdudftl
0TzN9nwSt9Ld5oQMz8oX7KcwExI=
8C4/Zed9GAoGCuZnRRU=
0R6HvJ+vT2pZMuZnRRU=
PXCroG2LPYhB92PmoRh6SNSmrvNCcT8=
jcoShE+OVbsoB4Vm
XKDr2FEDkRYoA6F7B3bfVhXPeYao
lxlqoFqiNTE=
gth+8scYHF4q9oJM/p353A==
kV6UlVdWZM+9b/WfNw==
mMkJeLvrdq91ULk=
Nxw5ckJtib7+oGdQ/p353A==
K4vu5D5UecNAxJtKPxM=
abYdRE3u8iYkqH9x
KnPrFJC5zSp1V9mCQbIDbiMamCw7zg==
DXEGJOvxscsrAcaZBs0qfqcwExI=
JxA3dYsfQKRsEMqqNrMQekNL0+MJaAkWNg==
Q4dtrcgmnb1BThr40YjqkyMQ3A==
7l7NPgxGZMGfhgludftl
MYT9Mshe6ejKfvG1lYXezH0WmCo61w==
sincewordsmatter.com
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
wscript.exeflow pid process 7 808 wscript.exe -
Executes dropped EXE 1 IoCs
Processes:
nbeggsncal.exepid process 1900 nbeggsncal.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
nbeggsncal.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\International\Geo\Nation nbeggsncal.exe -
Loads dropped DLL 4 IoCs
Processes:
formbook1.exenbeggsncal.exenbeggsncal.exewscript.exepid process 1744 formbook1.exe 1900 nbeggsncal.exe 752 nbeggsncal.exe 808 wscript.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
nbeggsncal.exenbeggsncal.exewscript.exedescription pid process target process PID 1900 set thread context of 752 1900 nbeggsncal.exe nbeggsncal.exe PID 752 set thread context of 1272 752 nbeggsncal.exe Explorer.EXE PID 808 set thread context of 1272 808 wscript.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
wscript.exedescription ioc process Key created \Registry\User\S-1-5-21-3385717845-2518323428-350143044-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 wscript.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
nbeggsncal.exewscript.exepid process 752 nbeggsncal.exe 752 nbeggsncal.exe 752 nbeggsncal.exe 752 nbeggsncal.exe 808 wscript.exe 808 wscript.exe 808 wscript.exe 808 wscript.exe 808 wscript.exe 808 wscript.exe 808 wscript.exe 808 wscript.exe 808 wscript.exe 808 wscript.exe 808 wscript.exe 808 wscript.exe 808 wscript.exe 808 wscript.exe 808 wscript.exe 808 wscript.exe 808 wscript.exe 808 wscript.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1272 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
nbeggsncal.exewscript.exepid process 752 nbeggsncal.exe 752 nbeggsncal.exe 752 nbeggsncal.exe 808 wscript.exe 808 wscript.exe 808 wscript.exe 808 wscript.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
nbeggsncal.exewscript.exedescription pid process Token: SeDebugPrivilege 752 nbeggsncal.exe Token: SeDebugPrivilege 808 wscript.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1272 Explorer.EXE 1272 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1272 Explorer.EXE 1272 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
formbook1.exenbeggsncal.exeExplorer.EXEwscript.exedescription pid process target process PID 1744 wrote to memory of 1900 1744 formbook1.exe nbeggsncal.exe PID 1744 wrote to memory of 1900 1744 formbook1.exe nbeggsncal.exe PID 1744 wrote to memory of 1900 1744 formbook1.exe nbeggsncal.exe PID 1744 wrote to memory of 1900 1744 formbook1.exe nbeggsncal.exe PID 1900 wrote to memory of 752 1900 nbeggsncal.exe nbeggsncal.exe PID 1900 wrote to memory of 752 1900 nbeggsncal.exe nbeggsncal.exe PID 1900 wrote to memory of 752 1900 nbeggsncal.exe nbeggsncal.exe PID 1900 wrote to memory of 752 1900 nbeggsncal.exe nbeggsncal.exe PID 1900 wrote to memory of 752 1900 nbeggsncal.exe nbeggsncal.exe PID 1272 wrote to memory of 808 1272 Explorer.EXE wscript.exe PID 1272 wrote to memory of 808 1272 Explorer.EXE wscript.exe PID 1272 wrote to memory of 808 1272 Explorer.EXE wscript.exe PID 1272 wrote to memory of 808 1272 Explorer.EXE wscript.exe PID 808 wrote to memory of 1836 808 wscript.exe Firefox.exe PID 808 wrote to memory of 1836 808 wscript.exe Firefox.exe PID 808 wrote to memory of 1836 808 wscript.exe Firefox.exe PID 808 wrote to memory of 1836 808 wscript.exe Firefox.exe PID 808 wrote to memory of 1836 808 wscript.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\formbook1.exe"C:\Users\Admin\AppData\Local\Temp\formbook1.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\nbeggsncal.exe"C:\Users\Admin\AppData\Local\Temp\nbeggsncal.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\nbeggsncal.exe"C:\Users\Admin\AppData\Local\Temp\nbeggsncal.exe"4⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:752 -
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:872
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:1836
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\cimrcc.gFilesize
185KB
MD5874dc59d7571e9ffa32c16740763a222
SHA1cf2e6e6c8e7e3a2f4e1a348a289983a730b676fc
SHA256da67c1628cfe982e5aa0995fd4c4f92a434e2e8a577941d7d9d0d8d1373a9183
SHA512d4a8d8c5107cd029fd638f49efabee51d4a4167de260b998497f715fc80f205c03458bbf433c326b46b0fd647ba383df557015428b62457207bb335ce75cb41e
-
C:\Users\Admin\AppData\Local\Temp\nbeggsncal.exeFilesize
131KB
MD5669c2269eea6c11fd71038f0918193fb
SHA1b2da793470b99bd215fbd9b3c7396ac402b068e9
SHA256ba605ae9b548c05ffa985ddad9217cbdd99c1aecc83ce6e7cf36a162cb69938e
SHA5120759ebe446901ab0974ff7cdac1b5517a7a739890a20858da93aaec94bd06bc4e6cb697b706864d78df044c41211990185b4bd9c00a24c616ce6004f371bc91c
-
C:\Users\Admin\AppData\Local\Temp\nbeggsncal.exeFilesize
131KB
MD5669c2269eea6c11fd71038f0918193fb
SHA1b2da793470b99bd215fbd9b3c7396ac402b068e9
SHA256ba605ae9b548c05ffa985ddad9217cbdd99c1aecc83ce6e7cf36a162cb69938e
SHA5120759ebe446901ab0974ff7cdac1b5517a7a739890a20858da93aaec94bd06bc4e6cb697b706864d78df044c41211990185b4bd9c00a24c616ce6004f371bc91c
-
C:\Users\Admin\AppData\Local\Temp\nbeggsncal.exeFilesize
131KB
MD5669c2269eea6c11fd71038f0918193fb
SHA1b2da793470b99bd215fbd9b3c7396ac402b068e9
SHA256ba605ae9b548c05ffa985ddad9217cbdd99c1aecc83ce6e7cf36a162cb69938e
SHA5120759ebe446901ab0974ff7cdac1b5517a7a739890a20858da93aaec94bd06bc4e6cb697b706864d78df044c41211990185b4bd9c00a24c616ce6004f371bc91c
-
C:\Users\Admin\AppData\Local\Temp\qzhglh.zoFilesize
4KB
MD50bd04364eecd4445c14e6f6a52045245
SHA129cd354bba1a83d8e8342d2f7e13a90c87af59a4
SHA25662cb82f57397ea5a5622f990d4729bc6838f5db0e17161080acf4fd46d0b751f
SHA512efda83747836c79a852c0261c0843a3a55991c16fc16b6fd58e7cef3a3b0a4efe561c40b8701c9bb05b74792d273bbd75fd2818b7380a3aacb81a94729d7f6c7
-
\Users\Admin\AppData\Local\Temp\nbeggsncal.exeFilesize
131KB
MD5669c2269eea6c11fd71038f0918193fb
SHA1b2da793470b99bd215fbd9b3c7396ac402b068e9
SHA256ba605ae9b548c05ffa985ddad9217cbdd99c1aecc83ce6e7cf36a162cb69938e
SHA5120759ebe446901ab0974ff7cdac1b5517a7a739890a20858da93aaec94bd06bc4e6cb697b706864d78df044c41211990185b4bd9c00a24c616ce6004f371bc91c
-
\Users\Admin\AppData\Local\Temp\nbeggsncal.exeFilesize
131KB
MD5669c2269eea6c11fd71038f0918193fb
SHA1b2da793470b99bd215fbd9b3c7396ac402b068e9
SHA256ba605ae9b548c05ffa985ddad9217cbdd99c1aecc83ce6e7cf36a162cb69938e
SHA5120759ebe446901ab0974ff7cdac1b5517a7a739890a20858da93aaec94bd06bc4e6cb697b706864d78df044c41211990185b4bd9c00a24c616ce6004f371bc91c
-
\Users\Admin\AppData\Local\Temp\sqlite3.dllFilesize
932KB
MD5661fd92d4eaeea3740649af5a484d7c8
SHA1c93f868890fee1475f8ec9e7607e26f5dce67d54
SHA25658a478f0560ea22c1bc194263f07cf6f3ecfe47d0c8b534a7bba185f28a1141f
SHA5121fac03c20139fde41d121e0adbd02d127261ce061509996087fc1c80baf2fe0d0f70fed6b83d38a85cfa2e07d038ff809161c7ecce31ec44ac8b89740d3db15d
-
memory/752-64-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/752-66-0x00000000001E0000-0x00000000001F0000-memory.dmpFilesize
64KB
-
memory/752-62-0x00000000004012B0-mapping.dmp
-
memory/752-65-0x0000000000870000-0x0000000000B73000-memory.dmpFilesize
3.0MB
-
memory/808-72-0x0000000000450000-0x00000000004DF000-memory.dmpFilesize
572KB
-
memory/808-68-0x0000000000000000-mapping.dmp
-
memory/808-69-0x00000000007F0000-0x0000000000816000-memory.dmpFilesize
152KB
-
memory/808-70-0x0000000000070000-0x000000000009D000-memory.dmpFilesize
180KB
-
memory/808-71-0x0000000002080000-0x0000000002383000-memory.dmpFilesize
3.0MB
-
memory/808-74-0x0000000000070000-0x000000000009D000-memory.dmpFilesize
180KB
-
memory/1272-67-0x0000000004860000-0x0000000004920000-memory.dmpFilesize
768KB
-
memory/1272-73-0x0000000004A90000-0x0000000004B51000-memory.dmpFilesize
772KB
-
memory/1272-75-0x0000000004A90000-0x0000000004B51000-memory.dmpFilesize
772KB
-
memory/1744-54-0x0000000075C81000-0x0000000075C83000-memory.dmpFilesize
8KB
-
memory/1900-56-0x0000000000000000-mapping.dmp