formbook | 033d52b01807172f9946d2c20c009df5c1a6a65ea153d75cc6e670d2151f79cc

General

Target

lSQSMS1aatHclJP.exe
Size

734KB
MD5

b5ecdb2b4c89d8b2111fef5112b3d59c
SHA1

c7e446bbdd1a23d47e860f3bf029ab8fea3621af
SHA256

033d52b01807172f9946d2c20c009df5c1a6a65ea153d75cc6e670d2151f79cc
SHA512

0e102a230c2e3757e1e5f6e44af8bf14d6f866768d7054dd1f21793374ab6d8090d112558700fab87a31f5e2197fbb6cb215cad72b511a94526a1fcfe3015866
SSDEEP

12288:8kMCVc1FDEC8oAc08NZ8OwESaDj3xvvn+EcVt8gnx2cHss/S+PHc42xtAq:pMGc1r8ooiYCj3xvv+9Yux2cHs6Sq84c

Score

10^/10

formbook fqwu rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

fqwu

Decoy

N6XHavFRXQTRmNUkF9dn

EoaWTgFMmLFmUJ7CJNkTiGoj5A==

Dm+WNJDwSQa5cML3Q7EBiGoj5A==

nixR8ZCkOWjqrASBuic=

yvWQNApkdf4QYIih4+xUDY0=

RtmBQtDYDb50g8btXA==

8SU541y9Ec12NYK8PSOfA8OPpaphimY=

/yEvxvlAkquuY3W1QQ==

AlHZgYW4BiI9V+M=

YsHIUsAOO15j+9TnWA==

JJu1S7QIIMij0xUqlUtv

CmWBLrD98YnyUCCFvy0=

uPwhAVEvtu1rTuY=

PI6bR88GVGXmRlpxpKjtBpo=

GnL7qs9HVQAiF6ckF9dn

2zVeBFKZgO1rTuY=

2VI1VpOg7boCAFxvrWN3ys9rovE=

L1lO62zA2o1QEEZRQtgh7g==

brhF5dY1e3zmSyCFvy0=

U6m2TsEidTTdsA5kX8wh7g==

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

lSQSMS1aatHclJP.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Control Panel\International\Geo\Nation	lSQSMS1aatHclJP.exe

Loads dropped DLL 1 IoCs

Processes:

colorcpl.exe

pid process

852 colorcpl.exe

pid	process
852	colorcpl.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

lSQSMS1aatHclJP.exelSQSMS1aatHclJP.execolorcpl.exe

description	pid	process	target process
PID 1744 set thread context of 1068	1744	lSQSMS1aatHclJP.exe	lSQSMS1aatHclJP.exe
PID 1068 set thread context of 1232	1068	lSQSMS1aatHclJP.exe	Explorer.EXE
PID 852 set thread context of 1232	852	colorcpl.exe	Explorer.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

colorcpl.exe

description	ioc	process
Key created	\Registry\User\S-1-5-21-1214520366-621468234-4062160515-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	colorcpl.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

lSQSMS1aatHclJP.execolorcpl.exe

pid	process
1068	lSQSMS1aatHclJP.exe
1068	lSQSMS1aatHclJP.exe
1068	lSQSMS1aatHclJP.exe
1068	lSQSMS1aatHclJP.exe
852	colorcpl.exe
852	colorcpl.exe
852	colorcpl.exe
852	colorcpl.exe
852	colorcpl.exe
852	colorcpl.exe
852	colorcpl.exe
852	colorcpl.exe
852	colorcpl.exe
852	colorcpl.exe
852	colorcpl.exe
852	colorcpl.exe
852	colorcpl.exe
852	colorcpl.exe
852	colorcpl.exe
852	colorcpl.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1232 Explorer.EXE
Suspicious behavior: MapViewOfSection 7 IoCs

Processes:

lSQSMS1aatHclJP.execolorcpl.exe

pid process

1068 lSQSMS1aatHclJP.exe
1068 lSQSMS1aatHclJP.exe
1068 lSQSMS1aatHclJP.exe
852 colorcpl.exe
852 colorcpl.exe
852 colorcpl.exe
852 colorcpl.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

lSQSMS1aatHclJP.execolorcpl.exe

description pid process

Token: SeDebugPrivilege 1068 lSQSMS1aatHclJP.exe
Token: SeDebugPrivilege 852 colorcpl.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1232 Explorer.EXE
1232 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1232 Explorer.EXE
1232 Explorer.EXE

pid	process
1232	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	1068	lSQSMS1aatHclJP.exe
Token: SeDebugPrivilege	852	colorcpl.exe

pid	process
1232	Explorer.EXE
1232	Explorer.EXE

pid	process
1232	Explorer.EXE
1232	Explorer.EXE

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

lSQSMS1aatHclJP.exeExplorer.EXEcolorcpl.exe

description	pid	process	target process
PID 1744 wrote to memory of 1068	1744	lSQSMS1aatHclJP.exe	lSQSMS1aatHclJP.exe
PID 1744 wrote to memory of 1068	1744	lSQSMS1aatHclJP.exe	lSQSMS1aatHclJP.exe
PID 1744 wrote to memory of 1068	1744	lSQSMS1aatHclJP.exe	lSQSMS1aatHclJP.exe
PID 1744 wrote to memory of 1068	1744	lSQSMS1aatHclJP.exe	lSQSMS1aatHclJP.exe
PID 1744 wrote to memory of 1068	1744	lSQSMS1aatHclJP.exe	lSQSMS1aatHclJP.exe
PID 1744 wrote to memory of 1068	1744	lSQSMS1aatHclJP.exe	lSQSMS1aatHclJP.exe
PID 1744 wrote to memory of 1068	1744	lSQSMS1aatHclJP.exe	lSQSMS1aatHclJP.exe
PID 1232 wrote to memory of 852	1232	Explorer.EXE	colorcpl.exe
PID 1232 wrote to memory of 852	1232	Explorer.EXE	colorcpl.exe
PID 1232 wrote to memory of 852	1232	Explorer.EXE	colorcpl.exe
PID 1232 wrote to memory of 852	1232	Explorer.EXE	colorcpl.exe
PID 852 wrote to memory of 1668	852	colorcpl.exe	Firefox.exe
PID 852 wrote to memory of 1668	852	colorcpl.exe	Firefox.exe
PID 852 wrote to memory of 1668	852	colorcpl.exe	Firefox.exe
PID 852 wrote to memory of 1668	852	colorcpl.exe	Firefox.exe
PID 852 wrote to memory of 1668	852	colorcpl.exe	Firefox.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1232

C:\Users\Admin\AppData\Local\Temp\lSQSMS1aatHclJP.exe
"C:\Users\Admin\AppData\Local\Temp\lSQSMS1aatHclJP.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1744

C:\Users\Admin\AppData\Local\Temp\lSQSMS1aatHclJP.exe
"C:\Users\Admin\AppData\Local\Temp\lSQSMS1aatHclJP.exe"
3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1068

C:\Windows\SysWOW64\colorcpl.exe
"C:\Windows\SysWOW64\colorcpl.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:852

C:\Program Files\Mozilla Firefox\Firefox.exe
"C:\Program Files\Mozilla Firefox\Firefox.exe"
3⤵
PID:1668

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\sqlite3.dll

Filesize
837KB

MD5
e1b58e0aa1b377a1d0e940660ad1ace1

SHA1
5afc7291b26855b1252b26381ebc85ed3cca218f

SHA256
1b98c006231d38524e2278a474c49274fe42e0bb1a31bcfda02e6e32f559b777

SHA512
9ce778bcb586638662b090910c4ceab3b64e16dfaf905a7581c1d349fecdf186995b3cc0dc8c6fc6e9761ea2831d7b14ac1619c2bd5ebc6d18015842e5d94aa2

Download Submit
memory/852-72-0x0000000000000000-mapping.dmp

Download
memory/852-81-0x0000000000080000-0x00000000000AD000-memory.dmp

Filesize
180KB

Download
memory/852-79-0x0000000000620000-0x00000000006AF000-memory.dmp

Filesize
572KB

Download
memory/852-75-0x0000000000080000-0x00000000000AD000-memory.dmp

Filesize
180KB

Download
memory/852-76-0x00000000020B0000-0x00000000023B3000-memory.dmp

Filesize
3.0MB

Download
memory/852-74-0x0000000000570000-0x0000000000588000-memory.dmp

Filesize
96KB

Download
memory/1068-60-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1068-61-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1068-64-0x00000000004012B0-mapping.dmp

Download
memory/1068-66-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1068-67-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1068-68-0x0000000000401000-0x000000000042F000-memory.dmp

Filesize
184KB

Download
memory/1068-69-0x0000000000990000-0x0000000000C93000-memory.dmp

Filesize
3.0MB

Download
memory/1068-70-0x0000000000110000-0x0000000000120000-memory.dmp

Filesize
64KB

Download
memory/1068-63-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1232-71-0x0000000004C50000-0x0000000004DA6000-memory.dmp

Filesize
1.3MB

Download
memory/1232-77-0x000007FEF6300000-0x000007FEF6443000-memory.dmp

Filesize
1.3MB

Download
memory/1232-78-0x000007FEB0D60000-0x000007FEB0D6A000-memory.dmp

Filesize
40KB

Download
memory/1232-80-0x0000000004DB0000-0x0000000004F0D000-memory.dmp

Filesize
1.4MB

Download
memory/1232-82-0x0000000004DB0000-0x0000000004F0D000-memory.dmp

Filesize
1.4MB

Download
memory/1744-54-0x00000000013B0000-0x000000000146E000-memory.dmp

Filesize
760KB

Download
memory/1744-59-0x0000000004870000-0x00000000048A4000-memory.dmp

Filesize
208KB

Download
memory/1744-58-0x0000000005BF0000-0x0000000005C60000-memory.dmp

Filesize
448KB

Download
memory/1744-57-0x0000000000480000-0x000000000048A000-memory.dmp

Filesize
40KB

Download
memory/1744-56-0x0000000000470000-0x0000000000486000-memory.dmp

Filesize
88KB

Download
memory/1744-55-0x0000000076771000-0x0000000076773000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads