formbook | 7c0561d38ad8d30935cc4750ef54f86ae0e8fedd0858278b6a202cf9589ae4d5

General

Target

3b33c707e522fc9e706c62687387ddbc.exe
Size

336KB
MD5

3b33c707e522fc9e706c62687387ddbc
SHA1

d98eb37e12d6d7b03fd94933ab5f7dc445c67477
SHA256

7c0561d38ad8d30935cc4750ef54f86ae0e8fedd0858278b6a202cf9589ae4d5
SHA512

7591fdefeff5a11fea8726d784a62229de33378f54cd27841647c53983fca87f055e40f6743bd62d7bb0493bd11b4d3a4c19529f890d924f6872d804b19c8695
SSDEEP

6144:9kwOU0Tna911TEwbdaqga1lpGC1xA67/jYUUEU6LrgJxet8ZJ8EGlu:Cf41y3ajpPA678UrU6LrgfeU8EGY

Score

10^/10

formbook ctap rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

ctap

Decoy

7fuiHU5O7pBugItrXtDlRbQzVNAypQ==

Ioe4Ezkvrkk5SljtGsXC

7SdYmzWqxYzoB10eYg==

87z12VKpqmy0nXHtGsXC

frPRoZR38nhTXl/tGsXC

JybcU3xwAWn21yEPd4XnKA==

B6LTKeV3SeQZAg==

9iFOJSEVtE+I6ea4tn6M72ANGm3K

bROuHdVCVl63QIZuI2etey+ugP0=

25FDh/Be3fhaReK+BwZm9aY+og==

ipYbazKawI7oB10eYg==

Y3ONgI2GHcStmm5WhEZCsE/GlNJovg==

NMjp1U2zzpPoB10eYg==

ZZOygHxoGkBxNTz1RnI=

Hy1dkswBcyQh

94qXZbB1+8ciD4Q=

JUhyQ8Fxl+4gBA==

7wuj4eTJFutgR7+k1R8mIA==

Nj3QJ1RBulY2AMS/1R8mIA==

LjFXk8zI5vgdq8N6ropiNA==

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Executes dropped EXE 2 IoCs

Processes:

pxzpa.exepxzpa.exe

pid process

5072 pxzpa.exe
2800 pxzpa.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

pxzpa.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation pxzpa.exe

pid	process
5072	pxzpa.exe
2800	pxzpa.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	pxzpa.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

pxzpa.exepxzpa.exeraserver.exe

description	pid	process	target process
PID 5072 set thread context of 2800	5072	pxzpa.exe	pxzpa.exe
PID 2800 set thread context of 3044	2800	pxzpa.exe	Explorer.EXE
PID 2980 set thread context of 3044	2980	raserver.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

raserver.exe

description	ioc	process
Key created	\Registry\User\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	raserver.exe

Suspicious behavior: EnumeratesProcesses 60 IoCs

Processes:

pxzpa.exeraserver.exe

pid	process
2800	pxzpa.exe
2800	pxzpa.exe
2800	pxzpa.exe
2800	pxzpa.exe
2800	pxzpa.exe
2800	pxzpa.exe
2800	pxzpa.exe
2800	pxzpa.exe
2980	raserver.exe
2980	raserver.exe
2980	raserver.exe
2980	raserver.exe
2980	raserver.exe
2980	raserver.exe
2980	raserver.exe
2980	raserver.exe
2980	raserver.exe
2980	raserver.exe
2980	raserver.exe
2980	raserver.exe
2980	raserver.exe
2980	raserver.exe
2980	raserver.exe
2980	raserver.exe
2980	raserver.exe
2980	raserver.exe
2980	raserver.exe
2980	raserver.exe
2980	raserver.exe
2980	raserver.exe
2980	raserver.exe
2980	raserver.exe
2980	raserver.exe
2980	raserver.exe
2980	raserver.exe
2980	raserver.exe
2980	raserver.exe
2980	raserver.exe
2980	raserver.exe
2980	raserver.exe
2980	raserver.exe
2980	raserver.exe
2980	raserver.exe
2980	raserver.exe
2980	raserver.exe
2980	raserver.exe
2980	raserver.exe
2980	raserver.exe
2980	raserver.exe
2980	raserver.exe
2980	raserver.exe
2980	raserver.exe
2980	raserver.exe
2980	raserver.exe
2980	raserver.exe
2980	raserver.exe
2980	raserver.exe
2980	raserver.exe
2980	raserver.exe
2980	raserver.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

3044 Explorer.EXE
Suspicious behavior: MapViewOfSection 8 IoCs

Processes:

pxzpa.exepxzpa.exeraserver.exe

pid process

5072 pxzpa.exe
2800 pxzpa.exe
2800 pxzpa.exe
2800 pxzpa.exe
2980 raserver.exe
2980 raserver.exe
2980 raserver.exe
2980 raserver.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

pxzpa.exeraserver.exe

description pid process

Token: SeDebugPrivilege 2800 pxzpa.exe
Token: SeDebugPrivilege 2980 raserver.exe

pid	process
3044	Explorer.EXE

pid	process
5072	pxzpa.exe
2800	pxzpa.exe
2800	pxzpa.exe
2800	pxzpa.exe
2980	raserver.exe
2980	raserver.exe
2980	raserver.exe
2980	raserver.exe

description	pid	process
Token: SeDebugPrivilege	2800	pxzpa.exe
Token: SeDebugPrivilege	2980	raserver.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

3b33c707e522fc9e706c62687387ddbc.exepxzpa.exeExplorer.EXEraserver.exe

description	pid	process	target process
PID 4440 wrote to memory of 5072	4440	3b33c707e522fc9e706c62687387ddbc.exe	pxzpa.exe
PID 4440 wrote to memory of 5072	4440	3b33c707e522fc9e706c62687387ddbc.exe	pxzpa.exe
PID 4440 wrote to memory of 5072	4440	3b33c707e522fc9e706c62687387ddbc.exe	pxzpa.exe
PID 5072 wrote to memory of 2800	5072	pxzpa.exe	pxzpa.exe
PID 5072 wrote to memory of 2800	5072	pxzpa.exe	pxzpa.exe
PID 5072 wrote to memory of 2800	5072	pxzpa.exe	pxzpa.exe
PID 5072 wrote to memory of 2800	5072	pxzpa.exe	pxzpa.exe
PID 3044 wrote to memory of 2980	3044	Explorer.EXE	raserver.exe
PID 3044 wrote to memory of 2980	3044	Explorer.EXE	raserver.exe
PID 3044 wrote to memory of 2980	3044	Explorer.EXE	raserver.exe
PID 2980 wrote to memory of 4532	2980	raserver.exe	Firefox.exe
PID 2980 wrote to memory of 4532	2980	raserver.exe	Firefox.exe
PID 2980 wrote to memory of 4532	2980	raserver.exe	Firefox.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Users\Admin\AppData\Local\Temp\3b33c707e522fc9e706c62687387ddbc.exe
  "C:\Users\Admin\AppData\Local\Temp\3b33c707e522fc9e706c62687387ddbc.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4440
- - C:\Users\Admin\AppData\Local\Temp\pxzpa.exe
    "C:\Users\Admin\AppData\Local\Temp\pxzpa.exe" C:\Users\Admin\AppData\Local\Temp\bvfschl.llo
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:5072
  - - C:\Users\Admin\AppData\Local\Temp\pxzpa.exe
      "C:\Users\Admin\AppData\Local\Temp\pxzpa.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:2800
- C:\Windows\SysWOW64\raserver.exe
  "C:\Windows\SysWOW64\raserver.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:4532

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bvfschl.llo

Filesize
5KB

MD5
234ecaa2516da7694806821607cb957f

SHA1
5e24bc4f64658bd2c9bbfed88ca6d39d1f84f278

SHA256
4559491a1389e02acd69695203a90b6692df27d34a3095ba7f4f753562754f56

SHA512
1a0fb05636f903ea3b583ec022b3d1182ee7c7a872abfc99822b633cb7bb2a305200406093430e308ecaaba28b5ed2ed84223812962863592d4d2cd399b18f8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\puacwrlc.q

Filesize
185KB

MD5
ae560924ece971bea500b39cf812665d

SHA1
db73b123c1edb1cde8925d784f1f793aacf26f6e

SHA256
176f6aaf297901b7100ab3164b6229042dc858876c48c04b7efeef2e71798176

SHA512
67fdbe987fa13481daccc6432034ddf4a33f1033a469adbfa347d8361a9290e5dcb183a45085486ef90d1409f991494c26902d85c1c8bf29ee98753dcbb1a8e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\pxzpa.exe

Filesize
281KB

MD5
ca0cca1b24cac955c84585eeefab6944

SHA1
517916bf6278c0584e8c50e2deeb5d75c67a413b

SHA256
aa4e786e9913c83ff743a8dfce23200f1c9b10a0040bd0d6507194c373607585

SHA512
28194e9239b47707438c2e1637d27506335253d5ba051b15e856a0afa1f88984f793c8c8a87b28b322efa7bae7db47d6f0a8f12091275f4cc16a1226ab4bb488

Download Submit
C:\Users\Admin\AppData\Local\Temp\pxzpa.exe

Filesize
281KB

MD5
ca0cca1b24cac955c84585eeefab6944

SHA1
517916bf6278c0584e8c50e2deeb5d75c67a413b

SHA256
aa4e786e9913c83ff743a8dfce23200f1c9b10a0040bd0d6507194c373607585

SHA512
28194e9239b47707438c2e1637d27506335253d5ba051b15e856a0afa1f88984f793c8c8a87b28b322efa7bae7db47d6f0a8f12091275f4cc16a1226ab4bb488

Download Submit
C:\Users\Admin\AppData\Local\Temp\pxzpa.exe

Filesize
281KB

MD5
ca0cca1b24cac955c84585eeefab6944

SHA1
517916bf6278c0584e8c50e2deeb5d75c67a413b

SHA256
aa4e786e9913c83ff743a8dfce23200f1c9b10a0040bd0d6507194c373607585

SHA512
28194e9239b47707438c2e1637d27506335253d5ba051b15e856a0afa1f88984f793c8c8a87b28b322efa7bae7db47d6f0a8f12091275f4cc16a1226ab4bb488

Download Submit
memory/2800-142-0x0000000000970000-0x0000000000980000-memory.dmp

Filesize
64KB

Download
memory/2800-137-0x0000000000000000-mapping.dmp

Download
memory/2800-139-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2800-140-0x0000000000401000-0x000000000042F000-memory.dmp

Filesize
184KB

Download
memory/2800-141-0x0000000000F40000-0x000000000128A000-memory.dmp

Filesize
3.3MB

Download
memory/2980-144-0x0000000000000000-mapping.dmp

Download
memory/2980-145-0x0000000000930000-0x000000000094F000-memory.dmp

Filesize
124KB

Download
memory/2980-146-0x0000000000E90000-0x0000000000EBD000-memory.dmp

Filesize
180KB

Download
memory/2980-147-0x0000000002E40000-0x000000000318A000-memory.dmp

Filesize
3.3MB

Download
memory/2980-148-0x0000000002BA0000-0x0000000002C2F000-memory.dmp

Filesize
572KB

Download
memory/2980-150-0x0000000000E90000-0x0000000000EBD000-memory.dmp

Filesize
180KB

Download
memory/3044-143-0x0000000007710000-0x0000000007855000-memory.dmp

Filesize
1.3MB

Download
memory/3044-149-0x0000000007860000-0x0000000007954000-memory.dmp

Filesize
976KB

Download
memory/3044-151-0x0000000007860000-0x0000000007954000-memory.dmp

Filesize
976KB

Download
memory/5072-132-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads