formbook | 91218386ed25d62220408973a03c76b8c4fc44512a60eabd0e437b2bbd10e7d4

General

Target

Inquiry.exe
Size

285KB
MD5

f0e4c1267b74749baa333af7b79863e4
SHA1

8392408915040e7397d0c5ef8415748fd41ed51c
SHA256

91218386ed25d62220408973a03c76b8c4fc44512a60eabd0e437b2bbd10e7d4
SHA512

22ccb51aa15e5b10ec58db93b71a809257ef76962072b107ace4d4385a592538ac31061bf50a4ced313ab45d7c691d1c8dd353b90bdbdede7a98e958763678d4
SSDEEP

6144:gkwn7X9cBmCuwC8XJDaXdihVmQzohW8ktHVKMZpWK4:NBmn8ZDAdKMQOW7VKIpWK4

Score

10^/10

formbook m5oe rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

m5oe

Decoy

HdR8hG6r12hBYuHY4zv6YeeFPQ==

tD1V9gswYvgQXEGd

1xKtJ1LdqRYMRMC84U1A

MbhjiWb7Lz8z7KIWl3UyUIJwA6Tb

joVB5Xggy2RtE+odsZg=

TrduAIay6Y3SvoIK20xI

pSna7LOsXXwXT/zz3Iow4g==

QnthmO4Qst5gC3sDoA==

eAirzOOgO7SOCenz3Iow4g==

xg0uSbfLTg==

YWQXwyGRzPEHzGrDFE8CBSE=

ujLnfuXoH9dbgHIK20xI

291v0XsGFrYQXEGd

MRvTd/qMuaHpjCM=

X131fLC6VWX4MsvCb2IPjIfq8wlksWfg

Y9Bur8DbgqFt/Yni86MMCCE=

q6RTBmJkmy5pWTmmCCrvmuCDPw==

mQS26DojT+EQXEGd

sjHQ+Kav2Wx9FeodsZg=

JA24UKnTA5re1LhcQaVo/w==

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Executes dropped EXE 2 IoCs

Processes:

iahjg.exeiahjg.exe

pid process

1416 iahjg.exe
1656 iahjg.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

iahjg.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Control Panel\International\Geo\Nation iahjg.exe
Loads dropped DLL 3 IoCs

Processes:

Inquiry.exeiahjg.exesvchost.exe

pid process

2000 Inquiry.exe
1416 iahjg.exe
936 svchost.exe

pid	process
1416	iahjg.exe
1656	iahjg.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Control Panel\International\Geo\Nation	iahjg.exe

pid	process
2000	Inquiry.exe
1416	iahjg.exe
936	svchost.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

iahjg.exeiahjg.exesvchost.exe

description	pid	process	target process
PID 1416 set thread context of 1656	1416	iahjg.exe	iahjg.exe
PID 1656 set thread context of 1276	1656	iahjg.exe	Explorer.EXE
PID 1656 set thread context of 1276	1656	iahjg.exe	Explorer.EXE
PID 936 set thread context of 1276	936	svchost.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Key created	\Registry\User\S-1-5-21-3406023954-474543476-3319432036-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	svchost.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

Processes:

iahjg.exesvchost.exe

pid	process
1656	iahjg.exe
1656	iahjg.exe
1656	iahjg.exe
1656	iahjg.exe
1656	iahjg.exe
936	svchost.exe
936	svchost.exe
936	svchost.exe
936	svchost.exe
936	svchost.exe
936	svchost.exe
936	svchost.exe
936	svchost.exe
936	svchost.exe
936	svchost.exe
936	svchost.exe
936	svchost.exe
936	svchost.exe
936	svchost.exe
936	svchost.exe
936	svchost.exe
936	svchost.exe
936	svchost.exe
936	svchost.exe
936	svchost.exe
936	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1276 Explorer.EXE
Suspicious behavior: MapViewOfSection 9 IoCs

Processes:

iahjg.exeiahjg.exesvchost.exe

pid process

1416 iahjg.exe
1656 iahjg.exe
1656 iahjg.exe
1656 iahjg.exe
1656 iahjg.exe
936 svchost.exe
936 svchost.exe
936 svchost.exe
936 svchost.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

iahjg.exesvchost.exe

description pid process

Token: SeDebugPrivilege 1656 iahjg.exe
Token: SeDebugPrivilege 936 svchost.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1276 Explorer.EXE
1276 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1276 Explorer.EXE
1276 Explorer.EXE

pid	process
1276	Explorer.EXE

pid	process
1416	iahjg.exe
1656	iahjg.exe
1656	iahjg.exe
1656	iahjg.exe
1656	iahjg.exe
936	svchost.exe
936	svchost.exe
936	svchost.exe
936	svchost.exe

description	pid	process
Token: SeDebugPrivilege	1656	iahjg.exe
Token: SeDebugPrivilege	936	svchost.exe

pid	process
1276	Explorer.EXE
1276	Explorer.EXE

pid	process
1276	Explorer.EXE
1276	Explorer.EXE

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

Inquiry.exeiahjg.exeiahjg.exesvchost.exe

description	pid	process	target process
PID 2000 wrote to memory of 1416	2000	Inquiry.exe	iahjg.exe
PID 2000 wrote to memory of 1416	2000	Inquiry.exe	iahjg.exe
PID 2000 wrote to memory of 1416	2000	Inquiry.exe	iahjg.exe
PID 2000 wrote to memory of 1416	2000	Inquiry.exe	iahjg.exe
PID 1416 wrote to memory of 1656	1416	iahjg.exe	iahjg.exe
PID 1416 wrote to memory of 1656	1416	iahjg.exe	iahjg.exe
PID 1416 wrote to memory of 1656	1416	iahjg.exe	iahjg.exe
PID 1416 wrote to memory of 1656	1416	iahjg.exe	iahjg.exe
PID 1416 wrote to memory of 1656	1416	iahjg.exe	iahjg.exe
PID 1656 wrote to memory of 936	1656	iahjg.exe	svchost.exe
PID 1656 wrote to memory of 936	1656	iahjg.exe	svchost.exe
PID 1656 wrote to memory of 936	1656	iahjg.exe	svchost.exe
PID 1656 wrote to memory of 936	1656	iahjg.exe	svchost.exe
PID 936 wrote to memory of 1876	936	svchost.exe	Firefox.exe
PID 936 wrote to memory of 1876	936	svchost.exe	Firefox.exe
PID 936 wrote to memory of 1876	936	svchost.exe	Firefox.exe
PID 936 wrote to memory of 1876	936	svchost.exe	Firefox.exe
PID 936 wrote to memory of 1876	936	svchost.exe	Firefox.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1276

C:\Users\Admin\AppData\Local\Temp\Inquiry.exe
"C:\Users\Admin\AppData\Local\Temp\Inquiry.exe"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2000

C:\Users\Admin\AppData\Local\Temp\iahjg.exe
"C:\Users\Admin\AppData\Local\Temp\iahjg.exe" C:\Users\Admin\AppData\Local\Temp\djntq.p
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1416

C:\Users\Admin\AppData\Local\Temp\iahjg.exe
"C:\Users\Admin\AppData\Local\Temp\iahjg.exe"
4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1656

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\SysWOW64\svchost.exe"
5⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:936

C:\Program Files\Mozilla Firefox\Firefox.exe
"C:\Program Files\Mozilla Firefox\Firefox.exe"
6⤵
PID:1876

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\djntq.p
Filesize
5KB

MD5
f27fed3f8f8c165ac48b676a094fc4e4

SHA1
c17902d9237ad297dc722ca7aff90847c95e9efa

SHA256
cb21b09101f103e4bd2cbd9275c8d9e26dbe88225ccf876802406deb074f8e96

SHA512
d42d8d54e8748e1e8f1da73f7ccefe31d1ab30cb1e88d67e97bbe9edbe5daf9535b62364116559316ee17aeb0e958f7607f782dfb908c5f55f3a642b93d4c188

Download Submit
C:\Users\Admin\AppData\Local\Temp\iahjg.exe
Filesize
51KB

MD5
9b189f63f42e58423a0b42311b6be5ce

SHA1
2d2bc7e732838ff6925cc7c23486b78aeb713ed2

SHA256
8db377e7f08c81910b0c64aaac26f99d9e468f6f1322c8f705a37743e712d3cf

SHA512
801b087ce8efb5bf5b91d8e9232891be2974faaaa5a2d4cd7ff2bdfe397ff3de1628f0fc0390fbd9ff78d1fd7b2c111058da9922ca36791fd2c37e8dbd74c164

Download Submit
C:\Users\Admin\AppData\Local\Temp\iahjg.exe
Filesize
51KB

MD5
9b189f63f42e58423a0b42311b6be5ce

SHA1
2d2bc7e732838ff6925cc7c23486b78aeb713ed2

SHA256
8db377e7f08c81910b0c64aaac26f99d9e468f6f1322c8f705a37743e712d3cf

SHA512
801b087ce8efb5bf5b91d8e9232891be2974faaaa5a2d4cd7ff2bdfe397ff3de1628f0fc0390fbd9ff78d1fd7b2c111058da9922ca36791fd2c37e8dbd74c164

Download Submit
C:\Users\Admin\AppData\Local\Temp\iahjg.exe
Filesize
51KB

MD5
9b189f63f42e58423a0b42311b6be5ce

SHA1
2d2bc7e732838ff6925cc7c23486b78aeb713ed2

SHA256
8db377e7f08c81910b0c64aaac26f99d9e468f6f1322c8f705a37743e712d3cf

SHA512
801b087ce8efb5bf5b91d8e9232891be2974faaaa5a2d4cd7ff2bdfe397ff3de1628f0fc0390fbd9ff78d1fd7b2c111058da9922ca36791fd2c37e8dbd74c164

Download Submit
C:\Users\Admin\AppData\Local\Temp\soqlkiazp.w
Filesize
185KB

MD5
e71cb95a699d9f1a4f4f283cacb04267

SHA1
9ddd6da8b25106dfbdc92f741c1cb2219c6f25e7

SHA256
b2819161ce58e436fb01af34a93dba71f13f9c0476b77a059342b2bd84652feb

SHA512
51b79d32daa8b19ecc9ec318c721a0c1cd767c01d65e6dc2adc24b87e80ff73c277b792fce3e2c0f2c5b69718ab34b0feb2d624c0a7308edd081a15927d46d07

Download Submit
\Users\Admin\AppData\Local\Temp\iahjg.exe
Filesize
51KB

MD5
9b189f63f42e58423a0b42311b6be5ce

SHA1
2d2bc7e732838ff6925cc7c23486b78aeb713ed2

SHA256
8db377e7f08c81910b0c64aaac26f99d9e468f6f1322c8f705a37743e712d3cf

SHA512
801b087ce8efb5bf5b91d8e9232891be2974faaaa5a2d4cd7ff2bdfe397ff3de1628f0fc0390fbd9ff78d1fd7b2c111058da9922ca36791fd2c37e8dbd74c164

Download Submit
\Users\Admin\AppData\Local\Temp\iahjg.exe
Filesize
51KB

MD5
9b189f63f42e58423a0b42311b6be5ce

SHA1
2d2bc7e732838ff6925cc7c23486b78aeb713ed2

SHA256
8db377e7f08c81910b0c64aaac26f99d9e468f6f1322c8f705a37743e712d3cf

SHA512
801b087ce8efb5bf5b91d8e9232891be2974faaaa5a2d4cd7ff2bdfe397ff3de1628f0fc0390fbd9ff78d1fd7b2c111058da9922ca36791fd2c37e8dbd74c164

Download Submit
\Users\Admin\AppData\Local\Temp\sqlite3.dll
Filesize
831KB

MD5
05ace2f6d9bef6fd9bbd05ee5262a1f2

SHA1
5cce2228e0d9c6cc913cf551e0bf7c76ed74ff59

SHA256
002459f4d4758011b4d7f36935f1fe323494b847f8c173a551076a3d30475ebc

SHA512
1e717a66a72eb626727144fa7458f472ada54fd1be37072c9e740945e34ba94025737aef44e54752c50c5b79a583c6a91a0d8043bf1bf7c3e7cab8537207f9fc

Download Submit
memory/936-76-0x0000000000920000-0x0000000000C23000-memory.dmp

Filesize
3.0MB

Download
memory/936-79-0x0000000000080000-0x00000000000AD000-memory.dmp

Filesize
180KB

Download
memory/936-77-0x00000000004B0000-0x000000000053F000-memory.dmp

Filesize
572KB

Download
memory/936-74-0x0000000000780000-0x0000000000788000-memory.dmp

Filesize
32KB

Download
memory/936-75-0x0000000000080000-0x00000000000AD000-memory.dmp

Filesize
180KB

Download
memory/936-72-0x0000000000000000-mapping.dmp

Download
memory/1276-78-0x0000000006C50000-0x0000000006DAB000-memory.dmp

Filesize
1.4MB

Download
memory/1276-84-0x000007FE803D0000-0x000007FE803DA000-memory.dmp

Filesize
40KB

Download
memory/1276-71-0x0000000004630000-0x000000000471B000-memory.dmp

Filesize
940KB

Download
memory/1276-69-0x0000000006AD0000-0x0000000006C4D000-memory.dmp

Filesize
1.5MB

Download
memory/1276-83-0x000007FEF67D0000-0x000007FEF6913000-memory.dmp

Filesize
1.3MB

Download
memory/1276-81-0x0000000006C50000-0x0000000006DAB000-memory.dmp

Filesize
1.4MB

Download
memory/1416-56-0x0000000000000000-mapping.dmp

Download
memory/1656-68-0x0000000000200000-0x0000000000210000-memory.dmp

Filesize
64KB

Download
memory/1656-63-0x00000000004012B0-mapping.dmp

Download
memory/1656-65-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1656-66-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1656-67-0x0000000000770000-0x0000000000A73000-memory.dmp

Filesize
3.0MB

Download
memory/1656-73-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1656-70-0x00000000003F0000-0x0000000000400000-memory.dmp

Filesize
64KB

Download
memory/2000-54-0x00000000767B1000-0x00000000767B3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads