formbook | 9472d7a4e6028ef04c5b1a1a57844a3198229bd209b68c1d3534123e4fad8fb2

Analysis

max time kernel
148s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
14/03/2023, 09:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MTCN TELLER RECEIPT.exe
Size

237KB
MD5

f9726a7a881f7182123ee36679c4d09b
SHA1

53b28856a51b66195ff4a3b799642b8d1f7025db
SHA256

9472d7a4e6028ef04c5b1a1a57844a3198229bd209b68c1d3534123e4fad8fb2
SHA512

1ea087c3d7311dbd07eeb03c4ca9ef37236fac517f11a305849ab022b8645baffd947d9e794f0418b6050a25f4a3b8f35137ad5f76591cb10e526df04050ac02
SSDEEP

6144:/Ya6i74F0L4ddME6oV38O0+yn9utn3HND:/YUcmL4X6oB8O0+Nt3HND

Score

10^/10

formbook ke03 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ke03

Decoy

fastartcustom.com

ikanggabus.xyz

aevum.ru

lacarretapps.com

arcaneacquisitions.net

fuulyshop.com

bloodbahis278.com

bullardrvpark.com

cowboy-hostel.xyz

empireoba.com

the-windsor-h.africa

help-desk-td.com

dofirosols.life

efefarmy.buzz

kewwrf.top

autoran.co.uk

moodysanalytics.boo

kulturemarket.com

ffwpu-kenya.com

heykon.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/2096-142-0x0000000000600000-0x000000000062F000-memory.dmp	formbook
behavioral2/memory/640-153-0x00000000008C0000-0x00000000008EF000-memory.dmp	formbook
behavioral2/memory/640-155-0x00000000008C0000-0x00000000008EF000-memory.dmp	formbook

Executes dropped EXE 2 IoCs

pid	Process
2140	otmflulrvh.exe
2096	otmflulrvh.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2140 set thread context of 2096	2140	otmflulrvh.exe	86
PID 2096 set thread context of 3236	2096	otmflulrvh.exe	24
PID 640 set thread context of 3236	640	mstsc.exe	24

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 60 IoCs

pid	Process
2096	otmflulrvh.exe
2096	otmflulrvh.exe
2096	otmflulrvh.exe
2096	otmflulrvh.exe
640	mstsc.exe
640	mstsc.exe
640	mstsc.exe
640	mstsc.exe
640	mstsc.exe
640	mstsc.exe
640	mstsc.exe
640	mstsc.exe
640	mstsc.exe
640	mstsc.exe
640	mstsc.exe
640	mstsc.exe
640	mstsc.exe
640	mstsc.exe
640	mstsc.exe
640	mstsc.exe
640	mstsc.exe
640	mstsc.exe
640	mstsc.exe
640	mstsc.exe
640	mstsc.exe
640	mstsc.exe
640	mstsc.exe
640	mstsc.exe
640	mstsc.exe
640	mstsc.exe
640	mstsc.exe
640	mstsc.exe
640	mstsc.exe
640	mstsc.exe
640	mstsc.exe
640	mstsc.exe
640	mstsc.exe
640	mstsc.exe
640	mstsc.exe
640	mstsc.exe
640	mstsc.exe
640	mstsc.exe
640	mstsc.exe
640	mstsc.exe
640	mstsc.exe
640	mstsc.exe
640	mstsc.exe
640	mstsc.exe
640	mstsc.exe
640	mstsc.exe
640	mstsc.exe
640	mstsc.exe
640	mstsc.exe
640	mstsc.exe
640	mstsc.exe
640	mstsc.exe
640	mstsc.exe
640	mstsc.exe
640	mstsc.exe
640	mstsc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3236	Explorer.EXE

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
2140	otmflulrvh.exe
2140	otmflulrvh.exe
2096	otmflulrvh.exe
2096	otmflulrvh.exe
2096	otmflulrvh.exe
640	mstsc.exe
640	mstsc.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	2096	otmflulrvh.exe
Token: SeDebugPrivilege	640	mstsc.exe
Token: SeShutdownPrivilege	3236	Explorer.EXE
Token: SeCreatePagefilePrivilege	3236	Explorer.EXE
Token: SeShutdownPrivilege	3236	Explorer.EXE
Token: SeCreatePagefilePrivilege	3236	Explorer.EXE
Token: SeShutdownPrivilege	3236	Explorer.EXE
Token: SeCreatePagefilePrivilege	3236	Explorer.EXE
Token: SeShutdownPrivilege	3236	Explorer.EXE
Token: SeCreatePagefilePrivilege	3236	Explorer.EXE
Token: SeShutdownPrivilege	3236	Explorer.EXE
Token: SeCreatePagefilePrivilege	3236	Explorer.EXE
Token: SeShutdownPrivilege	3236	Explorer.EXE
Token: SeCreatePagefilePrivilege	3236	Explorer.EXE
Token: SeShutdownPrivilege	3236	Explorer.EXE
Token: SeCreatePagefilePrivilege	3236	Explorer.EXE
Token: SeShutdownPrivilege	3236	Explorer.EXE
Token: SeCreatePagefilePrivilege	3236	Explorer.EXE

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 2140	1336	MTCN TELLER RECEIPT.exe	85
PID 1336 wrote to memory of 2140	1336	MTCN TELLER RECEIPT.exe	85
PID 1336 wrote to memory of 2140	1336	MTCN TELLER RECEIPT.exe	85
PID 2140 wrote to memory of 2096	2140	otmflulrvh.exe	86
PID 2140 wrote to memory of 2096	2140	otmflulrvh.exe	86
PID 2140 wrote to memory of 2096	2140	otmflulrvh.exe	86
PID 2140 wrote to memory of 2096	2140	otmflulrvh.exe	86
PID 3236 wrote to memory of 640	3236	Explorer.EXE	87
PID 3236 wrote to memory of 640	3236	Explorer.EXE	87
PID 3236 wrote to memory of 640	3236	Explorer.EXE	87
PID 640 wrote to memory of 1256	640	mstsc.exe	91
PID 640 wrote to memory of 1256	640	mstsc.exe	91
PID 640 wrote to memory of 1256	640	mstsc.exe	91

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3236
- C:\Users\Admin\AppData\Local\Temp\MTCN TELLER RECEIPT.exe
  "C:\Users\Admin\AppData\Local\Temp\MTCN TELLER RECEIPT.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1336
- - C:\Users\Admin\AppData\Local\Temp\otmflulrvh.exe
    "C:\Users\Admin\AppData\Local\Temp\otmflulrvh.exe" C:\Users\Admin\AppData\Local\Temp\qubvvmzl.rk
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2140
  - - C:\Users\Admin\AppData\Local\Temp\otmflulrvh.exe
      "C:\Users\Admin\AppData\Local\Temp\otmflulrvh.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:2096
- C:\Windows\SysWOW64\mstsc.exe
  "C:\Windows\SysWOW64\mstsc.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:640
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\otmflulrvh.exe"
    3⤵
    PID:1256

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\oiaib.rm

Filesize
205KB

MD5
6c642712d39637fc8ced74cb3dcc7903

SHA1
ff0ddab33f478889515a061e7763f235450cb8f9

SHA256
3349be17dc030f34b0d2a9067897b91b45d87d585531fc108463be9174aab3c8

SHA512
290e24095925a6ce7c48e523f8fbccd22e8aab4481bd437850d411dd79f7f8cefa015aff0838b1d565c07a6623f4045aa904093a889b7d0a0b7fd7cf4baaa9b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\otmflulrvh.exe

Filesize
5KB

MD5
086d2e81b0c19b74943ac4eeeb459a56

SHA1
448a2e6b3441d26c30ee12dc7d93de8a9c459c66

SHA256
af3ebfddb7d9356ba8272014df8a10fed3c0ce25f17d0958e34daee4bef90b77

SHA512
bebbdb06bff5e6ed36cf9a9e4bfe2230feeb0ad8e0d3192e835dbabf12eeaae2a784c9608ad91cc5d6e8ee7a1f413e1a7f29855f8371eef9db0dc3a894c74a9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\otmflulrvh.exe

Filesize
5KB

MD5
086d2e81b0c19b74943ac4eeeb459a56

SHA1
448a2e6b3441d26c30ee12dc7d93de8a9c459c66

SHA256
af3ebfddb7d9356ba8272014df8a10fed3c0ce25f17d0958e34daee4bef90b77

SHA512
bebbdb06bff5e6ed36cf9a9e4bfe2230feeb0ad8e0d3192e835dbabf12eeaae2a784c9608ad91cc5d6e8ee7a1f413e1a7f29855f8371eef9db0dc3a894c74a9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\otmflulrvh.exe

Filesize
5KB

MD5
086d2e81b0c19b74943ac4eeeb459a56

SHA1
448a2e6b3441d26c30ee12dc7d93de8a9c459c66

SHA256
af3ebfddb7d9356ba8272014df8a10fed3c0ce25f17d0958e34daee4bef90b77

SHA512
bebbdb06bff5e6ed36cf9a9e4bfe2230feeb0ad8e0d3192e835dbabf12eeaae2a784c9608ad91cc5d6e8ee7a1f413e1a7f29855f8371eef9db0dc3a894c74a9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\qubvvmzl.rk

Filesize
5KB

MD5
bc7836f77f8028836397e690f4e998ed

SHA1
dedfbfcb4399bf6e90a2005ae6911b602ff2fef1

SHA256
fd133ec88368b5125c6e886efc0f30e345eec49a887169a904601fb3c5e50dcf

SHA512
167e5f00b11409cade03214794bb146ff7db3ab62fd44620fddd98b64c81049ae5de4ccc57320a205554e957e6ce6b306a4525fec0d954b7629c819ce478c8af

Download Submit
memory/640-153-0x00000000008C0000-0x00000000008EF000-memory.dmp

Filesize
188KB

Download
memory/640-157-0x00000000026D0000-0x0000000002763000-memory.dmp

Filesize
588KB

Download
memory/640-155-0x00000000008C0000-0x00000000008EF000-memory.dmp

Filesize
188KB

Download
memory/640-154-0x0000000002890000-0x0000000002BDA000-memory.dmp

Filesize
3.3MB

Download
memory/640-150-0x0000000000310000-0x000000000044A000-memory.dmp

Filesize
1.2MB

Download
memory/640-152-0x0000000000310000-0x000000000044A000-memory.dmp

Filesize
1.2MB

Download
memory/2096-142-0x0000000000600000-0x000000000062F000-memory.dmp

Filesize
188KB

Download
memory/2096-148-0x0000000000A00000-0x0000000000A14000-memory.dmp

Filesize
80KB

Download
memory/2096-147-0x0000000000EA0000-0x00000000011EA000-memory.dmp

Filesize
3.3MB

Download
memory/3236-149-0x0000000008430000-0x0000000008539000-memory.dmp

Filesize
1.0MB

Download
memory/3236-158-0x0000000002740000-0x0000000002821000-memory.dmp

Filesize
900KB

Download
memory/3236-159-0x0000000002740000-0x0000000002821000-memory.dmp

Filesize
900KB

Download
memory/3236-161-0x0000000002740000-0x0000000002821000-memory.dmp

Filesize
900KB

Download