formbook | 9f0d17930a9312b8d8dfb23119b57fed676a1bb15fc1582754ab94201651b221

General

Target

NHYGUnNN.exe
Size

269KB
MD5

4f9c8432b57fa1aa875071de547ba947
SHA1

e1cc52fd851621743ba562a65161bfafed8e6b2b
SHA256

9f0d17930a9312b8d8dfb23119b57fed676a1bb15fc1582754ab94201651b221
SHA512

ced221c2e5225a8ead486e52f1c5307b24dbaff8864c7262f2d6f58cad3184753d1f2afe525c3afa122ddcafeab38845dafd2f7a22169bfac026375e7962481d
SSDEEP

6144:RhwendE8+/O+oImP2Qcy7ZwpeA9pg6Cer0K7+UUcT9gxyRClRcOpoik:EAHdP7ZwpeApT0K7+UUQ99RORcOpoR

Score

10^/10

formbook 4u5a rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

4u5a

Decoy

Y9HWoINcPu0r7SSSKt4FCmk7

G/E64auYdhRQM4wZW2bcOaY=

bL57APty/StRpW49a+EdxA==

TppryJ0SoslHe8gJFVc=

HXxDShYIEcUJDahdv2nvl5Hlbp4=

EKaq5c6w0nV3WWlEqM4Www==

VM+YjE8XS1OLcH1roYF4zA==

OwK0wxmBGnq2Fg==

B1zy4bulyfY9tj9DK2eIkeYArpTt

Avj5JeA8m9girqfQ4+cZxA==

AOY4dmDFkCdX8HUJMw==

5cQUw3pPMYr07V8=

P7ZsN4/zt63AEw==

FYyVCOpB8Vl//kSkDLPo91Yy

jxwZTBp+5gcsccPxDF+K4bDG2Rpp0A==

iGx9AO58DRhZbXX9

prwVyLkAtlhSU6irmansg8wArpTt

uqa8ZPl+FFObOkdFNg==

tL4OhF22EDaEOkdFNg==

6exH76Z9o7eu/n86vgPE

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Suspicious use of SetThreadContext 3 IoCs

Processes:

NHYGUnNN.exeRegsvcs.exenetsh.exe

description	pid	process	target process
PID 2680 set thread context of 4460	2680	NHYGUnNN.exe	Regsvcs.exe
PID 4460 set thread context of 3056	4460	Regsvcs.exe	Explorer.EXE
PID 3360 set thread context of 3056	3360	netsh.exe	Explorer.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

netsh.exe

description	ioc	process
Key created	\Registry\User\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	netsh.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

NHYGUnNN.exeRegsvcs.exenetsh.exe

pid	process
2680	NHYGUnNN.exe
2680	NHYGUnNN.exe
4460	Regsvcs.exe
4460	Regsvcs.exe
4460	Regsvcs.exe
4460	Regsvcs.exe
4460	Regsvcs.exe
4460	Regsvcs.exe
4460	Regsvcs.exe
4460	Regsvcs.exe
3360	netsh.exe
3360	netsh.exe
3360	netsh.exe
3360	netsh.exe
3360	netsh.exe
3360	netsh.exe
3360	netsh.exe
3360	netsh.exe
3360	netsh.exe
3360	netsh.exe
3360	netsh.exe
3360	netsh.exe
3360	netsh.exe
3360	netsh.exe
3360	netsh.exe
3360	netsh.exe
3360	netsh.exe
3360	netsh.exe
3360	netsh.exe
3360	netsh.exe
3360	netsh.exe
3360	netsh.exe
3360	netsh.exe
3360	netsh.exe
3360	netsh.exe
3360	netsh.exe
3360	netsh.exe
3360	netsh.exe
3360	netsh.exe
3360	netsh.exe
3360	netsh.exe
3360	netsh.exe
3360	netsh.exe
3360	netsh.exe
3360	netsh.exe
3360	netsh.exe
3360	netsh.exe
3360	netsh.exe
3360	netsh.exe
3360	netsh.exe
3360	netsh.exe
3360	netsh.exe
3360	netsh.exe
3360	netsh.exe
3360	netsh.exe
3360	netsh.exe
3360	netsh.exe
3360	netsh.exe
3360	netsh.exe
3360	netsh.exe
3360	netsh.exe
3360	netsh.exe
3360	netsh.exe
3360	netsh.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

3056 Explorer.EXE
Suspicious behavior: MapViewOfSection 7 IoCs

Processes:

Regsvcs.exenetsh.exe

pid process

4460 Regsvcs.exe
4460 Regsvcs.exe
4460 Regsvcs.exe
3360 netsh.exe
3360 netsh.exe
3360 netsh.exe
3360 netsh.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

NHYGUnNN.exeRegsvcs.exenetsh.exe

description pid process

Token: SeDebugPrivilege 2680 NHYGUnNN.exe
Token: SeDebugPrivilege 4460 Regsvcs.exe
Token: SeDebugPrivilege 3360 netsh.exe

pid	process
3056	Explorer.EXE

pid	process
4460	Regsvcs.exe
4460	Regsvcs.exe
4460	Regsvcs.exe
3360	netsh.exe
3360	netsh.exe
3360	netsh.exe
3360	netsh.exe

description	pid	process
Token: SeDebugPrivilege	2680	NHYGUnNN.exe
Token: SeDebugPrivilege	4460	Regsvcs.exe
Token: SeDebugPrivilege	3360	netsh.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

NHYGUnNN.exeExplorer.EXEnetsh.exe

description	pid	process	target process
PID 2680 wrote to memory of 3476	2680	NHYGUnNN.exe	Regsvcs.exe
PID 2680 wrote to memory of 3476	2680	NHYGUnNN.exe	Regsvcs.exe
PID 2680 wrote to memory of 3476	2680	NHYGUnNN.exe	Regsvcs.exe
PID 2680 wrote to memory of 4460	2680	NHYGUnNN.exe	Regsvcs.exe
PID 2680 wrote to memory of 4460	2680	NHYGUnNN.exe	Regsvcs.exe
PID 2680 wrote to memory of 4460	2680	NHYGUnNN.exe	Regsvcs.exe
PID 2680 wrote to memory of 4460	2680	NHYGUnNN.exe	Regsvcs.exe
PID 2680 wrote to memory of 4460	2680	NHYGUnNN.exe	Regsvcs.exe
PID 2680 wrote to memory of 4460	2680	NHYGUnNN.exe	Regsvcs.exe
PID 3056 wrote to memory of 3360	3056	Explorer.EXE	netsh.exe
PID 3056 wrote to memory of 3360	3056	Explorer.EXE	netsh.exe
PID 3056 wrote to memory of 3360	3056	Explorer.EXE	netsh.exe
PID 3360 wrote to memory of 5008	3360	netsh.exe	Firefox.exe
PID 3360 wrote to memory of 5008	3360	netsh.exe	Firefox.exe
PID 3360 wrote to memory of 5008	3360	netsh.exe	Firefox.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Users\Admin\AppData\Local\Temp\NHYGUnNN.exe
  "C:\Users\Admin\AppData\Local\Temp\NHYGUnNN.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2680
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Regsvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Regsvcs.exe"
    3⤵
    PID:3476
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Regsvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Regsvcs.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:4460
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\SysWOW64\netsh.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3360
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:5008

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2680-137-0x00007FFC484B0000-0x00007FFC48F71000-memory.dmp

Filesize
10.8MB

Download
memory/2680-132-0x000001F9AA2B0000-0x000001F9AA2F8000-memory.dmp

Filesize
288KB

Download
memory/3056-142-0x0000000002C70000-0x0000000002D3D000-memory.dmp

Filesize
820KB

Download
memory/3056-152-0x0000000007530000-0x0000000007619000-memory.dmp

Filesize
932KB

Download
memory/3056-150-0x0000000007530000-0x0000000007619000-memory.dmp

Filesize
932KB

Download
memory/3360-146-0x0000000000AB0000-0x0000000000ACE000-memory.dmp

Filesize
120KB

Download
memory/3360-151-0x0000000000FA0000-0x0000000000FCD000-memory.dmp

Filesize
180KB

Download
memory/3360-149-0x00000000017A0000-0x000000000182F000-memory.dmp

Filesize
572KB

Download
memory/3360-148-0x0000000001900000-0x0000000001C4A000-memory.dmp

Filesize
3.3MB

Download
memory/3360-143-0x0000000000000000-mapping.dmp

Download
memory/3360-147-0x0000000000FA0000-0x0000000000FCD000-memory.dmp

Filesize
180KB

Download
memory/4460-141-0x0000000001140000-0x0000000001150000-memory.dmp

Filesize
64KB

Download
memory/4460-145-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/4460-144-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4460-133-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4460-136-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4460-140-0x00000000015B0000-0x00000000018FA000-memory.dmp

Filesize
3.3MB

Download
memory/4460-138-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/4460-134-0x00000000004012B0-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads