formbook | 6a7b8ed7f2cfe7f8a3030df54f1ba443025c54e5a15d416469aac2a696d7bf1d

General

Target

Consignment Notification- 705643291.exe
Size

226KB
MD5

a60cbdaf4f35894d7970f9bcf606acfa
SHA1

fe4a22af06fb8d122065dfb0683a7dd9c6baae9a
SHA256

6a7b8ed7f2cfe7f8a3030df54f1ba443025c54e5a15d416469aac2a696d7bf1d
SHA512

7b9822089f6251b116e589140473e8f671568bd45b954c505ab77163210594fd4a4b0905d9dce3b601d50ee217e8f4c06f9fc05cae84873b2498f8c1d3d7b323
SSDEEP

3072:QEhKzShSycSMIZLq4ziw2z2nsfvTdob43u27OP4XrefAKNdOR6XgrhedPZphUYk:QBn1Ig4DvNb43m4qO4Qr85k

Score

10^/10

formbook yurm persistence rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

yurm

Decoy

X06d1tis1GUX/R0g87Ud

BKiZ33D1P766GVXO1ZwV

lAFdjB7CSxGX8Trz

Gc7dWizTVxWX8Trz

tDkr9JAfi1OHAW1PGOageIp4

bCpMtHKU3mVp8BY5sQ==

7WKpsMWt8nsrhJClJeOZNg==

0A9KTlETQ86Cmd8k0o5NP5RwCg==

aJ61paNJztSp42c=

CrgoA8ySIOsytCbO1ZwV

i46SnHYDD9tTIHI=

XFRCRCjtFZeU3x4Rn3xfD5BnPz+RDA==

c4CZghuHvzW9A31gEz0d

QAjzz9qyRRWBNYseAI4M

Jpbmu4A1YvBvN3ruZgiRmJA5BCFd

PfoFXGNFhhuX8Trz

bqCfk0m8ApAl+Tm1Ms5Tb23IT7tS

z7INff7HNALxc5HWq2/ftrVR6A7R1zvTUQ==

m7IShV4LSFxbqxhrVsZ1Ig==

BHRp7q0gtoRuqBRnVsZ1Ig==

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Executes dropped EXE 2 IoCs

Processes:

ttwutb.exettwutb.exe

pid process

1400 ttwutb.exe
3480 ttwutb.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

ttwutb.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation ttwutb.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
1400	ttwutb.exe
3480	ttwutb.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	ttwutb.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

ttwutb.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rxbbmtrp = "C:\\Users\\Admin\\AppData\\Roaming\\tggsconknigc\\wdvr.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\ttwutb.exe\" C:\\Users\\Admin\\AppData\\Local\\T"	ttwutb.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

ttwutb.exettwutb.execmd.exe

description	pid	process	target process
PID 1400 set thread context of 3480	1400	ttwutb.exe	ttwutb.exe
PID 3480 set thread context of 1192	3480	ttwutb.exe	Explorer.EXE
PID 3480 set thread context of 1192	3480	ttwutb.exe	Explorer.EXE
PID 4368 set thread context of 1192	4368	cmd.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

cmd.exe

description	ioc	process
Key created	\Registry\User\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	cmd.exe

Modifies registry class 2 IoCs

Processes:

Explorer.EXE

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 52 IoCs

Processes:

ttwutb.execmd.exe

pid	process
3480	ttwutb.exe
3480	ttwutb.exe
3480	ttwutb.exe
3480	ttwutb.exe
3480	ttwutb.exe
3480	ttwutb.exe
3480	ttwutb.exe
3480	ttwutb.exe
3480	ttwutb.exe
3480	ttwutb.exe
4368	cmd.exe
4368	cmd.exe
4368	cmd.exe
4368	cmd.exe
4368	cmd.exe
4368	cmd.exe
4368	cmd.exe
4368	cmd.exe
4368	cmd.exe
4368	cmd.exe
4368	cmd.exe
4368	cmd.exe
4368	cmd.exe
4368	cmd.exe
4368	cmd.exe
4368	cmd.exe
4368	cmd.exe
4368	cmd.exe
4368	cmd.exe
4368	cmd.exe
4368	cmd.exe
4368	cmd.exe
4368	cmd.exe
4368	cmd.exe
4368	cmd.exe
4368	cmd.exe
4368	cmd.exe
4368	cmd.exe
4368	cmd.exe
4368	cmd.exe
4368	cmd.exe
4368	cmd.exe
4368	cmd.exe
4368	cmd.exe
4368	cmd.exe
4368	cmd.exe
4368	cmd.exe
4368	cmd.exe
4368	cmd.exe
4368	cmd.exe
4368	cmd.exe
4368	cmd.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1192 Explorer.EXE
Suspicious behavior: MapViewOfSection 9 IoCs

Processes:

ttwutb.exettwutb.execmd.exe

pid process

1400 ttwutb.exe
3480 ttwutb.exe
3480 ttwutb.exe
3480 ttwutb.exe
3480 ttwutb.exe
4368 cmd.exe
4368 cmd.exe
4368 cmd.exe
4368 cmd.exe

pid	process
1192	Explorer.EXE

pid	process
1400	ttwutb.exe
3480	ttwutb.exe
3480	ttwutb.exe
3480	ttwutb.exe
3480	ttwutb.exe
4368	cmd.exe
4368	cmd.exe
4368	cmd.exe
4368	cmd.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

Processes:

ttwutb.execmd.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	3480	ttwutb.exe
Token: SeDebugPrivilege	4368	cmd.exe
Token: SeShutdownPrivilege	1192	Explorer.EXE
Token: SeCreatePagefilePrivilege	1192	Explorer.EXE
Token: SeShutdownPrivilege	1192	Explorer.EXE
Token: SeCreatePagefilePrivilege	1192	Explorer.EXE
Token: SeShutdownPrivilege	1192	Explorer.EXE
Token: SeCreatePagefilePrivilege	1192	Explorer.EXE
Token: SeShutdownPrivilege	1192	Explorer.EXE
Token: SeCreatePagefilePrivilege	1192	Explorer.EXE
Token: SeShutdownPrivilege	1192	Explorer.EXE
Token: SeCreatePagefilePrivilege	1192	Explorer.EXE
Token: SeShutdownPrivilege	1192	Explorer.EXE
Token: SeCreatePagefilePrivilege	1192	Explorer.EXE

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

Consignment Notification- 705643291.exettwutb.exettwutb.exeExplorer.EXEcmd.exe

description	pid	process	target process
PID 372 wrote to memory of 1400	372	Consignment Notification- 705643291.exe	ttwutb.exe
PID 372 wrote to memory of 1400	372	Consignment Notification- 705643291.exe	ttwutb.exe
PID 372 wrote to memory of 1400	372	Consignment Notification- 705643291.exe	ttwutb.exe
PID 1400 wrote to memory of 3480	1400	ttwutb.exe	ttwutb.exe
PID 1400 wrote to memory of 3480	1400	ttwutb.exe	ttwutb.exe
PID 1400 wrote to memory of 3480	1400	ttwutb.exe	ttwutb.exe
PID 1400 wrote to memory of 3480	1400	ttwutb.exe	ttwutb.exe
PID 3480 wrote to memory of 4368	3480	ttwutb.exe	cmd.exe
PID 3480 wrote to memory of 4368	3480	ttwutb.exe	cmd.exe
PID 3480 wrote to memory of 4368	3480	ttwutb.exe	cmd.exe
PID 1192 wrote to memory of 3948	1192	Explorer.EXE	control.exe
PID 1192 wrote to memory of 3948	1192	Explorer.EXE	control.exe
PID 1192 wrote to memory of 3948	1192	Explorer.EXE	control.exe
PID 4368 wrote to memory of 4696	4368	cmd.exe	Firefox.exe
PID 4368 wrote to memory of 4696	4368	cmd.exe	Firefox.exe
PID 4368 wrote to memory of 4696	4368	cmd.exe	Firefox.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1192

C:\Users\Admin\AppData\Local\Temp\Consignment Notification- 705643291.exe
"C:\Users\Admin\AppData\Local\Temp\Consignment Notification- 705643291.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:372

C:\Users\Admin\AppData\Local\Temp\ttwutb.exe
"C:\Users\Admin\AppData\Local\Temp\ttwutb.exe" C:\Users\Admin\AppData\Local\Temp\afoqzcrkmi.d
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1400

C:\Users\Admin\AppData\Local\Temp\ttwutb.exe
"C:\Users\Admin\AppData\Local\Temp\ttwutb.exe"
4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3480

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
5⤵
PID:1728

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\SysWOW64\cmd.exe"
5⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4368

C:\Program Files\Mozilla Firefox\Firefox.exe
"C:\Program Files\Mozilla Firefox\Firefox.exe"
6⤵
PID:4696

C:\Windows\SysWOW64\control.exe
"C:\Windows\SysWOW64\control.exe"
2⤵
PID:3948

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\afoqzcrkmi.d
Filesize
7KB

MD5
a5a31e3a62c832cb29d0bd27f3f42e8f

SHA1
303acc0d5a2b69ce4e6c5237461db0a2735339c4

SHA256
c89f088d54d301f9cc16c0380610ebacfd6152d243588aa114846823860a3cc6

SHA512
bca692d56f5273c69b927fccc08791e22732909cfe77b81d0f10cf11aee4f94f1c73922a370cabc009b3b516c0c6cc5e538d0bb11e03e5d84ef66f31079f993b

Download Submit
C:\Users\Admin\AppData\Local\Temp\asbvcpwfsu.nzh
Filesize
185KB

MD5
0c54a02e01b246d54a350c2421a9978e

SHA1
18d49d992eef55a62d8c1b48ddf32ae21c7bdfe8

SHA256
999741981cec391c06e6ac4b5e33168e5f04e4f1340d64c7f74d2456ab01565e

SHA512
6ecc204cc6b8434dedeae9682728d441a461123619c005204c0f30fb3f2d3a56501bcdd67df6ed7e1ca773fc1b36ad525bb747b2c4d3d7c0b62ae0c9c5ade918

Download Submit
C:\Users\Admin\AppData\Local\Temp\ttwutb.exe
Filesize
12KB

MD5
aafd9dbfd8f3255c05ed6a4a2e9cdaaf

SHA1
c3fdbb2b60791515f63e65a36b07a9d1904f6957

SHA256
0effb6bcc873119c07e3a4544297b28da24e5cb1e64567998b4a6ccd46bd2da6

SHA512
9025bb8df8f06ea2378040655717d9d367a0b8c827f31c337cc6430683b169b4c2b70cf82cd247fa6534e2759424902dfc70f70e6c7a8cb8189ce94d7ca1bbc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\ttwutb.exe
Filesize
12KB

MD5
aafd9dbfd8f3255c05ed6a4a2e9cdaaf

SHA1
c3fdbb2b60791515f63e65a36b07a9d1904f6957

SHA256
0effb6bcc873119c07e3a4544297b28da24e5cb1e64567998b4a6ccd46bd2da6

SHA512
9025bb8df8f06ea2378040655717d9d367a0b8c827f31c337cc6430683b169b4c2b70cf82cd247fa6534e2759424902dfc70f70e6c7a8cb8189ce94d7ca1bbc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\ttwutb.exe
Filesize
12KB

MD5
aafd9dbfd8f3255c05ed6a4a2e9cdaaf

SHA1
c3fdbb2b60791515f63e65a36b07a9d1904f6957

SHA256
0effb6bcc873119c07e3a4544297b28da24e5cb1e64567998b4a6ccd46bd2da6

SHA512
9025bb8df8f06ea2378040655717d9d367a0b8c827f31c337cc6430683b169b4c2b70cf82cd247fa6534e2759424902dfc70f70e6c7a8cb8189ce94d7ca1bbc5

Download Submit
memory/1192-143-0x00000000081B0000-0x0000000008297000-memory.dmp

Filesize
924KB

Download
memory/1192-155-0x0000000008A60000-0x0000000008BD6000-memory.dmp

Filesize
1.5MB

Download
memory/1192-153-0x0000000008A60000-0x0000000008BD6000-memory.dmp

Filesize
1.5MB

Download
memory/1192-145-0x00000000082A0000-0x00000000083FB000-memory.dmp

Filesize
1.4MB

Download
memory/1400-132-0x0000000000000000-mapping.dmp

Download
memory/3480-144-0x0000000001360000-0x0000000001370000-memory.dmp

Filesize
64KB

Download
memory/3480-139-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3480-141-0x0000000000FD0000-0x000000000131A000-memory.dmp

Filesize
3.3MB

Download
memory/3480-140-0x0000000000401000-0x000000000042F000-memory.dmp

Filesize
184KB

Download
memory/3480-146-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3480-147-0x0000000000401000-0x000000000042F000-memory.dmp

Filesize
184KB

Download
memory/3480-137-0x0000000000000000-mapping.dmp

Download
memory/3480-142-0x0000000000A80000-0x0000000000A90000-memory.dmp

Filesize
64KB

Download
memory/4368-149-0x00000000005F0000-0x000000000064A000-memory.dmp

Filesize
360KB

Download
memory/4368-151-0x00000000011B0000-0x00000000014FA000-memory.dmp

Filesize
3.3MB

Download
memory/4368-152-0x0000000000FD0000-0x000000000105F000-memory.dmp

Filesize
572KB

Download
memory/4368-150-0x0000000000580000-0x00000000005AD000-memory.dmp

Filesize
180KB

Download
memory/4368-154-0x0000000000580000-0x00000000005AD000-memory.dmp

Filesize
180KB

Download
memory/4368-148-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads