formbook | 4b01d8e4729b07277f8f71037f9fbda1f8d817d9688850d941e7832727bb0276

General

Target

Urgent Request For Quotation.exe
Size

739KB
MD5

0cefb2a275a4d5ae0aff3578abf2859b
SHA1

b84c05bfaaf6e98566479d6a990eaa79baf95b48
SHA256

4b01d8e4729b07277f8f71037f9fbda1f8d817d9688850d941e7832727bb0276
SHA512

e3ac56e26a9ef76d7a3e77e13656169b12a64bbd828c6a5041a1645277c4e20788f073ff240fe4b49608e766dbe615675998062f33f541194b9308c5be9d1958
SSDEEP

12288:JudpNvgkg586aWHffM9/uiiiOMZmHykP+KifPcbIc9FUqUiwA65cP+PXc5+:CNvgB5O8fquDMZmp2FcbIoUcB

Score

10^/10

formbook snky rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

snky

Decoy

AiMFvkl6+A4HEgZ99q5x4naN7lGmvJo=

tvj/KUTKeKgxszIemQ==

DTrTokBrjB5leF4=

tPeTOuIjJPtH

taxtMdIygEdpskxzOQ2ZjoAEeA==

CxLuaKAFRrJyuIqQUPbhZw==

Tn4fapT5kPmk1H0gpXQ=

h5p8hDqGSiRzdSbV

i3lg8tbRNRU6jC9pQSOxzHYZgpbnOKBx

EwbfBo6m+UXU2qaVUPbhZw==

WpeenFSMquJ3xXD1/b43

niV5qTFu3tfmcgrI

fqyyyElbdxWswJ7A

Lh7o92ZOr4ghbwvK

Y2RYMDue4x+KszIemQ==

lN3Y3z5AS85eah1MDvfFQQA=

uq+Oqh8MNRxHOOkqA9lqYEZZhJU=

FEtGDeGnnRoSQEM=

TkMlruotvsmtpFwg6shr03LjwMWGow==

7PGx8hNMep8EMj5Q39dsq16IbbaIrA==

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Urgent Request For Quotation.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	Urgent Request For Quotation.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 3 IoCs

Processes:

Urgent Request For Quotation.exeUrgent Request For Quotation.execscript.exe

description	pid	process	target process
PID 1716 set thread context of 3536	1716	Urgent Request For Quotation.exe	Urgent Request For Quotation.exe
PID 3536 set thread context of 2756	3536	Urgent Request For Quotation.exe	Explorer.EXE
PID 3908 set thread context of 2756	3908	cscript.exe	Explorer.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

cscript.exe

description	ioc	process
Key created	\Registry\User\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	cscript.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

Processes:

Urgent Request For Quotation.execscript.exe

pid	process
3536	Urgent Request For Quotation.exe
3536	Urgent Request For Quotation.exe
3536	Urgent Request For Quotation.exe
3536	Urgent Request For Quotation.exe
3536	Urgent Request For Quotation.exe
3536	Urgent Request For Quotation.exe
3536	Urgent Request For Quotation.exe
3536	Urgent Request For Quotation.exe
3908	cscript.exe
3908	cscript.exe
3908	cscript.exe
3908	cscript.exe
3908	cscript.exe
3908	cscript.exe
3908	cscript.exe
3908	cscript.exe
3908	cscript.exe
3908	cscript.exe
3908	cscript.exe
3908	cscript.exe
3908	cscript.exe
3908	cscript.exe
3908	cscript.exe
3908	cscript.exe
3908	cscript.exe
3908	cscript.exe
3908	cscript.exe
3908	cscript.exe
3908	cscript.exe
3908	cscript.exe
3908	cscript.exe
3908	cscript.exe
3908	cscript.exe
3908	cscript.exe
3908	cscript.exe
3908	cscript.exe
3908	cscript.exe
3908	cscript.exe
3908	cscript.exe
3908	cscript.exe
3908	cscript.exe
3908	cscript.exe
3908	cscript.exe
3908	cscript.exe
3908	cscript.exe
3908	cscript.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

2756 Explorer.EXE

pid	process
2756	Explorer.EXE

Suspicious behavior: MapViewOfSection 7 IoCs

Processes:

Urgent Request For Quotation.execscript.exe

pid	process
3536	Urgent Request For Quotation.exe
3536	Urgent Request For Quotation.exe
3536	Urgent Request For Quotation.exe
3908	cscript.exe
3908	cscript.exe
3908	cscript.exe
3908	cscript.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

Urgent Request For Quotation.execscript.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	3536	Urgent Request For Quotation.exe
Token: SeDebugPrivilege	3908	cscript.exe
Token: SeShutdownPrivilege	2756	Explorer.EXE
Token: SeCreatePagefilePrivilege	2756	Explorer.EXE
Token: SeShutdownPrivilege	2756	Explorer.EXE
Token: SeCreatePagefilePrivilege	2756	Explorer.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Urgent Request For Quotation.exeExplorer.EXEcscript.exe

description	pid	process	target process
PID 1716 wrote to memory of 3536	1716	Urgent Request For Quotation.exe	Urgent Request For Quotation.exe
PID 1716 wrote to memory of 3536	1716	Urgent Request For Quotation.exe	Urgent Request For Quotation.exe
PID 1716 wrote to memory of 3536	1716	Urgent Request For Quotation.exe	Urgent Request For Quotation.exe
PID 1716 wrote to memory of 3536	1716	Urgent Request For Quotation.exe	Urgent Request For Quotation.exe
PID 1716 wrote to memory of 3536	1716	Urgent Request For Quotation.exe	Urgent Request For Quotation.exe
PID 1716 wrote to memory of 3536	1716	Urgent Request For Quotation.exe	Urgent Request For Quotation.exe
PID 2756 wrote to memory of 3908	2756	Explorer.EXE	cscript.exe
PID 2756 wrote to memory of 3908	2756	Explorer.EXE	cscript.exe
PID 2756 wrote to memory of 3908	2756	Explorer.EXE	cscript.exe
PID 3908 wrote to memory of 3488	3908	cscript.exe	Firefox.exe
PID 3908 wrote to memory of 3488	3908	cscript.exe	Firefox.exe
PID 3908 wrote to memory of 3488	3908	cscript.exe	Firefox.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2756

C:\Users\Admin\AppData\Local\Temp\Urgent Request For Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Urgent Request For Quotation.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1716

C:\Users\Admin\AppData\Local\Temp\Urgent Request For Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Urgent Request For Quotation.exe"
3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3536

C:\Windows\SysWOW64\cscript.exe
"C:\Windows\SysWOW64\cscript.exe"
2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3908

C:\Program Files\Mozilla Firefox\Firefox.exe
"C:\Program Files\Mozilla Firefox\Firefox.exe"
3⤵
PID:3488

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1716-132-0x00000000004F0000-0x00000000005B0000-memory.dmp

Filesize
768KB

Download
memory/1716-133-0x00000000055F0000-0x0000000005B94000-memory.dmp

Filesize
5.6MB

Download
memory/1716-134-0x0000000004F60000-0x0000000004FF2000-memory.dmp

Filesize
584KB

Download
memory/1716-135-0x0000000005000000-0x000000000500A000-memory.dmp

Filesize
40KB

Download
memory/1716-136-0x0000000007A50000-0x0000000007AEC000-memory.dmp

Filesize
624KB

Download
memory/2756-160-0x0000000003070000-0x0000000003080000-memory.dmp

Filesize
64KB

Download
memory/2756-161-0x0000000003070000-0x0000000003080000-memory.dmp

Filesize
64KB

Download
memory/2756-162-0x0000000003070000-0x0000000003080000-memory.dmp

Filesize
64KB

Download
memory/2756-152-0x0000000002F30000-0x0000000002FD5000-memory.dmp

Filesize
660KB

Download
memory/2756-159-0x0000000000E40000-0x0000000000E50000-memory.dmp

Filesize
64KB

Download
memory/2756-158-0x0000000003070000-0x0000000003080000-memory.dmp

Filesize
64KB

Download
memory/2756-157-0x0000000003070000-0x0000000003080000-memory.dmp

Filesize
64KB

Download
memory/2756-156-0x0000000000E40000-0x0000000000E50000-memory.dmp

Filesize
64KB

Download
memory/2756-146-0x0000000003320000-0x0000000003443000-memory.dmp

Filesize
1.1MB

Download
memory/2756-155-0x00000000011B0000-0x00000000011C0000-memory.dmp

Filesize
64KB

Download
memory/2756-154-0x0000000002F30000-0x0000000002FD5000-memory.dmp

Filesize
660KB

Download
memory/3536-140-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3536-142-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/3536-137-0x0000000000000000-mapping.dmp

Download
memory/3536-138-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3536-141-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3536-143-0x0000000001AF0000-0x0000000001E3A000-memory.dmp

Filesize
3.3MB

Download
memory/3536-144-0x0000000000422000-0x0000000000424000-memory.dmp

Filesize
8KB

Download
memory/3536-145-0x00000000011F0000-0x0000000001200000-memory.dmp

Filesize
64KB

Download
memory/3908-147-0x0000000000000000-mapping.dmp

Download
memory/3908-148-0x0000000000BA0000-0x0000000000BC7000-memory.dmp

Filesize
156KB

Download
memory/3908-150-0x00000000033A0000-0x00000000036EA000-memory.dmp

Filesize
3.3MB

Download
memory/3908-153-0x0000000000F50000-0x0000000000F7D000-memory.dmp

Filesize
180KB

Download
memory/3908-149-0x0000000000F50000-0x0000000000F7D000-memory.dmp

Filesize
180KB

Download
memory/3908-151-0x0000000003200000-0x000000000328F000-memory.dmp

Filesize
572KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads