formbook | a4392c3be6ba337f370c0b2170bf46c6c65f0054304f355d40b0b7fffec718e4

General

Target

hbuIgEcnzT30Uma.exe
Size

828KB
MD5

0e3d9093a78c09e35a878781b8324dce
SHA1

8edccec93f1f626b72794d41308dc019d79c361b
SHA256

a4392c3be6ba337f370c0b2170bf46c6c65f0054304f355d40b0b7fffec718e4
SHA512

cecdd4049457492d7c564d3180e9ad791f574291fb19575fdbc5ef1bac382492c99a215c2dd1a9ce5dbc1c1c90ed7bc3033988536b56d8198f45deddd7d6923b
SSDEEP

12288:JYCcinkg586aWHffUlllYUJ1Q0ydOML09Vjc4eEWBd9njk/:WCZnB5O8fUlQoyVWWVJ+

Score

10^/10

formbook bmr1 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

bmr1

Decoy

q05YNsJC4MpYLGAf4A==

6KUzKCvwX0fwzrFQXvlucw==

KA4ZibW1w+hWN5Q=

TfgNq18tIWtsM7h+DexncQ==

zspNqjUKBdJVHTkiMMXJYeF7G53bVvMPoA==

hopQr+b8KzPIbMWvw0Yxir6cyw==

2thmt+17FR/MVsakbM/+w3xGOhopJw==

5gO5gfA6jwna/4FNSPqrvvHyr2A=

kqtr0wr9KaOXVMyDDexncQ==

PNldyz0Boa5cLGAf4A==

Gysor7fqabd0UzTwWp3Zir6cyw==

pMRgV18gtLorB21prX4=

ukpf+vu2u+hWN5Q=

pcS/rO+KmPMj69G9cMHnoSEm59cbIQ==

4fWGzv347bFNDYJeeIHKG5co

WXlRyM2Yn+4Ab1EgRAFHWdGDCzf1

ZPoM+2U1cwMzteOBsHY=

o8jQoNron4sT3A/KomE=

7QX8tTpv/A+YKw==

wFvmV8SY/A+YKw==

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

hbuIgEcnzT30Uma.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	hbuIgEcnzT30Uma.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

hbuIgEcnzT30Uma.exehbuIgEcnzT30Uma.exehelp.exe

description	pid	process	target process
PID 4072 set thread context of 5036	4072	hbuIgEcnzT30Uma.exe	hbuIgEcnzT30Uma.exe
PID 5036 set thread context of 2684	5036	hbuIgEcnzT30Uma.exe	Explorer.EXE
PID 844 set thread context of 2684	844	help.exe	Explorer.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

help.exe

description	ioc	process
Key created	\Registry\User\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	help.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

Processes:

hbuIgEcnzT30Uma.exehelp.exe

pid	process
5036	hbuIgEcnzT30Uma.exe
5036	hbuIgEcnzT30Uma.exe
5036	hbuIgEcnzT30Uma.exe
5036	hbuIgEcnzT30Uma.exe
5036	hbuIgEcnzT30Uma.exe
5036	hbuIgEcnzT30Uma.exe
5036	hbuIgEcnzT30Uma.exe
5036	hbuIgEcnzT30Uma.exe
844	help.exe
844	help.exe
844	help.exe
844	help.exe
844	help.exe
844	help.exe
844	help.exe
844	help.exe
844	help.exe
844	help.exe
844	help.exe
844	help.exe
844	help.exe
844	help.exe
844	help.exe
844	help.exe
844	help.exe
844	help.exe
844	help.exe
844	help.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

2684 Explorer.EXE
Suspicious behavior: MapViewOfSection 7 IoCs

Processes:

hbuIgEcnzT30Uma.exehelp.exe

pid process

5036 hbuIgEcnzT30Uma.exe
5036 hbuIgEcnzT30Uma.exe
5036 hbuIgEcnzT30Uma.exe
844 help.exe
844 help.exe
844 help.exe
844 help.exe

pid	process
2684	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

hbuIgEcnzT30Uma.exeExplorer.EXEhelp.exe

description	pid	process
Token: SeDebugPrivilege	5036	hbuIgEcnzT30Uma.exe
Token: SeShutdownPrivilege	2684	Explorer.EXE
Token: SeCreatePagefilePrivilege	2684	Explorer.EXE
Token: SeShutdownPrivilege	2684	Explorer.EXE
Token: SeCreatePagefilePrivilege	2684	Explorer.EXE
Token: SeDebugPrivilege	844	help.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

hbuIgEcnzT30Uma.exeExplorer.EXEhelp.exe

description	pid	process	target process
PID 4072 wrote to memory of 5036	4072	hbuIgEcnzT30Uma.exe	hbuIgEcnzT30Uma.exe
PID 4072 wrote to memory of 5036	4072	hbuIgEcnzT30Uma.exe	hbuIgEcnzT30Uma.exe
PID 4072 wrote to memory of 5036	4072	hbuIgEcnzT30Uma.exe	hbuIgEcnzT30Uma.exe
PID 4072 wrote to memory of 5036	4072	hbuIgEcnzT30Uma.exe	hbuIgEcnzT30Uma.exe
PID 4072 wrote to memory of 5036	4072	hbuIgEcnzT30Uma.exe	hbuIgEcnzT30Uma.exe
PID 4072 wrote to memory of 5036	4072	hbuIgEcnzT30Uma.exe	hbuIgEcnzT30Uma.exe
PID 2684 wrote to memory of 844	2684	Explorer.EXE	help.exe
PID 2684 wrote to memory of 844	2684	Explorer.EXE	help.exe
PID 2684 wrote to memory of 844	2684	Explorer.EXE	help.exe
PID 844 wrote to memory of 4504	844	help.exe	Firefox.exe
PID 844 wrote to memory of 4504	844	help.exe	Firefox.exe
PID 844 wrote to memory of 4504	844	help.exe	Firefox.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2684

C:\Users\Admin\AppData\Local\Temp\hbuIgEcnzT30Uma.exe
"C:\Users\Admin\AppData\Local\Temp\hbuIgEcnzT30Uma.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4072

C:\Users\Admin\AppData\Local\Temp\hbuIgEcnzT30Uma.exe
"C:\Users\Admin\AppData\Local\Temp\hbuIgEcnzT30Uma.exe"
3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:5036

C:\Windows\SysWOW64\help.exe
"C:\Windows\SysWOW64\help.exe"
2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:844

C:\Program Files\Mozilla Firefox\Firefox.exe
"C:\Program Files\Mozilla Firefox\Firefox.exe"
3⤵
PID:4504

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/844-149-0x0000000000520000-0x0000000000527000-memory.dmp

Filesize
28KB

Download
memory/844-150-0x0000000000DE0000-0x000000000112A000-memory.dmp

Filesize
3.3MB

Download
memory/844-146-0x0000000000000000-mapping.dmp

Download
memory/844-151-0x00000000005C0000-0x00000000005ED000-memory.dmp

Filesize
180KB

Download
memory/844-152-0x0000000001130000-0x00000000011BF000-memory.dmp

Filesize
572KB

Download
memory/844-154-0x00000000005C0000-0x00000000005ED000-memory.dmp

Filesize
180KB

Download
memory/2684-155-0x0000000007950000-0x0000000007A88000-memory.dmp

Filesize
1.2MB

Download
memory/2684-153-0x0000000007950000-0x0000000007A88000-memory.dmp

Filesize
1.2MB

Download
memory/2684-145-0x00000000077C0000-0x0000000007941000-memory.dmp

Filesize
1.5MB

Download
memory/4072-132-0x0000000000380000-0x0000000000456000-memory.dmp

Filesize
856KB

Download
memory/4072-136-0x0000000009140000-0x00000000091DC000-memory.dmp

Filesize
624KB

Download
memory/4072-135-0x0000000004F90000-0x0000000004F9A000-memory.dmp

Filesize
40KB

Download
memory/4072-134-0x0000000004EA0000-0x0000000004F32000-memory.dmp

Filesize
584KB

Download
memory/4072-133-0x0000000005450000-0x00000000059F4000-memory.dmp

Filesize
5.6MB

Download
memory/5036-137-0x0000000000000000-mapping.dmp

Download
memory/5036-147-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5036-148-0x0000000000401000-0x000000000042F000-memory.dmp

Filesize
184KB

Download
memory/5036-144-0x0000000000DF0000-0x0000000000E00000-memory.dmp

Filesize
64KB

Download
memory/5036-143-0x0000000001670000-0x00000000019BA000-memory.dmp

Filesize
3.3MB

Download
memory/5036-141-0x0000000000401000-0x000000000042F000-memory.dmp

Filesize
184KB

Download
memory/5036-140-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5036-138-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads