formbook | 91218386ed25d62220408973a03c76b8c4fc44512a60eabd0e437b2bbd10e7d4

General

Target

Inquiry.exe
Size

285KB
MD5

f0e4c1267b74749baa333af7b79863e4
SHA1

8392408915040e7397d0c5ef8415748fd41ed51c
SHA256

91218386ed25d62220408973a03c76b8c4fc44512a60eabd0e437b2bbd10e7d4
SHA512

22ccb51aa15e5b10ec58db93b71a809257ef76962072b107ace4d4385a592538ac31061bf50a4ced313ab45d7c691d1c8dd353b90bdbdede7a98e958763678d4
SSDEEP

6144:gkwn7X9cBmCuwC8XJDaXdihVmQzohW8ktHVKMZpWK4:NBmn8ZDAdKMQOW7VKIpWK4

Score

10^/10

formbook m5oe rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

m5oe

Decoy

HdR8hG6r12hBYuHY4zv6YeeFPQ==

tD1V9gswYvgQXEGd

1xKtJ1LdqRYMRMC84U1A

MbhjiWb7Lz8z7KIWl3UyUIJwA6Tb

joVB5Xggy2RtE+odsZg=

TrduAIay6Y3SvoIK20xI

pSna7LOsXXwXT/zz3Iow4g==

QnthmO4Qst5gC3sDoA==

eAirzOOgO7SOCenz3Iow4g==

xg0uSbfLTg==

YWQXwyGRzPEHzGrDFE8CBSE=

ujLnfuXoH9dbgHIK20xI

291v0XsGFrYQXEGd

MRvTd/qMuaHpjCM=

X131fLC6VWX4MsvCb2IPjIfq8wlksWfg

Y9Bur8DbgqFt/Yni86MMCCE=

q6RTBmJkmy5pWTmmCCrvmuCDPw==

mQS26DojT+EQXEGd

sjHQ+Kav2Wx9FeodsZg=

JA24UKnTA5re1LhcQaVo/w==

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Executes dropped EXE 2 IoCs

Processes:

iahjg.exeiahjg.exe

pid process

4012 iahjg.exe
3876 iahjg.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

iahjg.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation iahjg.exe

pid	process
4012	iahjg.exe
3876	iahjg.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	iahjg.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

iahjg.exeiahjg.execontrol.exe

description	pid	process	target process
PID 4012 set thread context of 3876	4012	iahjg.exe	iahjg.exe
PID 3876 set thread context of 700	3876	iahjg.exe	Explorer.EXE
PID 4372 set thread context of 700	4372	control.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

control.exe

description	ioc	process
Key created	\Registry\User\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	control.exe

Suspicious behavior: EnumeratesProcesses 62 IoCs

Processes:

iahjg.execontrol.exe

pid	process
3876	iahjg.exe
3876	iahjg.exe
3876	iahjg.exe
3876	iahjg.exe
3876	iahjg.exe
3876	iahjg.exe
3876	iahjg.exe
3876	iahjg.exe
4372	control.exe
4372	control.exe
4372	control.exe
4372	control.exe
4372	control.exe
4372	control.exe
4372	control.exe
4372	control.exe
4372	control.exe
4372	control.exe
4372	control.exe
4372	control.exe
4372	control.exe
4372	control.exe
4372	control.exe
4372	control.exe
4372	control.exe
4372	control.exe
4372	control.exe
4372	control.exe
4372	control.exe
4372	control.exe
4372	control.exe
4372	control.exe
4372	control.exe
4372	control.exe
4372	control.exe
4372	control.exe
4372	control.exe
4372	control.exe
4372	control.exe
4372	control.exe
4372	control.exe
4372	control.exe
4372	control.exe
4372	control.exe
4372	control.exe
4372	control.exe
4372	control.exe
4372	control.exe
4372	control.exe
4372	control.exe
4372	control.exe
4372	control.exe
4372	control.exe
4372	control.exe
4372	control.exe
4372	control.exe
4372	control.exe
4372	control.exe
4372	control.exe
4372	control.exe
4372	control.exe
4372	control.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

700 Explorer.EXE
Suspicious behavior: MapViewOfSection 8 IoCs

Processes:

iahjg.exeiahjg.execontrol.exe

pid process

4012 iahjg.exe
3876 iahjg.exe
3876 iahjg.exe
3876 iahjg.exe
4372 control.exe
4372 control.exe
4372 control.exe
4372 control.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

iahjg.execontrol.exe

description pid process

Token: SeDebugPrivilege 3876 iahjg.exe
Token: SeDebugPrivilege 4372 control.exe

pid	process
700	Explorer.EXE

pid	process
4012	iahjg.exe
3876	iahjg.exe
3876	iahjg.exe
3876	iahjg.exe
4372	control.exe
4372	control.exe
4372	control.exe
4372	control.exe

description	pid	process
Token: SeDebugPrivilege	3876	iahjg.exe
Token: SeDebugPrivilege	4372	control.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

Inquiry.exeiahjg.exeExplorer.EXEcontrol.exe

description	pid	process	target process
PID 4520 wrote to memory of 4012	4520	Inquiry.exe	iahjg.exe
PID 4520 wrote to memory of 4012	4520	Inquiry.exe	iahjg.exe
PID 4520 wrote to memory of 4012	4520	Inquiry.exe	iahjg.exe
PID 4012 wrote to memory of 3876	4012	iahjg.exe	iahjg.exe
PID 4012 wrote to memory of 3876	4012	iahjg.exe	iahjg.exe
PID 4012 wrote to memory of 3876	4012	iahjg.exe	iahjg.exe
PID 4012 wrote to memory of 3876	4012	iahjg.exe	iahjg.exe
PID 700 wrote to memory of 4372	700	Explorer.EXE	control.exe
PID 700 wrote to memory of 4372	700	Explorer.EXE	control.exe
PID 700 wrote to memory of 4372	700	Explorer.EXE	control.exe
PID 4372 wrote to memory of 3856	4372	control.exe	Firefox.exe
PID 4372 wrote to memory of 3856	4372	control.exe	Firefox.exe
PID 4372 wrote to memory of 3856	4372	control.exe	Firefox.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:700

C:\Users\Admin\AppData\Local\Temp\Inquiry.exe
"C:\Users\Admin\AppData\Local\Temp\Inquiry.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:4520

C:\Users\Admin\AppData\Local\Temp\iahjg.exe
"C:\Users\Admin\AppData\Local\Temp\iahjg.exe" C:\Users\Admin\AppData\Local\Temp\djntq.p
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4012

C:\Users\Admin\AppData\Local\Temp\iahjg.exe
"C:\Users\Admin\AppData\Local\Temp\iahjg.exe"
4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3876

C:\Windows\SysWOW64\control.exe
"C:\Windows\SysWOW64\control.exe"
2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4372

C:\Program Files\Mozilla Firefox\Firefox.exe
"C:\Program Files\Mozilla Firefox\Firefox.exe"
3⤵
PID:3856

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\djntq.p
Filesize
5KB

MD5
f27fed3f8f8c165ac48b676a094fc4e4

SHA1
c17902d9237ad297dc722ca7aff90847c95e9efa

SHA256
cb21b09101f103e4bd2cbd9275c8d9e26dbe88225ccf876802406deb074f8e96

SHA512
d42d8d54e8748e1e8f1da73f7ccefe31d1ab30cb1e88d67e97bbe9edbe5daf9535b62364116559316ee17aeb0e958f7607f782dfb908c5f55f3a642b93d4c188

Download Submit
C:\Users\Admin\AppData\Local\Temp\iahjg.exe
Filesize
51KB

MD5
9b189f63f42e58423a0b42311b6be5ce

SHA1
2d2bc7e732838ff6925cc7c23486b78aeb713ed2

SHA256
8db377e7f08c81910b0c64aaac26f99d9e468f6f1322c8f705a37743e712d3cf

SHA512
801b087ce8efb5bf5b91d8e9232891be2974faaaa5a2d4cd7ff2bdfe397ff3de1628f0fc0390fbd9ff78d1fd7b2c111058da9922ca36791fd2c37e8dbd74c164

Download Submit
C:\Users\Admin\AppData\Local\Temp\iahjg.exe
Filesize
51KB

MD5
9b189f63f42e58423a0b42311b6be5ce

SHA1
2d2bc7e732838ff6925cc7c23486b78aeb713ed2

SHA256
8db377e7f08c81910b0c64aaac26f99d9e468f6f1322c8f705a37743e712d3cf

SHA512
801b087ce8efb5bf5b91d8e9232891be2974faaaa5a2d4cd7ff2bdfe397ff3de1628f0fc0390fbd9ff78d1fd7b2c111058da9922ca36791fd2c37e8dbd74c164

Download Submit
C:\Users\Admin\AppData\Local\Temp\iahjg.exe
Filesize
51KB

MD5
9b189f63f42e58423a0b42311b6be5ce

SHA1
2d2bc7e732838ff6925cc7c23486b78aeb713ed2

SHA256
8db377e7f08c81910b0c64aaac26f99d9e468f6f1322c8f705a37743e712d3cf

SHA512
801b087ce8efb5bf5b91d8e9232891be2974faaaa5a2d4cd7ff2bdfe397ff3de1628f0fc0390fbd9ff78d1fd7b2c111058da9922ca36791fd2c37e8dbd74c164

Download Submit
C:\Users\Admin\AppData\Local\Temp\soqlkiazp.w
Filesize
185KB

MD5
e71cb95a699d9f1a4f4f283cacb04267

SHA1
9ddd6da8b25106dfbdc92f741c1cb2219c6f25e7

SHA256
b2819161ce58e436fb01af34a93dba71f13f9c0476b77a059342b2bd84652feb

SHA512
51b79d32daa8b19ecc9ec318c721a0c1cd767c01d65e6dc2adc24b87e80ff73c277b792fce3e2c0f2c5b69718ab34b0feb2d624c0a7308edd081a15927d46d07

Download Submit
memory/700-143-0x0000000003170000-0x0000000003220000-memory.dmp

Filesize
704KB

Download
memory/700-152-0x0000000008580000-0x00000000086F9000-memory.dmp

Filesize
1.5MB

Download
memory/700-150-0x0000000008580000-0x00000000086F9000-memory.dmp

Filesize
1.5MB

Download
memory/3876-142-0x00000000005A0000-0x00000000005B0000-memory.dmp

Filesize
64KB

Download
memory/3876-141-0x0000000000B80000-0x0000000000ECA000-memory.dmp

Filesize
3.3MB

Download
memory/3876-140-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3876-145-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3876-139-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3876-137-0x0000000000000000-mapping.dmp

Download
memory/4012-132-0x0000000000000000-mapping.dmp

Download
memory/4372-144-0x0000000000000000-mapping.dmp

Download
memory/4372-147-0x0000000002250000-0x000000000259A000-memory.dmp

Filesize
3.3MB

Download
memory/4372-146-0x0000000000050000-0x0000000000077000-memory.dmp

Filesize
156KB

Download
memory/4372-148-0x0000000000140000-0x000000000016D000-memory.dmp

Filesize
180KB

Download
memory/4372-149-0x0000000002090000-0x000000000211F000-memory.dmp

Filesize
572KB

Download
memory/4372-151-0x0000000000140000-0x000000000016D000-memory.dmp

Filesize
180KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads