formbook | bdee6d7a7e7cc141bdb3fc0997cbb07b1a85016e23fd74eec044a5ca52ae5052

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
16-12-2022 13:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Outstanding SOA.exe
Size

272KB
MD5

110f69d363cea079d6d0bdeff1bb838f
SHA1

324be5674ea782a4eaf68b51b87fc61b0f894044
SHA256

bdee6d7a7e7cc141bdb3fc0997cbb07b1a85016e23fd74eec044a5ca52ae5052
SHA512

c035d86afbd3b548cd6bf08a57838db4735f090fcbb34555179a52ea9b1c377490a8e550a42b5bbcf0d47e0560af9bde920fb16849c16e9add9adaf4beb9baec
SSDEEP

6144:9kw24wUoB7N3lbNKRmqdtK1jdACBqE5ObP8l5i:S4wU6N3xZq/2pAiqE5OkQ

Score

10^/10

formbook scse persistence rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

scse

Decoy

SKpYFyVNT2zunKf0uuM=

FlEHUseI7I5XbrO8fR/XBcS9ZA==

FPuxoUOxkLiATugw

VKdxsDSk0jdT5Kw=

FpqHf9iI/1tl97E=

YGI6sIl3UIxfZvlD+JiUuuLR

oBAEO0suBEAD5aK00A==

RKJqTzg4gQ/Q6DYSuTjDGkwuyl0ik5Kb8w==

VFg9s3W0/Ype8A3cZb+D7g==

hwD+VNd6014nrsaTWm4FBcS9ZA==

zkAdUq1soKYUfZaTqLmL

XVQ9WbRivUIQ477a/hKv+g==

QireF2geizAwmp674AGc5g==

PSTUQxs6j8OATugw

LHJhyy2VbX8NEqf0uuM=

MiY1vg6T3HqATugw

wqkUjaVXnGgBqA==

jUr/eUtSIT01Wegt

PjQidcqKzAbSZICUZb+D7g==

OkAmcv12sUEAIHwFHakzdIo2FPHw

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Executes dropped EXE 2 IoCs

Processes:

pnrhtyb.exepnrhtyb.exe

pid process

3036 pnrhtyb.exe
4768 pnrhtyb.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

pnrhtyb.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation pnrhtyb.exe

pid	process
3036	pnrhtyb.exe
4768	pnrhtyb.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	pnrhtyb.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

pnrhtyb.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rabnvgeeyk = "C:\\Users\\Admin\\AppData\\Roaming\\vkabk\\bvdpbneprit.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\pnrhtyb.exe\" C:\\Users\\Admin\\AppData\\Local\\"	pnrhtyb.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

pnrhtyb.exepnrhtyb.exeWWAHost.exe

description	pid	process	target process
PID 3036 set thread context of 4768	3036	pnrhtyb.exe	pnrhtyb.exe
PID 4768 set thread context of 2756	4768	pnrhtyb.exe	Explorer.EXE
PID 552 set thread context of 2756	552	WWAHost.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

WWAHost.exe

description	ioc	process
Key created	\Registry\User\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	WWAHost.exe

Suspicious behavior: EnumeratesProcesses 62 IoCs

Processes:

pnrhtyb.exeWWAHost.exe

pid	process
4768	pnrhtyb.exe
4768	pnrhtyb.exe
4768	pnrhtyb.exe
4768	pnrhtyb.exe
4768	pnrhtyb.exe
4768	pnrhtyb.exe
4768	pnrhtyb.exe
4768	pnrhtyb.exe
552	WWAHost.exe
552	WWAHost.exe
552	WWAHost.exe
552	WWAHost.exe
552	WWAHost.exe
552	WWAHost.exe
552	WWAHost.exe
552	WWAHost.exe
552	WWAHost.exe
552	WWAHost.exe
552	WWAHost.exe
552	WWAHost.exe
552	WWAHost.exe
552	WWAHost.exe
552	WWAHost.exe
552	WWAHost.exe
552	WWAHost.exe
552	WWAHost.exe
552	WWAHost.exe
552	WWAHost.exe
552	WWAHost.exe
552	WWAHost.exe
552	WWAHost.exe
552	WWAHost.exe
552	WWAHost.exe
552	WWAHost.exe
552	WWAHost.exe
552	WWAHost.exe
552	WWAHost.exe
552	WWAHost.exe
552	WWAHost.exe
552	WWAHost.exe
552	WWAHost.exe
552	WWAHost.exe
552	WWAHost.exe
552	WWAHost.exe
552	WWAHost.exe
552	WWAHost.exe
552	WWAHost.exe
552	WWAHost.exe
552	WWAHost.exe
552	WWAHost.exe
552	WWAHost.exe
552	WWAHost.exe
552	WWAHost.exe
552	WWAHost.exe
552	WWAHost.exe
552	WWAHost.exe
552	WWAHost.exe
552	WWAHost.exe
552	WWAHost.exe
552	WWAHost.exe
552	WWAHost.exe
552	WWAHost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

2756 Explorer.EXE
Suspicious behavior: MapViewOfSection 8 IoCs

Processes:

pnrhtyb.exepnrhtyb.exeWWAHost.exe

pid process

3036 pnrhtyb.exe
4768 pnrhtyb.exe
4768 pnrhtyb.exe
4768 pnrhtyb.exe
552 WWAHost.exe
552 WWAHost.exe
552 WWAHost.exe
552 WWAHost.exe

pid	process
2756	Explorer.EXE

pid	process
3036	pnrhtyb.exe
4768	pnrhtyb.exe
4768	pnrhtyb.exe
4768	pnrhtyb.exe
552	WWAHost.exe
552	WWAHost.exe
552	WWAHost.exe
552	WWAHost.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

Processes:

pnrhtyb.exeWWAHost.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	4768	pnrhtyb.exe
Token: SeDebugPrivilege	552	WWAHost.exe
Token: SeShutdownPrivilege	2756	Explorer.EXE
Token: SeCreatePagefilePrivilege	2756	Explorer.EXE
Token: SeShutdownPrivilege	2756	Explorer.EXE
Token: SeCreatePagefilePrivilege	2756	Explorer.EXE
Token: SeShutdownPrivilege	2756	Explorer.EXE
Token: SeCreatePagefilePrivilege	2756	Explorer.EXE
Token: SeShutdownPrivilege	2756	Explorer.EXE
Token: SeCreatePagefilePrivilege	2756	Explorer.EXE

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

Outstanding SOA.exepnrhtyb.exeExplorer.EXEWWAHost.exe

description	pid	process	target process
PID 1444 wrote to memory of 3036	1444	Outstanding SOA.exe	pnrhtyb.exe
PID 1444 wrote to memory of 3036	1444	Outstanding SOA.exe	pnrhtyb.exe
PID 1444 wrote to memory of 3036	1444	Outstanding SOA.exe	pnrhtyb.exe
PID 3036 wrote to memory of 4768	3036	pnrhtyb.exe	pnrhtyb.exe
PID 3036 wrote to memory of 4768	3036	pnrhtyb.exe	pnrhtyb.exe
PID 3036 wrote to memory of 4768	3036	pnrhtyb.exe	pnrhtyb.exe
PID 3036 wrote to memory of 4768	3036	pnrhtyb.exe	pnrhtyb.exe
PID 2756 wrote to memory of 552	2756	Explorer.EXE	WWAHost.exe
PID 2756 wrote to memory of 552	2756	Explorer.EXE	WWAHost.exe
PID 2756 wrote to memory of 552	2756	Explorer.EXE	WWAHost.exe
PID 552 wrote to memory of 1500	552	WWAHost.exe	Firefox.exe
PID 552 wrote to memory of 1500	552	WWAHost.exe	Firefox.exe
PID 552 wrote to memory of 1500	552	WWAHost.exe	Firefox.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Users\Admin\AppData\Local\Temp\Outstanding SOA.exe
  "C:\Users\Admin\AppData\Local\Temp\Outstanding SOA.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1444
- - C:\Users\Admin\AppData\Local\Temp\pnrhtyb.exe
    "C:\Users\Admin\AppData\Local\Temp\pnrhtyb.exe" C:\Users\Admin\AppData\Local\Temp\pnuhuhyrkcu.s
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:3036
  - - C:\Users\Admin\AppData\Local\Temp\pnrhtyb.exe
      "C:\Users\Admin\AppData\Local\Temp\pnrhtyb.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:4768
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:4324
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:4648
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:1676
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:1516
- C:\Windows\SysWOW64\WWAHost.exe
  "C:\Windows\SysWOW64\WWAHost.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:552
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:1500

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\pnrhtyb.exe

Filesize
141KB

MD5
e6366cf29bc69431f338125292bf75d5

SHA1
4f5fac42967462b478a82b03ddf2788e666502eb

SHA256
b5a0d29be1de9fad206d74df477d616b3772ab66d28b238e9b3b1af49a6bb5a9

SHA512
9f0555e4f2b41a95039d5611d72084d92c79e97b41492155de4c14163aa9fdcacccbe802470efe68711d890ae255dfd70f4f47a8c6bc464a57add894f7c3ac24

Download Submit
C:\Users\Admin\AppData\Local\Temp\pnrhtyb.exe

Filesize
141KB

MD5
e6366cf29bc69431f338125292bf75d5

SHA1
4f5fac42967462b478a82b03ddf2788e666502eb

SHA256
b5a0d29be1de9fad206d74df477d616b3772ab66d28b238e9b3b1af49a6bb5a9

SHA512
9f0555e4f2b41a95039d5611d72084d92c79e97b41492155de4c14163aa9fdcacccbe802470efe68711d890ae255dfd70f4f47a8c6bc464a57add894f7c3ac24

Download Submit
C:\Users\Admin\AppData\Local\Temp\pnrhtyb.exe

Filesize
141KB

MD5
e6366cf29bc69431f338125292bf75d5

SHA1
4f5fac42967462b478a82b03ddf2788e666502eb

SHA256
b5a0d29be1de9fad206d74df477d616b3772ab66d28b238e9b3b1af49a6bb5a9

SHA512
9f0555e4f2b41a95039d5611d72084d92c79e97b41492155de4c14163aa9fdcacccbe802470efe68711d890ae255dfd70f4f47a8c6bc464a57add894f7c3ac24

Download Submit
C:\Users\Admin\AppData\Local\Temp\pnuhuhyrkcu.s

Filesize
7KB

MD5
2a81348d4e1afe228867ea7f9e3c5c1a

SHA1
fe9c9129d36c6492afe7088855d50f6aa209496d

SHA256
e9499c9d2eae7d655a93ced0da9b30156f63de4d094ffc5fa06067fb5355aacc

SHA512
8bd4e5efcd86b175fc8300c87ed06b0304ed909bbca2d133ec5452a4a310b4d57b9cf2f560670a7dfdd7d8349335e41e29cfb7afda0b1ff8a514b3d73b4c8148

Download Submit
C:\Users\Admin\AppData\Local\Temp\rtlhwzub.z

Filesize
184KB

MD5
fcb71430f99c4abc15f26c4a672dc9ac

SHA1
351dff9775946672145e07f2a3e12ca4e797dd01

SHA256
9131243092bf48835bf0760c4a1c85b2acf53136e82cdeb0339b18cb4febde17

SHA512
35045726a0c11009eb3b5d65ff62fc29c6fd835287ee2e31f38f2d6f24b144f4f66bd0b4f20946e486f057382d2dac0ae8f647e52eac135a43fc24467b6c92ae

Download Submit
memory/552-144-0x0000000000000000-mapping.dmp

Download
memory/552-151-0x0000000000610000-0x000000000063D000-memory.dmp

Filesize
180KB

Download
memory/552-149-0x0000000001200000-0x000000000128F000-memory.dmp

Filesize
572KB

Download
memory/552-147-0x00000000014A0000-0x00000000017EA000-memory.dmp

Filesize
3.3MB

Download
memory/552-146-0x0000000000610000-0x000000000063D000-memory.dmp

Filesize
180KB

Download
memory/552-145-0x0000000000680000-0x000000000075C000-memory.dmp

Filesize
880KB

Download
memory/2756-164-0x0000000003120000-0x0000000003130000-memory.dmp

Filesize
64KB

Download
memory/2756-170-0x0000000003460000-0x0000000003470000-memory.dmp

Filesize
64KB

Download
memory/2756-143-0x0000000002F30000-0x0000000003004000-memory.dmp

Filesize
848KB

Download
memory/2756-198-0x00000000011B0000-0x00000000011C0000-memory.dmp

Filesize
64KB

Download
memory/2756-197-0x0000000000E30000-0x0000000000E40000-memory.dmp

Filesize
64KB

Download
memory/2756-148-0x0000000002F30000-0x0000000003004000-memory.dmp

Filesize
848KB

Download
memory/2756-196-0x00000000011B0000-0x00000000011C0000-memory.dmp

Filesize
64KB

Download
memory/2756-150-0x0000000003320000-0x000000000345A000-memory.dmp

Filesize
1.2MB

Download
memory/2756-195-0x0000000003120000-0x0000000003130000-memory.dmp

Filesize
64KB

Download
memory/2756-152-0x0000000003320000-0x000000000345A000-memory.dmp

Filesize
1.2MB

Download
memory/2756-153-0x0000000003120000-0x0000000003130000-memory.dmp

Filesize
64KB

Download
memory/2756-154-0x0000000003120000-0x0000000003130000-memory.dmp

Filesize
64KB

Download
memory/2756-155-0x0000000003120000-0x0000000003130000-memory.dmp

Filesize
64KB

Download
memory/2756-156-0x0000000003120000-0x0000000003130000-memory.dmp

Filesize
64KB

Download
memory/2756-157-0x0000000003120000-0x0000000003130000-memory.dmp

Filesize
64KB

Download
memory/2756-158-0x0000000003120000-0x0000000003130000-memory.dmp

Filesize
64KB

Download
memory/2756-159-0x0000000003120000-0x0000000003130000-memory.dmp

Filesize
64KB

Download
memory/2756-160-0x0000000003120000-0x0000000003130000-memory.dmp

Filesize
64KB

Download
memory/2756-161-0x0000000003120000-0x0000000003130000-memory.dmp

Filesize
64KB

Download
memory/2756-162-0x0000000003120000-0x0000000003130000-memory.dmp

Filesize
64KB

Download
memory/2756-163-0x0000000003120000-0x0000000003130000-memory.dmp

Filesize
64KB

Download
memory/2756-194-0x0000000003120000-0x0000000003130000-memory.dmp

Filesize
64KB

Download
memory/2756-165-0x0000000003120000-0x0000000003130000-memory.dmp

Filesize
64KB

Download
memory/2756-166-0x0000000003120000-0x0000000003130000-memory.dmp

Filesize
64KB

Download
memory/2756-167-0x0000000003120000-0x0000000003130000-memory.dmp

Filesize
64KB

Download
memory/2756-168-0x0000000003120000-0x0000000003130000-memory.dmp

Filesize
64KB

Download
memory/2756-169-0x0000000003120000-0x0000000003130000-memory.dmp

Filesize
64KB

Download
memory/2756-193-0x0000000003120000-0x0000000003130000-memory.dmp

Filesize
64KB

Download
memory/2756-171-0x0000000003480000-0x0000000003490000-memory.dmp

Filesize
64KB

Download
memory/2756-172-0x0000000003480000-0x0000000003490000-memory.dmp

Filesize
64KB

Download
memory/2756-173-0x0000000003480000-0x0000000003490000-memory.dmp

Filesize
64KB

Download
memory/2756-174-0x0000000003120000-0x0000000003130000-memory.dmp

Filesize
64KB

Download
memory/2756-175-0x0000000003120000-0x0000000003130000-memory.dmp

Filesize
64KB

Download
memory/2756-176-0x0000000003120000-0x0000000003130000-memory.dmp

Filesize
64KB

Download
memory/2756-177-0x0000000003120000-0x0000000003130000-memory.dmp

Filesize
64KB

Download
memory/2756-178-0x0000000003120000-0x0000000003130000-memory.dmp

Filesize
64KB

Download
memory/2756-179-0x0000000003120000-0x0000000003130000-memory.dmp

Filesize
64KB

Download
memory/2756-181-0x0000000000E30000-0x0000000000E40000-memory.dmp

Filesize
64KB

Download
memory/2756-180-0x0000000003120000-0x0000000003130000-memory.dmp

Filesize
64KB

Download
memory/2756-182-0x0000000003120000-0x0000000003130000-memory.dmp

Filesize
64KB

Download
memory/2756-184-0x0000000003120000-0x0000000003130000-memory.dmp

Filesize
64KB

Download
memory/2756-185-0x0000000003120000-0x0000000003130000-memory.dmp

Filesize
64KB

Download
memory/2756-186-0x0000000003120000-0x0000000003130000-memory.dmp

Filesize
64KB

Download
memory/2756-187-0x0000000003120000-0x0000000003130000-memory.dmp

Filesize
64KB

Download
memory/2756-188-0x0000000003120000-0x0000000003130000-memory.dmp

Filesize
64KB

Download
memory/2756-189-0x0000000003120000-0x0000000003130000-memory.dmp

Filesize
64KB

Download
memory/2756-190-0x0000000003120000-0x0000000003130000-memory.dmp

Filesize
64KB

Download
memory/2756-191-0x0000000003120000-0x0000000003130000-memory.dmp

Filesize
64KB

Download
memory/2756-192-0x0000000003120000-0x0000000003130000-memory.dmp

Filesize
64KB

Download
memory/3036-132-0x0000000000000000-mapping.dmp

Download
memory/4768-142-0x00000000004E0000-0x00000000004F0000-memory.dmp

Filesize
64KB

Download
memory/4768-137-0x0000000000000000-mapping.dmp

Download
memory/4768-139-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4768-141-0x0000000000A30000-0x0000000000D7A000-memory.dmp

Filesize
3.3MB

Download
memory/4768-140-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download