formbook | 6a7b8ed7f2cfe7f8a3030df54f1ba443025c54e5a15d416469aac2a696d7bf1d

General

Target

Consignment Notification- 705643291.exe
Size

226KB
MD5

a60cbdaf4f35894d7970f9bcf606acfa
SHA1

fe4a22af06fb8d122065dfb0683a7dd9c6baae9a
SHA256

6a7b8ed7f2cfe7f8a3030df54f1ba443025c54e5a15d416469aac2a696d7bf1d
SHA512

7b9822089f6251b116e589140473e8f671568bd45b954c505ab77163210594fd4a4b0905d9dce3b601d50ee217e8f4c06f9fc05cae84873b2498f8c1d3d7b323
SSDEEP

3072:QEhKzShSycSMIZLq4ziw2z2nsfvTdob43u27OP4XrefAKNdOR6XgrhedPZphUYk:QBn1Ig4DvNb43m4qO4Qr85k

Score

10^/10

formbook yurm persistence rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

yurm

Decoy

X06d1tis1GUX/R0g87Ud

BKiZ33D1P766GVXO1ZwV

lAFdjB7CSxGX8Trz

Gc7dWizTVxWX8Trz

tDkr9JAfi1OHAW1PGOageIp4

bCpMtHKU3mVp8BY5sQ==

7WKpsMWt8nsrhJClJeOZNg==

0A9KTlETQ86Cmd8k0o5NP5RwCg==

aJ61paNJztSp42c=

CrgoA8ySIOsytCbO1ZwV

i46SnHYDD9tTIHI=

XFRCRCjtFZeU3x4Rn3xfD5BnPz+RDA==

c4CZghuHvzW9A31gEz0d

QAjzz9qyRRWBNYseAI4M

Jpbmu4A1YvBvN3ruZgiRmJA5BCFd

PfoFXGNFhhuX8Trz

bqCfk0m8ApAl+Tm1Ms5Tb23IT7tS

z7INff7HNALxc5HWq2/ftrVR6A7R1zvTUQ==

m7IShV4LSFxbqxhrVsZ1Ig==

BHRp7q0gtoRuqBRnVsZ1Ig==

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Executes dropped EXE 2 IoCs

Processes:

ttwutb.exettwutb.exe

pid process

1032 ttwutb.exe
1228 ttwutb.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

ttwutb.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Control Panel\International\Geo\Nation ttwutb.exe
Loads dropped DLL 3 IoCs

Processes:

Consignment Notification- 705643291.exettwutb.exeexplorer.exe

pid process

1776 Consignment Notification- 705643291.exe
1032 ttwutb.exe
544 explorer.exe

pid	process
1032	ttwutb.exe
1228	ttwutb.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Control Panel\International\Geo\Nation	ttwutb.exe

pid	process
1776	Consignment Notification- 705643291.exe
1032	ttwutb.exe
544	explorer.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

ttwutb.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\rxbbmtrp = "C:\\Users\\Admin\\AppData\\Roaming\\tggsconknigc\\wdvr.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\ttwutb.exe\" C:\\Users\\Admin\\AppData\\Local\\T"	ttwutb.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

ttwutb.exettwutb.exeexplorer.exe

description	pid	process	target process
PID 1032 set thread context of 1228	1032	ttwutb.exe	ttwutb.exe
PID 1228 set thread context of 1336	1228	ttwutb.exe	Explorer.EXE
PID 544 set thread context of 1336	544	explorer.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\Registry\User\S-1-5-21-3406023954-474543476-3319432036-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	explorer.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

Processes:

ttwutb.exeexplorer.exe

pid	process
1228	ttwutb.exe
1228	ttwutb.exe
1228	ttwutb.exe
1228	ttwutb.exe
544	explorer.exe
544	explorer.exe
544	explorer.exe
544	explorer.exe
544	explorer.exe
544	explorer.exe
544	explorer.exe
544	explorer.exe
544	explorer.exe
544	explorer.exe
544	explorer.exe
544	explorer.exe
544	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1336 Explorer.EXE
Suspicious behavior: MapViewOfSection 8 IoCs

Processes:

ttwutb.exettwutb.exeexplorer.exe

pid process

1032 ttwutb.exe
1228 ttwutb.exe
1228 ttwutb.exe
1228 ttwutb.exe
544 explorer.exe
544 explorer.exe
544 explorer.exe
544 explorer.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

ttwutb.exeexplorer.exeExplorer.EXE

description pid process

Token: SeDebugPrivilege 1228 ttwutb.exe
Token: SeDebugPrivilege 544 explorer.exe
Token: SeShutdownPrivilege 1336 Explorer.EXE
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1336 Explorer.EXE
1336 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1336 Explorer.EXE
1336 Explorer.EXE

pid	process
1336	Explorer.EXE

pid	process
1032	ttwutb.exe
1228	ttwutb.exe
1228	ttwutb.exe
1228	ttwutb.exe
544	explorer.exe
544	explorer.exe
544	explorer.exe
544	explorer.exe

description	pid	process
Token: SeDebugPrivilege	1228	ttwutb.exe
Token: SeDebugPrivilege	544	explorer.exe
Token: SeShutdownPrivilege	1336	Explorer.EXE

pid	process
1336	Explorer.EXE
1336	Explorer.EXE

pid	process
1336	Explorer.EXE
1336	Explorer.EXE

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

Consignment Notification- 705643291.exettwutb.exeExplorer.EXEexplorer.exe

description	pid	process	target process
PID 1776 wrote to memory of 1032	1776	Consignment Notification- 705643291.exe	ttwutb.exe
PID 1776 wrote to memory of 1032	1776	Consignment Notification- 705643291.exe	ttwutb.exe
PID 1776 wrote to memory of 1032	1776	Consignment Notification- 705643291.exe	ttwutb.exe
PID 1776 wrote to memory of 1032	1776	Consignment Notification- 705643291.exe	ttwutb.exe
PID 1032 wrote to memory of 1228	1032	ttwutb.exe	ttwutb.exe
PID 1032 wrote to memory of 1228	1032	ttwutb.exe	ttwutb.exe
PID 1032 wrote to memory of 1228	1032	ttwutb.exe	ttwutb.exe
PID 1032 wrote to memory of 1228	1032	ttwutb.exe	ttwutb.exe
PID 1032 wrote to memory of 1228	1032	ttwutb.exe	ttwutb.exe
PID 1336 wrote to memory of 544	1336	Explorer.EXE	explorer.exe
PID 1336 wrote to memory of 544	1336	Explorer.EXE	explorer.exe
PID 1336 wrote to memory of 544	1336	Explorer.EXE	explorer.exe
PID 1336 wrote to memory of 544	1336	Explorer.EXE	explorer.exe
PID 544 wrote to memory of 296	544	explorer.exe	Firefox.exe
PID 544 wrote to memory of 296	544	explorer.exe	Firefox.exe
PID 544 wrote to memory of 296	544	explorer.exe	Firefox.exe
PID 544 wrote to memory of 296	544	explorer.exe	Firefox.exe
PID 544 wrote to memory of 296	544	explorer.exe	Firefox.exe

C:\Users\Admin\AppData\Local\Temp\Consignment Notification- 705643291.exe
"C:\Users\Admin\AppData\Local\Temp\Consignment Notification- 705643291.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1776

C:\Users\Admin\AppData\Local\Temp\ttwutb.exe
"C:\Users\Admin\AppData\Local\Temp\ttwutb.exe" C:\Users\Admin\AppData\Local\Temp\afoqzcrkmi.d
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1032

C:\Users\Admin\AppData\Local\Temp\ttwutb.exe
"C:\Users\Admin\AppData\Local\Temp\ttwutb.exe"
3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1228

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1336

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\SysWOW64\explorer.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:544

C:\Program Files\Mozilla Firefox\Firefox.exe
"C:\Program Files\Mozilla Firefox\Firefox.exe"
3⤵
PID:296

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\afoqzcrkmi.d
Filesize
7KB

MD5
a5a31e3a62c832cb29d0bd27f3f42e8f

SHA1
303acc0d5a2b69ce4e6c5237461db0a2735339c4

SHA256
c89f088d54d301f9cc16c0380610ebacfd6152d243588aa114846823860a3cc6

SHA512
bca692d56f5273c69b927fccc08791e22732909cfe77b81d0f10cf11aee4f94f1c73922a370cabc009b3b516c0c6cc5e538d0bb11e03e5d84ef66f31079f993b

Download Submit
C:\Users\Admin\AppData\Local\Temp\asbvcpwfsu.nzh
Filesize
185KB

MD5
0c54a02e01b246d54a350c2421a9978e

SHA1
18d49d992eef55a62d8c1b48ddf32ae21c7bdfe8

SHA256
999741981cec391c06e6ac4b5e33168e5f04e4f1340d64c7f74d2456ab01565e

SHA512
6ecc204cc6b8434dedeae9682728d441a461123619c005204c0f30fb3f2d3a56501bcdd67df6ed7e1ca773fc1b36ad525bb747b2c4d3d7c0b62ae0c9c5ade918

Download Submit
C:\Users\Admin\AppData\Local\Temp\ttwutb.exe
Filesize
12KB

MD5
aafd9dbfd8f3255c05ed6a4a2e9cdaaf

SHA1
c3fdbb2b60791515f63e65a36b07a9d1904f6957

SHA256
0effb6bcc873119c07e3a4544297b28da24e5cb1e64567998b4a6ccd46bd2da6

SHA512
9025bb8df8f06ea2378040655717d9d367a0b8c827f31c337cc6430683b169b4c2b70cf82cd247fa6534e2759424902dfc70f70e6c7a8cb8189ce94d7ca1bbc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\ttwutb.exe
Filesize
12KB

MD5
aafd9dbfd8f3255c05ed6a4a2e9cdaaf

SHA1
c3fdbb2b60791515f63e65a36b07a9d1904f6957

SHA256
0effb6bcc873119c07e3a4544297b28da24e5cb1e64567998b4a6ccd46bd2da6

SHA512
9025bb8df8f06ea2378040655717d9d367a0b8c827f31c337cc6430683b169b4c2b70cf82cd247fa6534e2759424902dfc70f70e6c7a8cb8189ce94d7ca1bbc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\ttwutb.exe
Filesize
12KB

MD5
aafd9dbfd8f3255c05ed6a4a2e9cdaaf

SHA1
c3fdbb2b60791515f63e65a36b07a9d1904f6957

SHA256
0effb6bcc873119c07e3a4544297b28da24e5cb1e64567998b4a6ccd46bd2da6

SHA512
9025bb8df8f06ea2378040655717d9d367a0b8c827f31c337cc6430683b169b4c2b70cf82cd247fa6534e2759424902dfc70f70e6c7a8cb8189ce94d7ca1bbc5

Download Submit
\Users\Admin\AppData\Local\Temp\sqlite3.dll
Filesize
849KB

MD5
87f9e5a6318ac1ec5ee05aa94a919d7a

SHA1
7a9956e8de89603dba99772da29493d3fd0fe37d

SHA256
7705b87603e0d772e1753441001fcf1ac2643ee41bf14a8177de2c056628665c

SHA512
c45c03176142918e34f746711e83384572bd6a8ed0a005600aa4a18cf22eade06c76eda190b37db49ec1971c4649e086affd19eee108c5f405df27c0c8cb23d2

Download Submit
\Users\Admin\AppData\Local\Temp\ttwutb.exe
Filesize
12KB

MD5
aafd9dbfd8f3255c05ed6a4a2e9cdaaf

SHA1
c3fdbb2b60791515f63e65a36b07a9d1904f6957

SHA256
0effb6bcc873119c07e3a4544297b28da24e5cb1e64567998b4a6ccd46bd2da6

SHA512
9025bb8df8f06ea2378040655717d9d367a0b8c827f31c337cc6430683b169b4c2b70cf82cd247fa6534e2759424902dfc70f70e6c7a8cb8189ce94d7ca1bbc5

Download Submit
\Users\Admin\AppData\Local\Temp\ttwutb.exe
Filesize
12KB

MD5
aafd9dbfd8f3255c05ed6a4a2e9cdaaf

SHA1
c3fdbb2b60791515f63e65a36b07a9d1904f6957

SHA256
0effb6bcc873119c07e3a4544297b28da24e5cb1e64567998b4a6ccd46bd2da6

SHA512
9025bb8df8f06ea2378040655717d9d367a0b8c827f31c337cc6430683b169b4c2b70cf82cd247fa6534e2759424902dfc70f70e6c7a8cb8189ce94d7ca1bbc5

Download Submit
memory/544-74-0x0000000000080000-0x00000000000AD000-memory.dmp

Filesize
180KB

Download
memory/544-72-0x00000000750D1000-0x00000000750D3000-memory.dmp

Filesize
8KB

Download
memory/544-78-0x0000000000080000-0x00000000000AD000-memory.dmp

Filesize
180KB

Download
memory/544-76-0x0000000001F90000-0x000000000201F000-memory.dmp

Filesize
572KB

Download
memory/544-75-0x0000000002370000-0x0000000002673000-memory.dmp

Filesize
3.0MB

Download
memory/544-73-0x0000000000250000-0x00000000004D1000-memory.dmp

Filesize
2.5MB

Download
memory/544-70-0x0000000000000000-mapping.dmp

Download
memory/1032-56-0x0000000000000000-mapping.dmp

Download
memory/1228-67-0x00000000008A0000-0x0000000000BA3000-memory.dmp

Filesize
3.0MB

Download
memory/1228-63-0x00000000004012B0-mapping.dmp

Download
memory/1228-68-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/1228-66-0x0000000000401000-0x000000000042F000-memory.dmp

Filesize
184KB

Download
memory/1228-65-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1336-69-0x0000000006960000-0x0000000006AD0000-memory.dmp

Filesize
1.4MB

Download
memory/1336-77-0x0000000007140000-0x00000000072AF000-memory.dmp

Filesize
1.4MB

Download
memory/1336-79-0x0000000007140000-0x00000000072AF000-memory.dmp

Filesize
1.4MB

Download
memory/1776-54-0x0000000075C31000-0x0000000075C33000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads