formbook | f713783b78488d6997250029c2cc9c506b38c96a1198cd0fdc263fc1ed85d4ae

General

Target

d4540b3b4445dca1814c5489568883e4f7e7ae889d39f60b62e803d05ed5418a.exe
Size

246KB
MD5

18f4957244bc049d56a80817e78da201
SHA1

a8dd8602f604e5b33b4e21c157cd23a084218d62
SHA256

d4540b3b4445dca1814c5489568883e4f7e7ae889d39f60b62e803d05ed5418a
SHA512

75ae534cca9e219288ff02b391b2995f9c49f82b406c86b3554a78cecaabed4c84b473137241ed08aea3894f25d6fc5d2a95a1d0766ba908ac42657adf5e5336
SSDEEP

6144:KEa0i0pnITU4I9GqwmJYb3IaNDTRovITs0ZVc+oD8oA+:aynmqwmeIQTR3Ts8VcHA+

Score

10^/10

formbook fkku rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

fkku

Decoy

ItLUfbYmkw6ODl8lnvwkR/8=

oUKMUSjydqzVWxG/CqjK3ngAhQ==

HB9lfRtFwT/XlJ9Lxw==

hBYXuorq7a3WwPq1NSezCMStlQ==

ciRqfQbLgwx/+e2rLqTZ8oMLc2LYY4o=

9vb76Nc8JzKlj4YEQyPAx2dx86U=

fB9041xJgwl1

ND8juoNyH6x5XqlZ2Q==

QEaot04y8XLjFOBp1Cg=

SG6vmdmmpmFmDosczg==

WWCorUT756r1F+aD3cd7Cij6nSFQ

Yl63zVL2NnFph44XcKkiP/k=

s2RfFNOd3fuBEJNZ2ig=

u1p6Ucr2uCketwGD

0vD8lFkSfRCHEJdebbrb

qzlqgxrsrDRmDosczg==

H5aTYXc2rHXjzQ==

S/pFbexYx0S+Ex7SN5rC

9kOIkRTWkA136nA2Ua/R

ojOElJ50E1N40ZNanCbEZw==

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Executes dropped EXE 2 IoCs

Processes:

dztud.exedztud.exe

pid process

1180 dztud.exe
4688 dztud.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

dztud.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation dztud.exe

pid	process
1180	dztud.exe
4688	dztud.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	dztud.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

dztud.exedztud.exeNETSTAT.EXE

description	pid	process	target process
PID 1180 set thread context of 4688	1180	dztud.exe	dztud.exe
PID 4688 set thread context of 2664	4688	dztud.exe	Explorer.EXE
PID 4688 set thread context of 2664	4688	dztud.exe	Explorer.EXE
PID 1864 set thread context of 2664	1864	NETSTAT.EXE	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command-Line Interface
T1059

Processes:

NETSTAT.EXE

pid process

1864 NETSTAT.EXE

pid	process
1864	NETSTAT.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

NETSTAT.EXE

description	ioc	process
Key created	\Registry\User\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	NETSTAT.EXE

Suspicious behavior: EnumeratesProcesses 62 IoCs

Processes:

dztud.exeNETSTAT.EXE

pid	process
4688	dztud.exe
4688	dztud.exe
4688	dztud.exe
4688	dztud.exe
4688	dztud.exe
4688	dztud.exe
4688	dztud.exe
4688	dztud.exe
4688	dztud.exe
4688	dztud.exe
1864	NETSTAT.EXE
1864	NETSTAT.EXE
1864	NETSTAT.EXE
1864	NETSTAT.EXE
1864	NETSTAT.EXE
1864	NETSTAT.EXE
1864	NETSTAT.EXE
1864	NETSTAT.EXE
1864	NETSTAT.EXE
1864	NETSTAT.EXE
1864	NETSTAT.EXE
1864	NETSTAT.EXE
1864	NETSTAT.EXE
1864	NETSTAT.EXE
1864	NETSTAT.EXE
1864	NETSTAT.EXE
1864	NETSTAT.EXE
1864	NETSTAT.EXE
1864	NETSTAT.EXE
1864	NETSTAT.EXE
1864	NETSTAT.EXE
1864	NETSTAT.EXE
1864	NETSTAT.EXE
1864	NETSTAT.EXE
1864	NETSTAT.EXE
1864	NETSTAT.EXE
1864	NETSTAT.EXE
1864	NETSTAT.EXE
1864	NETSTAT.EXE
1864	NETSTAT.EXE
1864	NETSTAT.EXE
1864	NETSTAT.EXE
1864	NETSTAT.EXE
1864	NETSTAT.EXE
1864	NETSTAT.EXE
1864	NETSTAT.EXE
1864	NETSTAT.EXE
1864	NETSTAT.EXE
1864	NETSTAT.EXE
1864	NETSTAT.EXE
1864	NETSTAT.EXE
1864	NETSTAT.EXE
1864	NETSTAT.EXE
1864	NETSTAT.EXE
1864	NETSTAT.EXE
1864	NETSTAT.EXE
1864	NETSTAT.EXE
1864	NETSTAT.EXE
1864	NETSTAT.EXE
1864	NETSTAT.EXE
1864	NETSTAT.EXE
1864	NETSTAT.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

2664 Explorer.EXE
Suspicious behavior: MapViewOfSection 9 IoCs

Processes:

dztud.exedztud.exeNETSTAT.EXE

pid process

1180 dztud.exe
4688 dztud.exe
4688 dztud.exe
4688 dztud.exe
4688 dztud.exe
1864 NETSTAT.EXE
1864 NETSTAT.EXE
1864 NETSTAT.EXE
1864 NETSTAT.EXE
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

dztud.exeNETSTAT.EXE

description pid process

Token: SeDebugPrivilege 4688 dztud.exe
Token: SeDebugPrivilege 1864 NETSTAT.EXE

pid	process
2664	Explorer.EXE

pid	process
1180	dztud.exe
4688	dztud.exe
4688	dztud.exe
4688	dztud.exe
4688	dztud.exe
1864	NETSTAT.EXE
1864	NETSTAT.EXE
1864	NETSTAT.EXE
1864	NETSTAT.EXE

description	pid	process
Token: SeDebugPrivilege	4688	dztud.exe
Token: SeDebugPrivilege	1864	NETSTAT.EXE

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

d4540b3b4445dca1814c5489568883e4f7e7ae889d39f60b62e803d05ed5418a.exedztud.exeExplorer.EXENETSTAT.EXE

description	pid	process	target process
PID 4956 wrote to memory of 1180	4956	d4540b3b4445dca1814c5489568883e4f7e7ae889d39f60b62e803d05ed5418a.exe	dztud.exe
PID 4956 wrote to memory of 1180	4956	d4540b3b4445dca1814c5489568883e4f7e7ae889d39f60b62e803d05ed5418a.exe	dztud.exe
PID 4956 wrote to memory of 1180	4956	d4540b3b4445dca1814c5489568883e4f7e7ae889d39f60b62e803d05ed5418a.exe	dztud.exe
PID 1180 wrote to memory of 4688	1180	dztud.exe	dztud.exe
PID 1180 wrote to memory of 4688	1180	dztud.exe	dztud.exe
PID 1180 wrote to memory of 4688	1180	dztud.exe	dztud.exe
PID 1180 wrote to memory of 4688	1180	dztud.exe	dztud.exe
PID 2664 wrote to memory of 1864	2664	Explorer.EXE	NETSTAT.EXE
PID 2664 wrote to memory of 1864	2664	Explorer.EXE	NETSTAT.EXE
PID 2664 wrote to memory of 1864	2664	Explorer.EXE	NETSTAT.EXE
PID 1864 wrote to memory of 3472	1864	NETSTAT.EXE	Firefox.exe
PID 1864 wrote to memory of 3472	1864	NETSTAT.EXE	Firefox.exe
PID 1864 wrote to memory of 3472	1864	NETSTAT.EXE	Firefox.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2664

C:\Users\Admin\AppData\Local\Temp\d4540b3b4445dca1814c5489568883e4f7e7ae889d39f60b62e803d05ed5418a.exe
"C:\Users\Admin\AppData\Local\Temp\d4540b3b4445dca1814c5489568883e4f7e7ae889d39f60b62e803d05ed5418a.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:4956

C:\Users\Admin\AppData\Local\Temp\dztud.exe
"C:\Users\Admin\AppData\Local\Temp\dztud.exe" C:\Users\Admin\AppData\Local\Temp\foxlvd.azo
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1180

C:\Users\Admin\AppData\Local\Temp\dztud.exe
"C:\Users\Admin\AppData\Local\Temp\dztud.exe" C:\Users\Admin\AppData\Local\Temp\foxlvd.azo
4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4688

C:\Windows\SysWOW64\NETSTAT.EXE
"C:\Windows\SysWOW64\NETSTAT.EXE"
2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1864

C:\Program Files\Mozilla Firefox\Firefox.exe
"C:\Program Files\Mozilla Firefox\Firefox.exe"
3⤵
PID:3472

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\dztud.exe
Filesize
30KB

MD5
61b3304d1d4f6a61d5ab92cbe4016910

SHA1
de5b55fe477b94299297996eff913f16fe38d9cd

SHA256
b3f72f6c6580f51b78b6bb90a4aaa7c8b13699bef94f3ff619f144b9bd1b6b40

SHA512
f4f429f63cdd355133e72bb1eb31963346e1f3055c6c4fb2ea1ff8943d8408524ba0f8c25f71cda970d70b346905b5fd7b8731f567db093fa317d1737f194d91

Download Submit
C:\Users\Admin\AppData\Local\Temp\dztud.exe
Filesize
30KB

MD5
61b3304d1d4f6a61d5ab92cbe4016910

SHA1
de5b55fe477b94299297996eff913f16fe38d9cd

SHA256
b3f72f6c6580f51b78b6bb90a4aaa7c8b13699bef94f3ff619f144b9bd1b6b40

SHA512
f4f429f63cdd355133e72bb1eb31963346e1f3055c6c4fb2ea1ff8943d8408524ba0f8c25f71cda970d70b346905b5fd7b8731f567db093fa317d1737f194d91

Download Submit
C:\Users\Admin\AppData\Local\Temp\dztud.exe
Filesize
30KB

MD5
61b3304d1d4f6a61d5ab92cbe4016910

SHA1
de5b55fe477b94299297996eff913f16fe38d9cd

SHA256
b3f72f6c6580f51b78b6bb90a4aaa7c8b13699bef94f3ff619f144b9bd1b6b40

SHA512
f4f429f63cdd355133e72bb1eb31963346e1f3055c6c4fb2ea1ff8943d8408524ba0f8c25f71cda970d70b346905b5fd7b8731f567db093fa317d1737f194d91

Download Submit
C:\Users\Admin\AppData\Local\Temp\foxlvd.azo
Filesize
5KB

MD5
004294a9f4b51e40dbf7c4018524b9a7

SHA1
d7e0f3a18965d5729163471128cc6eb6e4d77409

SHA256
9eefab494a9bb92d08b0852f840e9f8c0882297e41e9c1201d5abc3cc9d643cf

SHA512
88c970982df5def42e97dd7e2f43157fd5c5018eb576c41c4c2d968bb134ae75143f587bfce49a902747168566cc64fb4285bd461b3a592ba9a9b7c5390c6c78

Download Submit
C:\Users\Admin\AppData\Local\Temp\ytvko.u
Filesize
185KB

MD5
3f7fc6e065ed10355db4f53a3ec78f1b

SHA1
df6a08a214046eddb22748e4d4ab15e3f831e32d

SHA256
6fd28b913aadcd55aa8e03bdb3671517ea41789fbdd673eed390b314fd0fcf07

SHA512
feb54b32270f5df305d9cb5044a9729d9af765c6df543e522e8a9136cac3c16670b4246042fe55f0b6aa19f38e5c3aa67f9d1d9c0e0dc35f7b487d5718c135d1

Download Submit
memory/1180-132-0x0000000000000000-mapping.dmp

Download
memory/1864-150-0x0000000000710000-0x000000000073D000-memory.dmp

Filesize
180KB

Download
memory/1864-146-0x0000000000000000-mapping.dmp

Download
memory/1864-153-0x0000000000710000-0x000000000073D000-memory.dmp

Filesize
180KB

Download
memory/1864-152-0x0000000000E90000-0x0000000000F1F000-memory.dmp

Filesize
572KB

Download
memory/1864-151-0x0000000001110000-0x000000000145A000-memory.dmp

Filesize
3.3MB

Download
memory/1864-149-0x0000000000070000-0x000000000007B000-memory.dmp

Filesize
44KB

Download
memory/2664-143-0x0000000002DE0000-0x0000000002EDB000-memory.dmp

Filesize
1004KB

Download
memory/2664-145-0x0000000007FB0000-0x000000000812D000-memory.dmp

Filesize
1.5MB

Download
memory/2664-154-0x0000000008520000-0x0000000008609000-memory.dmp

Filesize
932KB

Download
memory/2664-155-0x0000000008520000-0x0000000008609000-memory.dmp

Filesize
932KB

Download
memory/4688-144-0x0000000000D60000-0x0000000000D70000-memory.dmp

Filesize
64KB

Download
memory/4688-147-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4688-148-0x0000000000401000-0x000000000042F000-memory.dmp

Filesize
184KB

Download
memory/4688-139-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4688-137-0x0000000000000000-mapping.dmp

Download
memory/4688-142-0x0000000000D00000-0x0000000000D10000-memory.dmp

Filesize
64KB

Download
memory/4688-141-0x0000000001220000-0x000000000156A000-memory.dmp

Filesize
3.3MB

Download
memory/4688-140-0x0000000000401000-0x000000000042F000-memory.dmp

Filesize
184KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads