formbook | 4a0f5f393b9b5ec51e24b1feb5ac4239ea144960d25825e1dd5f3af02858cc2c

General

Target

MV DOOYANG TBN PARTICULARS.exe
Size

259KB
MD5

571c086c113946c6bede6590548a96d1
SHA1

f03b3c1cf890d22df72094e3df466d141a0226b5
SHA256

4a0f5f393b9b5ec51e24b1feb5ac4239ea144960d25825e1dd5f3af02858cc2c
SHA512

9917251bfc52dc8ba6788aecee9a149340c30b73565598c22d28a6d1a34d5e7357a4b4812429965b1d3f58ad904dad4902d06762dcbe25adcdce83d900e27f1a
SSDEEP

6144:1BnqxnIIw4bDUEDTIg826uyIM42tgpouzDPDxm:yxnIN43UHzDucgi0PDxm

Score

10^/10

formbook ermr persistence rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

ermr

Decoy

ErOK6LFCgNIAlQmH54oaYOL/CN29Z78=

qNSdDhu/PT/1fgafDagiCSZH1SY=

wLpPOAkYS8EABl3pHGc4hNT/Q1sHBrU=

jSxRvptHkeTGl7PT0SEmaZmjqzanuA==

b91oL+2wCcpyhnd6yvF6Pg==

mr81yp1/qqZX

hy7Xsz/PU/LWHMcGL4UYJx9n3A==

KlwrHt1gouPaXaWhoQ==

ng8M320IRJL9Ptw=

8GQbOXuaWxvKnNM=

XndOL7E5sNpVUNty4d/a

rryPBBC8PybYb+2h2MF3FHGL

kEoeyERSVCYO0g==

5/P+SBDby5hO

1fYXc30/h9W7iO17

34X+YKR+wRFE

8ir/X2MlVByh5lQ1ow8=

u9ikm2UMZ7J7hpCYow==

FLI+c3clp1BNDjVAfvC2Dnw=

t21Erq8/r09wAzAJTAH3Ng==

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

cmd.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\YTPX2XKHQZ = "C:\\Program Files (x86)\\Iufu8zjr\\evxfbcpdxyx.exe"	cmd.exe

Blocklisted process makes network request 1 IoCs

Processes:

cmd.exe

flow pid process

49 5012 cmd.exe
Executes dropped EXE 2 IoCs

Processes:

vvyzzbuuw.exevvyzzbuuw.exe

pid process

3376 vvyzzbuuw.exe
4952 vvyzzbuuw.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

vvyzzbuuw.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation vvyzzbuuw.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

flow	pid	process
49	5012	cmd.exe

pid	process
3376	vvyzzbuuw.exe
4952	vvyzzbuuw.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	vvyzzbuuw.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

vvyzzbuuw.exevvyzzbuuw.execmd.exe

description	pid	process	target process
PID 3376 set thread context of 4952	3376	vvyzzbuuw.exe	vvyzzbuuw.exe
PID 4952 set thread context of 2228	4952	vvyzzbuuw.exe	Explorer.EXE
PID 5012 set thread context of 2228	5012	cmd.exe	Explorer.EXE

Drops file in Program Files directory 1 IoCs

Processes:

cmd.exe

description ioc process

File opened for modification C:\Program Files (x86)\Iufu8zjr\evxfbcpdxyx.exe cmd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Program Files (x86)\Iufu8zjr\evxfbcpdxyx.exe	cmd.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

cmd.exe

description	ioc	process
Key created	\Registry\User\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	cmd.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

Processes:

vvyzzbuuw.execmd.exe

pid	process
4952	vvyzzbuuw.exe
4952	vvyzzbuuw.exe
4952	vvyzzbuuw.exe
4952	vvyzzbuuw.exe
4952	vvyzzbuuw.exe
4952	vvyzzbuuw.exe
4952	vvyzzbuuw.exe
4952	vvyzzbuuw.exe
5012	cmd.exe
5012	cmd.exe
5012	cmd.exe
5012	cmd.exe
5012	cmd.exe
5012	cmd.exe
5012	cmd.exe
5012	cmd.exe
5012	cmd.exe
5012	cmd.exe
5012	cmd.exe
5012	cmd.exe
5012	cmd.exe
5012	cmd.exe
5012	cmd.exe
5012	cmd.exe
5012	cmd.exe
5012	cmd.exe
5012	cmd.exe
5012	cmd.exe
5012	cmd.exe
5012	cmd.exe
5012	cmd.exe
5012	cmd.exe
5012	cmd.exe
5012	cmd.exe
5012	cmd.exe
5012	cmd.exe
5012	cmd.exe
5012	cmd.exe
5012	cmd.exe
5012	cmd.exe
5012	cmd.exe
5012	cmd.exe
5012	cmd.exe
5012	cmd.exe
5012	cmd.exe
5012	cmd.exe
5012	cmd.exe
5012	cmd.exe
5012	cmd.exe
5012	cmd.exe
5012	cmd.exe
5012	cmd.exe
5012	cmd.exe
5012	cmd.exe
5012	cmd.exe
5012	cmd.exe
5012	cmd.exe
5012	cmd.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

2228 Explorer.EXE
Suspicious behavior: MapViewOfSection 8 IoCs

Processes:

vvyzzbuuw.exevvyzzbuuw.execmd.exe

pid process

3376 vvyzzbuuw.exe
4952 vvyzzbuuw.exe
4952 vvyzzbuuw.exe
4952 vvyzzbuuw.exe
5012 cmd.exe
5012 cmd.exe
5012 cmd.exe
5012 cmd.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

vvyzzbuuw.execmd.exe

description pid process

Token: SeDebugPrivilege 4952 vvyzzbuuw.exe
Token: SeDebugPrivilege 5012 cmd.exe

pid	process
2228	Explorer.EXE

pid	process
3376	vvyzzbuuw.exe
4952	vvyzzbuuw.exe
4952	vvyzzbuuw.exe
4952	vvyzzbuuw.exe
5012	cmd.exe
5012	cmd.exe
5012	cmd.exe
5012	cmd.exe

description	pid	process
Token: SeDebugPrivilege	4952	vvyzzbuuw.exe
Token: SeDebugPrivilege	5012	cmd.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

MV DOOYANG TBN PARTICULARS.exevvyzzbuuw.exeExplorer.EXEcmd.exe

description	pid	process	target process
PID 940 wrote to memory of 3376	940	MV DOOYANG TBN PARTICULARS.exe	vvyzzbuuw.exe
PID 940 wrote to memory of 3376	940	MV DOOYANG TBN PARTICULARS.exe	vvyzzbuuw.exe
PID 940 wrote to memory of 3376	940	MV DOOYANG TBN PARTICULARS.exe	vvyzzbuuw.exe
PID 3376 wrote to memory of 4952	3376	vvyzzbuuw.exe	vvyzzbuuw.exe
PID 3376 wrote to memory of 4952	3376	vvyzzbuuw.exe	vvyzzbuuw.exe
PID 3376 wrote to memory of 4952	3376	vvyzzbuuw.exe	vvyzzbuuw.exe
PID 3376 wrote to memory of 4952	3376	vvyzzbuuw.exe	vvyzzbuuw.exe
PID 2228 wrote to memory of 5012	2228	Explorer.EXE	cmd.exe
PID 2228 wrote to memory of 5012	2228	Explorer.EXE	cmd.exe
PID 2228 wrote to memory of 5012	2228	Explorer.EXE	cmd.exe
PID 5012 wrote to memory of 1136	5012	cmd.exe	cmd.exe
PID 5012 wrote to memory of 1136	5012	cmd.exe	cmd.exe
PID 5012 wrote to memory of 1136	5012	cmd.exe	cmd.exe
PID 5012 wrote to memory of 3560	5012	cmd.exe	Firefox.exe
PID 5012 wrote to memory of 3560	5012	cmd.exe	Firefox.exe
PID 5012 wrote to memory of 3560	5012	cmd.exe	Firefox.exe

System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

cmd.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer cmd.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2228

C:\Users\Admin\AppData\Local\Temp\MV DOOYANG TBN PARTICULARS.exe
"C:\Users\Admin\AppData\Local\Temp\MV DOOYANG TBN PARTICULARS.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:940

C:\Users\Admin\AppData\Local\Temp\vvyzzbuuw.exe
"C:\Users\Admin\AppData\Local\Temp\vvyzzbuuw.exe" C:\Users\Admin\AppData\Local\Temp\begdxlgnc.tn
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3376

C:\Users\Admin\AppData\Local\Temp\vvyzzbuuw.exe
"C:\Users\Admin\AppData\Local\Temp\vvyzzbuuw.exe" C:\Users\Admin\AppData\Local\Temp\begdxlgnc.tn
4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4952

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\SysWOW64\cmd.exe"
2⤵
- Adds policy Run key to start application
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5012

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\vvyzzbuuw.exe"
3⤵
PID:1136

C:\Program Files\Mozilla Firefox\Firefox.exe
"C:\Program Files\Mozilla Firefox\Firefox.exe"
3⤵
PID:3560

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\begdxlgnc.tn
Filesize
5KB

MD5
26041daed9cf37bd7ae41993c4bdbc07

SHA1
0f01f6287187a1f5327bef840551d107c17a073b

SHA256
985de5ae56d813e59264e3c517edc443089028f8be6fb6ea297b10f2e2db8e7a

SHA512
cdcd612f2cfcdd0cf269d8ff91c42ed9bfb6f2f8ed080eac3ce7cf7306addba77d8720953438804904c3236633073b7e85f21d1e61a6c5f98de2b7244a6efa48

Download Submit
C:\Users\Admin\AppData\Local\Temp\qjpzsg.p
Filesize
177KB

MD5
befd89dac126ccc214e128a65db6574d

SHA1
0c6ebce14c335a1d1346dd07ec6005fb84929ab4

SHA256
4f67291c218282b521d51bdc42344132f0509641b0e48d3908af0f75ed3269fc

SHA512
c048a108e29262f7bc31227e4e04b3e607320f304815f300f34ae001e63bddb1e29177ff48d82b134ac341fc3cdfafc0cb77cc068966d12779ce5cf8707db913

Download Submit
C:\Users\Admin\AppData\Local\Temp\vvyzzbuuw.exe
Filesize
122KB

MD5
d812391fdc0465fbc9c146cdc5f395dd

SHA1
34142e8c93ae1b5a58b62f3f21209ac7d81c66f3

SHA256
18f18e2e328bc1bd498d23fd35574f955164ac2a2b92d31854a16e7dfa7c384b

SHA512
99e565c50edd53909b28e802fd7094d28a3265eef66af94fc0f09b0e8fd926c55912b49aa53d53d8af2645165c2a04dff1aaf41f04d3df6eddccf2639e3ef26a

Download Submit
C:\Users\Admin\AppData\Local\Temp\vvyzzbuuw.exe
Filesize
122KB

MD5
d812391fdc0465fbc9c146cdc5f395dd

SHA1
34142e8c93ae1b5a58b62f3f21209ac7d81c66f3

SHA256
18f18e2e328bc1bd498d23fd35574f955164ac2a2b92d31854a16e7dfa7c384b

SHA512
99e565c50edd53909b28e802fd7094d28a3265eef66af94fc0f09b0e8fd926c55912b49aa53d53d8af2645165c2a04dff1aaf41f04d3df6eddccf2639e3ef26a

Download Submit
C:\Users\Admin\AppData\Local\Temp\vvyzzbuuw.exe
Filesize
122KB

MD5
d812391fdc0465fbc9c146cdc5f395dd

SHA1
34142e8c93ae1b5a58b62f3f21209ac7d81c66f3

SHA256
18f18e2e328bc1bd498d23fd35574f955164ac2a2b92d31854a16e7dfa7c384b

SHA512
99e565c50edd53909b28e802fd7094d28a3265eef66af94fc0f09b0e8fd926c55912b49aa53d53d8af2645165c2a04dff1aaf41f04d3df6eddccf2639e3ef26a

Download Submit
memory/1136-146-0x0000000000000000-mapping.dmp

Download
memory/2228-142-0x0000000008320000-0x0000000008458000-memory.dmp

Filesize
1.2MB

Download
memory/2228-152-0x0000000007C20000-0x0000000007D14000-memory.dmp

Filesize
976KB

Download
memory/2228-151-0x0000000007C20000-0x0000000007D14000-memory.dmp

Filesize
976KB

Download
memory/3376-132-0x0000000000000000-mapping.dmp

Download
memory/4952-137-0x0000000000000000-mapping.dmp

Download
memory/4952-144-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/4952-141-0x00000000009E0000-0x00000000009F1000-memory.dmp

Filesize
68KB

Download
memory/4952-140-0x0000000000A60000-0x0000000000DAA000-memory.dmp

Filesize
3.3MB

Download
memory/4952-139-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/5012-143-0x0000000000000000-mapping.dmp

Download
memory/5012-145-0x0000000000460000-0x00000000004BA000-memory.dmp

Filesize
360KB

Download
memory/5012-147-0x0000000001AB0000-0x0000000001DFA000-memory.dmp

Filesize
3.3MB

Download
memory/5012-148-0x0000000001200000-0x000000000122D000-memory.dmp

Filesize
180KB

Download
memory/5012-149-0x0000000001200000-0x000000000122D000-memory.dmp

Filesize
180KB

Download
memory/5012-150-0x00000000018F0000-0x0000000001980000-memory.dmp

Filesize
576KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads