formbook | c8517f6c638a7d458d5dc46ba0c8b62c22165996339338788f9632cba03570c5

General

Target

71084394.exe
Size

340KB
MD5

071d5dc67ed8f6be856d7f23d77382fc
SHA1

66f71f1f920899aaffe32f996f25df8c031cbd8a
SHA256

c8517f6c638a7d458d5dc46ba0c8b62c22165996339338788f9632cba03570c5
SHA512

973b2c8a59dda6d40e75d45fabc72e9b0679373f604267837854d6ff8f6ecb4f02b855ab3210ca6b49f6315cdac69666d788f01cc60fd5d99fa638a16afa5b0e
SSDEEP

6144:9kwu1ri9AcbfpzRnOa4YS+UYzzrgezsk4VUIE6Xfjh8o/Y7qAKTFtsY7eREBOd:61riiODTUU1AUIE6XfT/CKRmfeBOd

Score

10^/10

formbook yurm persistence rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

yurm

Decoy

X06d1tis1GUX/R0g87Ud

BKiZ33D1P766GVXO1ZwV

lAFdjB7CSxGX8Trz

Gc7dWizTVxWX8Trz

tDkr9JAfi1OHAW1PGOageIp4

bCpMtHKU3mVp8BY5sQ==

7WKpsMWt8nsrhJClJeOZNg==

0A9KTlETQ86Cmd8k0o5NP5RwCg==

aJ61paNJztSp42c=

CrgoA8ySIOsytCbO1ZwV

i46SnHYDD9tTIHI=

XFRCRCjtFZeU3x4Rn3xfD5BnPz+RDA==

c4CZghuHvzW9A31gEz0d

QAjzz9qyRRWBNYseAI4M

Jpbmu4A1YvBvN3ruZgiRmJA5BCFd

PfoFXGNFhhuX8Trz

bqCfk0m8ApAl+Tm1Ms5Tb23IT7tS

z7INff7HNALxc5HWq2/ftrVR6A7R1zvTUQ==

m7IShV4LSFxbqxhrVsZ1Ig==

BHRp7q0gtoRuqBRnVsZ1Ig==

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Blocklisted process makes network request 1 IoCs

Processes:

wscript.exe

flow pid process

7 748 wscript.exe
Executes dropped EXE 2 IoCs

Processes:

cwjtwgru.execwjtwgru.exe

pid process

932 cwjtwgru.exe
1000 cwjtwgru.exe

flow	pid	process
7	748	wscript.exe

pid	process
932	cwjtwgru.exe
1000	cwjtwgru.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

cwjtwgru.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\International\Geo\Nation	cwjtwgru.exe

Loads dropped DLL 3 IoCs

Processes:

71084394.execwjtwgru.exewscript.exe

pid process

1520 71084394.exe
932 cwjtwgru.exe
748 wscript.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
1520	71084394.exe
932	cwjtwgru.exe
748	wscript.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

cwjtwgru.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\frcjbs = "C:\\Users\\Admin\\AppData\\Roaming\\oodcsfypml\\gqbi.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\cwjtwgru.exe\" C:\\Users\\Admin\\AppData\\Local\\T"	cwjtwgru.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

cwjtwgru.execwjtwgru.exewscript.exe

description	pid	process	target process
PID 932 set thread context of 1000	932	cwjtwgru.exe	cwjtwgru.exe
PID 1000 set thread context of 1272	1000	cwjtwgru.exe	Explorer.EXE
PID 748 set thread context of 1272	748	wscript.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

wscript.exe

description	ioc	process
Key created	\Registry\User\S-1-5-21-3385717845-2518323428-350143044-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	wscript.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

Processes:

cwjtwgru.exewscript.exe

pid	process
1000	cwjtwgru.exe
1000	cwjtwgru.exe
1000	cwjtwgru.exe
1000	cwjtwgru.exe
748	wscript.exe
748	wscript.exe
748	wscript.exe
748	wscript.exe
748	wscript.exe
748	wscript.exe
748	wscript.exe
748	wscript.exe
748	wscript.exe
748	wscript.exe
748	wscript.exe
748	wscript.exe
748	wscript.exe
748	wscript.exe
748	wscript.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1272 Explorer.EXE
Suspicious behavior: MapViewOfSection 8 IoCs

Processes:

cwjtwgru.execwjtwgru.exewscript.exe

pid process

932 cwjtwgru.exe
1000 cwjtwgru.exe
1000 cwjtwgru.exe
1000 cwjtwgru.exe
748 wscript.exe
748 wscript.exe
748 wscript.exe
748 wscript.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

cwjtwgru.exewscript.exeExplorer.EXE

description pid process

Token: SeDebugPrivilege 1000 cwjtwgru.exe
Token: SeDebugPrivilege 748 wscript.exe
Token: SeShutdownPrivilege 1272 Explorer.EXE
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1272 Explorer.EXE
1272 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1272 Explorer.EXE
1272 Explorer.EXE

pid	process
1272	Explorer.EXE

pid	process
932	cwjtwgru.exe
1000	cwjtwgru.exe
1000	cwjtwgru.exe
1000	cwjtwgru.exe
748	wscript.exe
748	wscript.exe
748	wscript.exe
748	wscript.exe

description	pid	process
Token: SeDebugPrivilege	1000	cwjtwgru.exe
Token: SeDebugPrivilege	748	wscript.exe
Token: SeShutdownPrivilege	1272	Explorer.EXE

pid	process
1272	Explorer.EXE
1272	Explorer.EXE

pid	process
1272	Explorer.EXE
1272	Explorer.EXE

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

71084394.execwjtwgru.exeExplorer.EXEwscript.exe

description	pid	process	target process
PID 1520 wrote to memory of 932	1520	71084394.exe	cwjtwgru.exe
PID 1520 wrote to memory of 932	1520	71084394.exe	cwjtwgru.exe
PID 1520 wrote to memory of 932	1520	71084394.exe	cwjtwgru.exe
PID 1520 wrote to memory of 932	1520	71084394.exe	cwjtwgru.exe
PID 932 wrote to memory of 1000	932	cwjtwgru.exe	cwjtwgru.exe
PID 932 wrote to memory of 1000	932	cwjtwgru.exe	cwjtwgru.exe
PID 932 wrote to memory of 1000	932	cwjtwgru.exe	cwjtwgru.exe
PID 932 wrote to memory of 1000	932	cwjtwgru.exe	cwjtwgru.exe
PID 932 wrote to memory of 1000	932	cwjtwgru.exe	cwjtwgru.exe
PID 1272 wrote to memory of 748	1272	Explorer.EXE	wscript.exe
PID 1272 wrote to memory of 748	1272	Explorer.EXE	wscript.exe
PID 1272 wrote to memory of 748	1272	Explorer.EXE	wscript.exe
PID 1272 wrote to memory of 748	1272	Explorer.EXE	wscript.exe
PID 748 wrote to memory of 428	748	wscript.exe	Firefox.exe
PID 748 wrote to memory of 428	748	wscript.exe	Firefox.exe
PID 748 wrote to memory of 428	748	wscript.exe	Firefox.exe
PID 748 wrote to memory of 428	748	wscript.exe	Firefox.exe
PID 748 wrote to memory of 428	748	wscript.exe	Firefox.exe

C:\Users\Admin\AppData\Local\Temp\71084394.exe
"C:\Users\Admin\AppData\Local\Temp\71084394.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Users\Admin\AppData\Local\Temp\cwjtwgru.exe
  "C:\Users\Admin\AppData\Local\Temp\cwjtwgru.exe" C:\Users\Admin\AppData\Local\Temp\rrexulxkwf.e
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:932
- - C:\Users\Admin\AppData\Local\Temp\cwjtwgru.exe
    "C:\Users\Admin\AppData\Local\Temp\cwjtwgru.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:1000

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1272
- C:\Windows\SysWOW64\wscript.exe
  "C:\Windows\SysWOW64\wscript.exe"
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:748
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:428

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cwjtwgru.exe

Filesize
287KB

MD5
dbcbf8f0ed1c6516183140ec6b43cb70

SHA1
86592b028bdea04cc22f7719d9b1ad056111a206

SHA256
3ca4fd53d2bf04262bc4c73f1daac1840dfd569902866d02ff0105496d66dad4

SHA512
2a81002fa5aa7f128f2b2a7c58b2771ebd8972df34a052461160bd413fb441d0f09bf10e6f87387097190be2151417d10f5fa91c3e3d7703d582186fac504e9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\cwjtwgru.exe

Filesize
287KB

MD5
dbcbf8f0ed1c6516183140ec6b43cb70

SHA1
86592b028bdea04cc22f7719d9b1ad056111a206

SHA256
3ca4fd53d2bf04262bc4c73f1daac1840dfd569902866d02ff0105496d66dad4

SHA512
2a81002fa5aa7f128f2b2a7c58b2771ebd8972df34a052461160bd413fb441d0f09bf10e6f87387097190be2151417d10f5fa91c3e3d7703d582186fac504e9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\cwjtwgru.exe

Filesize
287KB

MD5
dbcbf8f0ed1c6516183140ec6b43cb70

SHA1
86592b028bdea04cc22f7719d9b1ad056111a206

SHA256
3ca4fd53d2bf04262bc4c73f1daac1840dfd569902866d02ff0105496d66dad4

SHA512
2a81002fa5aa7f128f2b2a7c58b2771ebd8972df34a052461160bd413fb441d0f09bf10e6f87387097190be2151417d10f5fa91c3e3d7703d582186fac504e9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\rrexulxkwf.e

Filesize
7KB

MD5
f13ad12221d1e97b4d65bf2e53b1f402

SHA1
9c6dfd899bec615fdea6f4e2b962068aab6c4988

SHA256
cb5c32c1b652404386ab6ff840c7eb441b011fbc0c2394fca6204de86f214235

SHA512
ebc39cb6786e5f26d22b0234adf88dd927ce484983f38c923dff3202079c983ecc05d7f5ac0cd1d77b7df50697b952792be8ea73a0e762bf7fb8895fb7d4a93d

Download Submit
C:\Users\Admin\AppData\Local\Temp\tdyiryx.q

Filesize
185KB

MD5
cf0334f289bbb9d291df245b50345a61

SHA1
31089abeebfd120069ff4431ec58dc3f845345db

SHA256
9b2dce356e0b291300995dd2960eb5031d27165879b8c48fa263a83a1f617216

SHA512
a3da13f1323313bc486c7deea72ee37d55a6584a5f43912dd735248371fdb8d81fa9d0d83bcdb3d8fb2e02aa6514bf500c4204614e656dd9cbd2c2c11e5b895f

Download Submit
\Users\Admin\AppData\Local\Temp\cwjtwgru.exe

Filesize
287KB

MD5
dbcbf8f0ed1c6516183140ec6b43cb70

SHA1
86592b028bdea04cc22f7719d9b1ad056111a206

SHA256
3ca4fd53d2bf04262bc4c73f1daac1840dfd569902866d02ff0105496d66dad4

SHA512
2a81002fa5aa7f128f2b2a7c58b2771ebd8972df34a052461160bd413fb441d0f09bf10e6f87387097190be2151417d10f5fa91c3e3d7703d582186fac504e9b

Download Submit
\Users\Admin\AppData\Local\Temp\cwjtwgru.exe

Filesize
287KB

MD5
dbcbf8f0ed1c6516183140ec6b43cb70

SHA1
86592b028bdea04cc22f7719d9b1ad056111a206

SHA256
3ca4fd53d2bf04262bc4c73f1daac1840dfd569902866d02ff0105496d66dad4

SHA512
2a81002fa5aa7f128f2b2a7c58b2771ebd8972df34a052461160bd413fb441d0f09bf10e6f87387097190be2151417d10f5fa91c3e3d7703d582186fac504e9b

Download Submit
\Users\Admin\AppData\Local\Temp\sqlite3.dll

Filesize
832KB

MD5
07fb6d31f37fb1b4164bef301306c288

SHA1
4cb41af6d63a07324ef6b18b1a1f43ce94e25626

SHA256
06ddf0a370af00d994824605a8e1307ba138f89b2d864539f0d19e8804edac02

SHA512
cab4a7c5805b80851aba5f2c9b001fabc1416f6648d891f49eacc81fe79287c5baa01306a42298da722750b812a4ea85388ffae9200dcf656dd1d5b5b9323353

Download Submit
memory/748-73-0x00000000020B0000-0x00000000023B3000-memory.dmp

Filesize
3.0MB

Download
memory/748-70-0x0000000000000000-mapping.dmp

Download
memory/748-76-0x0000000000070000-0x000000000009D000-memory.dmp

Filesize
180KB

Download
memory/748-74-0x0000000000980000-0x0000000000A0F000-memory.dmp

Filesize
572KB

Download
memory/748-72-0x0000000000070000-0x000000000009D000-memory.dmp

Filesize
180KB

Download
memory/748-71-0x0000000000AF0000-0x0000000000B16000-memory.dmp

Filesize
152KB

Download
memory/932-56-0x0000000000000000-mapping.dmp

Download
memory/1000-67-0x00000000008A0000-0x0000000000BA3000-memory.dmp

Filesize
3.0MB

Download
memory/1000-68-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/1000-63-0x00000000004012B0-mapping.dmp

Download
memory/1000-66-0x0000000000401000-0x000000000042F000-memory.dmp

Filesize
184KB

Download
memory/1000-65-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1272-69-0x0000000004AB0000-0x0000000004BCE000-memory.dmp

Filesize
1.1MB

Download
memory/1272-75-0x0000000002AE0000-0x0000000002BC6000-memory.dmp

Filesize
920KB

Download
memory/1272-77-0x0000000002AE0000-0x0000000002BC6000-memory.dmp

Filesize
920KB

Download
memory/1520-54-0x0000000075C81000-0x0000000075C83000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads