formbook | 1c9b6b93ad7226b05cbb54ac2be814395269877ed8d48e2d22fd06318d0139fc

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
08-03-2023 10:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9123b739b8d3d1c2f5a3dabf8c358c77175422d0e83f5edadc7584bd50eb484c.exe
Size

264KB
MD5

c1a8c992aac5a10c6ca89cedb772d567
SHA1

99ad74abf2717a297260df450e105e8a40cd16fc
SHA256

9123b739b8d3d1c2f5a3dabf8c358c77175422d0e83f5edadc7584bd50eb484c
SHA512

cb3f735fa6f68fca72e596a658db049141ce2319b718df578f755efc9d2f302c1b3407e1a6190d3dee1c4c67f7a33e2440dc117f4cfef16301f2e1c303fed450
SSDEEP

6144:gYa6+YxKBm16Bj9lWAbkKXVa9S02ZVh2Qs/cEpeXzhdGZbghHrOSh:gYI7maj9tk9Svu/cW0zhsKhFh

Score

10^/10

formbook bn26 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

bn26

Decoy

juweipai.com

assurance-mon-espace-sante.com

robqq.com

ablindear.com

socialmonkeys.co.uk

learningworldtech.com

imprese-it.com

themoodcollectives.africa

lutonmethodists.org.uk

castawaycovebnb.com

caronthemove.com

carolinacastro.uk

dcfashionweekintl.com

branchbasicsa.com

drpatrickakinsanya.africa

inventourownfuture.com

applege.top

whatamitiredof.com

daphan.pics

gardenstatevinyl.net

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/1188-69-0x00000000000B0000-0x00000000000DF000-memory.dmp	formbook

Executes dropped EXE 2 IoCs

pid	Process
1336	ovyvcwwn.exe
1188	ovyvcwwn.exe

Loads dropped DLL 6 IoCs

pid	Process
1320	9123b739b8d3d1c2f5a3dabf8c358c77175422d0e83f5edadc7584bd50eb484c.exe
1320	9123b739b8d3d1c2f5a3dabf8c358c77175422d0e83f5edadc7584bd50eb484c.exe
1336	ovyvcwwn.exe
524	WerFault.exe
524	WerFault.exe
524	WerFault.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1336 set thread context of 1188	1336	ovyvcwwn.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
524	1188	WerFault.exe	29

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1336	ovyvcwwn.exe
1336	ovyvcwwn.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 1336	1320	9123b739b8d3d1c2f5a3dabf8c358c77175422d0e83f5edadc7584bd50eb484c.exe	28
PID 1320 wrote to memory of 1336	1320	9123b739b8d3d1c2f5a3dabf8c358c77175422d0e83f5edadc7584bd50eb484c.exe	28
PID 1320 wrote to memory of 1336	1320	9123b739b8d3d1c2f5a3dabf8c358c77175422d0e83f5edadc7584bd50eb484c.exe	28
PID 1320 wrote to memory of 1336	1320	9123b739b8d3d1c2f5a3dabf8c358c77175422d0e83f5edadc7584bd50eb484c.exe	28
PID 1336 wrote to memory of 1188	1336	ovyvcwwn.exe	29
PID 1336 wrote to memory of 1188	1336	ovyvcwwn.exe	29
PID 1336 wrote to memory of 1188	1336	ovyvcwwn.exe	29
PID 1336 wrote to memory of 1188	1336	ovyvcwwn.exe	29
PID 1336 wrote to memory of 1188	1336	ovyvcwwn.exe	29
PID 1188 wrote to memory of 524	1188	ovyvcwwn.exe	30
PID 1188 wrote to memory of 524	1188	ovyvcwwn.exe	30
PID 1188 wrote to memory of 524	1188	ovyvcwwn.exe	30
PID 1188 wrote to memory of 524	1188	ovyvcwwn.exe	30

C:\Users\Admin\AppData\Local\Temp\9123b739b8d3d1c2f5a3dabf8c358c77175422d0e83f5edadc7584bd50eb484c.exe
"C:\Users\Admin\AppData\Local\Temp\9123b739b8d3d1c2f5a3dabf8c358c77175422d0e83f5edadc7584bd50eb484c.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Users\Admin\AppData\Local\Temp\ovyvcwwn.exe
  "C:\Users\Admin\AppData\Local\Temp\ovyvcwwn.exe" C:\Users\Admin\AppData\Local\Temp\qjiixipuri.re
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1336
- - C:\Users\Admin\AppData\Local\Temp\ovyvcwwn.exe
    "C:\Users\Admin\AppData\Local\Temp\ovyvcwwn.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1188
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1188 -s 36
      4⤵
      Loads dropped DLL
      Program crash
      PID:524

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ovyvcwwn.exe

Filesize
6KB

MD5
06732507c8b0860440725eaba06eb440

SHA1
d529c223cb33c5586fe34203c97eaf07a964ce9a

SHA256
3aedbd25541f571cfbe801e124a93f78f31f43048891862ed7c93bb5281f7192

SHA512
d65af28d6d01edd3f55fabdc6742f7ab6f011cef7f6ba615f8ab0c9e1bb38b375a31e5a06cd29df615a377ff9c051c411a908d98d2fbcf3369250c5898103d85

Download Submit
C:\Users\Admin\AppData\Local\Temp\ovyvcwwn.exe

Filesize
6KB

MD5
06732507c8b0860440725eaba06eb440

SHA1
d529c223cb33c5586fe34203c97eaf07a964ce9a

SHA256
3aedbd25541f571cfbe801e124a93f78f31f43048891862ed7c93bb5281f7192

SHA512
d65af28d6d01edd3f55fabdc6742f7ab6f011cef7f6ba615f8ab0c9e1bb38b375a31e5a06cd29df615a377ff9c051c411a908d98d2fbcf3369250c5898103d85

Download Submit
C:\Users\Admin\AppData\Local\Temp\ovyvcwwn.exe

Filesize
6KB

MD5
06732507c8b0860440725eaba06eb440

SHA1
d529c223cb33c5586fe34203c97eaf07a964ce9a

SHA256
3aedbd25541f571cfbe801e124a93f78f31f43048891862ed7c93bb5281f7192

SHA512
d65af28d6d01edd3f55fabdc6742f7ab6f011cef7f6ba615f8ab0c9e1bb38b375a31e5a06cd29df615a377ff9c051c411a908d98d2fbcf3369250c5898103d85

Download Submit
C:\Users\Admin\AppData\Local\Temp\ovyvcwwn.exe

Filesize
6KB

MD5
06732507c8b0860440725eaba06eb440

SHA1
d529c223cb33c5586fe34203c97eaf07a964ce9a

SHA256
3aedbd25541f571cfbe801e124a93f78f31f43048891862ed7c93bb5281f7192

SHA512
d65af28d6d01edd3f55fabdc6742f7ab6f011cef7f6ba615f8ab0c9e1bb38b375a31e5a06cd29df615a377ff9c051c411a908d98d2fbcf3369250c5898103d85

Download Submit
C:\Users\Admin\AppData\Local\Temp\qjiixipuri.re

Filesize
5KB

MD5
f149e350e181be4cf2c638f2bdfcc587

SHA1
03c3de809de0612b1efd0bcdfd4bb32def023c86

SHA256
ea29e25950d73a7e92b759e59643a2988dcb0972c3405fedd530c402e786bca3

SHA512
a96da28136d0cfc10884a1f4aa0ca621bba0f1bedb9ede4946de9bb34aadedd0ce99e642a9fd8bd1f85ba2c00bd8cb0012f7b6cae73d15cc9756e7af14056744

Download Submit
C:\Users\Admin\AppData\Local\Temp\udaibslayym.nnq

Filesize
205KB

MD5
b4acf2ff536265e3d417db161855c925

SHA1
9871b0a7218133cd34f9ab346990030fbda91cf8

SHA256
9910edbcea80e2b839e99a143d3870c27eea211a248692e95e76c51ec9c91b27

SHA512
64a84f6e641badd29c20df4af97a95436cc4a1095d0d04b7dfc7e83c58e8a2a73da86f30f655150488be7405f6c95bc2998e89d6658bcf91a3b8663b84762914

Download Submit
\Users\Admin\AppData\Local\Temp\ovyvcwwn.exe

Filesize
6KB

MD5
06732507c8b0860440725eaba06eb440

SHA1
d529c223cb33c5586fe34203c97eaf07a964ce9a

SHA256
3aedbd25541f571cfbe801e124a93f78f31f43048891862ed7c93bb5281f7192

SHA512
d65af28d6d01edd3f55fabdc6742f7ab6f011cef7f6ba615f8ab0c9e1bb38b375a31e5a06cd29df615a377ff9c051c411a908d98d2fbcf3369250c5898103d85

Download Submit
\Users\Admin\AppData\Local\Temp\ovyvcwwn.exe

Filesize
6KB

MD5
06732507c8b0860440725eaba06eb440

SHA1
d529c223cb33c5586fe34203c97eaf07a964ce9a

SHA256
3aedbd25541f571cfbe801e124a93f78f31f43048891862ed7c93bb5281f7192

SHA512
d65af28d6d01edd3f55fabdc6742f7ab6f011cef7f6ba615f8ab0c9e1bb38b375a31e5a06cd29df615a377ff9c051c411a908d98d2fbcf3369250c5898103d85

Download Submit
\Users\Admin\AppData\Local\Temp\ovyvcwwn.exe

Filesize
6KB

MD5
06732507c8b0860440725eaba06eb440

SHA1
d529c223cb33c5586fe34203c97eaf07a964ce9a

SHA256
3aedbd25541f571cfbe801e124a93f78f31f43048891862ed7c93bb5281f7192

SHA512
d65af28d6d01edd3f55fabdc6742f7ab6f011cef7f6ba615f8ab0c9e1bb38b375a31e5a06cd29df615a377ff9c051c411a908d98d2fbcf3369250c5898103d85

Download Submit
\Users\Admin\AppData\Local\Temp\ovyvcwwn.exe

Filesize
6KB

MD5
06732507c8b0860440725eaba06eb440

SHA1
d529c223cb33c5586fe34203c97eaf07a964ce9a

SHA256
3aedbd25541f571cfbe801e124a93f78f31f43048891862ed7c93bb5281f7192

SHA512
d65af28d6d01edd3f55fabdc6742f7ab6f011cef7f6ba615f8ab0c9e1bb38b375a31e5a06cd29df615a377ff9c051c411a908d98d2fbcf3369250c5898103d85

Download Submit
\Users\Admin\AppData\Local\Temp\ovyvcwwn.exe

Filesize
6KB

MD5
06732507c8b0860440725eaba06eb440

SHA1
d529c223cb33c5586fe34203c97eaf07a964ce9a

SHA256
3aedbd25541f571cfbe801e124a93f78f31f43048891862ed7c93bb5281f7192

SHA512
d65af28d6d01edd3f55fabdc6742f7ab6f011cef7f6ba615f8ab0c9e1bb38b375a31e5a06cd29df615a377ff9c051c411a908d98d2fbcf3369250c5898103d85

Download Submit
\Users\Admin\AppData\Local\Temp\ovyvcwwn.exe

Filesize
6KB

MD5
06732507c8b0860440725eaba06eb440

SHA1
d529c223cb33c5586fe34203c97eaf07a964ce9a

SHA256
3aedbd25541f571cfbe801e124a93f78f31f43048891862ed7c93bb5281f7192

SHA512
d65af28d6d01edd3f55fabdc6742f7ab6f011cef7f6ba615f8ab0c9e1bb38b375a31e5a06cd29df615a377ff9c051c411a908d98d2fbcf3369250c5898103d85

Download Submit
memory/1188-69-0x00000000000B0000-0x00000000000DF000-memory.dmp

Filesize
188KB

Download