formbook | ac08f1d3518dfe35c2d802992008d4a6750c6e83b9b7c4ed32be68c49bde40be

General

Target

Compr..NotaFiscal3713.xls
Size

1.2MB
MD5

0765692957ce1a7d381daf4d254e0dc1
SHA1

d32070796d799a70d20889773f54870b7a564ad7
SHA256

ac08f1d3518dfe35c2d802992008d4a6750c6e83b9b7c4ed32be68c49bde40be
SHA512

3463acb361a08aebf8d20638454f8bdb40422f88bf28cf7f0dbf8229b0466da74b8e66feb6fdeaac218b6861b5868edcfb7cbcffc7759e239d2d1ed67c5d543e
SSDEEP

24576:GHu9V1ZyFw6VzAZypw6V1ipbmcwTA5G8cmuwwzx:GHu396Vzy16VqmjTJmuwQ

Score

10^/10

formbook ms14 discovery rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ms14

Decoy

adjoinstaff.online

kmmdznky.cfd

keyviewgroup.com

kidomarketing.com

jroxtqpq.cfd

jdevmx.com

genqaagz.cfd

1cdpwp.cfd

francegoldvip.com

2qy218.xyz

peterscanner.com

trullys.com

aniwatch.top

windyhillcnc.com

pokazhu.com

r74jsy.cfd

paulgadgets.com

lindanewtee.com

lasik-de-de-8808230.zone

critone.site

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 4 IoCs

rat

resource	yara_rule
behavioral1/memory/2672-93-0x0000000000400000-0x0000000001462000-memory.dmp	formbook
behavioral1/memory/2672-97-0x0000000000400000-0x0000000001462000-memory.dmp	formbook
behavioral1/memory/2928-105-0x0000000000080000-0x00000000000AE000-memory.dmp	formbook
behavioral1/memory/2928-107-0x0000000000080000-0x00000000000AE000-memory.dmp	formbook

Blocklisted process makes network request 1 IoCs

flow	pid	Process
3	2696	EQNEDT32.EXE

Downloads MZ/PE file

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	IBM_Centitos.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	IBM_Centitos.exe

Executes dropped EXE 1 IoCs

pid	Process
2856	IBM_Centitos.exe

Loads dropped DLL 4 IoCs

pid	Process
2696	EQNEDT32.EXE
2856	IBM_Centitos.exe
2856	IBM_Centitos.exe
2672	IBM_Centitos.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
2672	IBM_Centitos.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2856	IBM_Centitos.exe
2672	IBM_Centitos.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2856 set thread context of 2672	2856	IBM_Centitos.exe	33
PID 2672 set thread context of 1192	2672	IBM_Centitos.exe	15
PID 2928 set thread context of 1192	2928	colorcpl.exe	15

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\sansningerne.Unc	IBM_Centitos.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\0409\Katje\falsebenet\Bike\Angivende.ini	IBM_Centitos.exe
File opened for modification	C:\Windows\resources\0409\Hovedgaarde.For	IBM_Centitos.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 12 IoCs

installer

resource	yara_rule
behavioral1/files/0x0006000000017183-67.dat	nsis_installer_1
behavioral1/files/0x0006000000017183-67.dat	nsis_installer_2
behavioral1/files/0x0006000000017183-68.dat	nsis_installer_1
behavioral1/files/0x0006000000017183-68.dat	nsis_installer_2
behavioral1/files/0x0006000000017183-71.dat	nsis_installer_1
behavioral1/files/0x0006000000017183-71.dat	nsis_installer_2
behavioral1/files/0x0006000000017183-72.dat	nsis_installer_1
behavioral1/files/0x0006000000017183-72.dat	nsis_installer_2
behavioral1/files/0x0006000000017183-85.dat	nsis_installer_1
behavioral1/files/0x0006000000017183-85.dat	nsis_installer_2
behavioral1/files/0x0006000000017183-87.dat	nsis_installer_1
behavioral1/files/0x0006000000017183-87.dat	nsis_installer_2

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Launches Equation Editor 1 TTPs 1 IoCs

Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

exploit

Exploitation for Client Execution

T1203

pid	Process
2696	EQNEDT32.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2488	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2672	IBM_Centitos.exe
2672	IBM_Centitos.exe
2928	colorcpl.exe
2928	colorcpl.exe
2928	colorcpl.exe
2928	colorcpl.exe
2928	colorcpl.exe
2928	colorcpl.exe
2928	colorcpl.exe
2928	colorcpl.exe
2928	colorcpl.exe
2928	colorcpl.exe
2928	colorcpl.exe
2928	colorcpl.exe
2928	colorcpl.exe
2928	colorcpl.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1192	Explorer.EXE

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
2856	IBM_Centitos.exe
2672	IBM_Centitos.exe
2672	IBM_Centitos.exe
2672	IBM_Centitos.exe
2928	colorcpl.exe
2928	colorcpl.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2672	IBM_Centitos.exe
Token: SeShutdownPrivilege	1192	Explorer.EXE
Token: SeDebugPrivilege	2928	colorcpl.exe
Token: SeShutdownPrivilege	1192	Explorer.EXE
Token: SeShutdownPrivilege	1192	Explorer.EXE

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2488	EXCEL.EXE
2488	EXCEL.EXE
2488	EXCEL.EXE
2488	EXCEL.EXE
2488	EXCEL.EXE

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 2856	2696	EQNEDT32.EXE	29
PID 2696 wrote to memory of 2856	2696	EQNEDT32.EXE	29
PID 2696 wrote to memory of 2856	2696	EQNEDT32.EXE	29
PID 2696 wrote to memory of 2856	2696	EQNEDT32.EXE	29
PID 2856 wrote to memory of 2672	2856	IBM_Centitos.exe	33
PID 2856 wrote to memory of 2672	2856	IBM_Centitos.exe	33
PID 2856 wrote to memory of 2672	2856	IBM_Centitos.exe	33
PID 2856 wrote to memory of 2672	2856	IBM_Centitos.exe	33
PID 2856 wrote to memory of 2672	2856	IBM_Centitos.exe	33
PID 1192 wrote to memory of 2928	1192	Explorer.EXE	35
PID 1192 wrote to memory of 2928	1192	Explorer.EXE	35
PID 1192 wrote to memory of 2928	1192	Explorer.EXE	35
PID 1192 wrote to memory of 2928	1192	Explorer.EXE	35
PID 2928 wrote to memory of 2908	2928	colorcpl.exe	36
PID 2928 wrote to memory of 2908	2928	colorcpl.exe	36
PID 2928 wrote to memory of 2908	2928	colorcpl.exe	36
PID 2928 wrote to memory of 2908	2928	colorcpl.exe	36

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
  "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\Compr..NotaFiscal3713.xls
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:2488
- C:\Windows\SysWOW64\colorcpl.exe
  "C:\Windows\SysWOW64\colorcpl.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2928
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\IBM_Centitos.exe"
    3⤵
    PID:2908

C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Users\Admin\AppData\Local\Temp\IBM_Centitos.exe
  "C:\Users\Admin\AppData\Local\Temp\IBM_Centitos.exe"
  2⤵
  - Checks QEMU agent file
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\Users\Admin\AppData\Local\Temp\IBM_Centitos.exe
    "C:\Users\Admin\AppData\Local\Temp\IBM_Centitos.exe"
    3⤵
    - Checks QEMU agent file
    - Loads dropped DLL
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:2672

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Exploitation for Client Execution

1

T1203

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\6AF9D45A.emf

Filesize
1.4MB

MD5
a01b9617553432807b9b58025b338d97

SHA1
439bdcc450408b9735b2428c2d53d2e6977fa58c

SHA256
7a0426ed2e2349916969ff7087c0f76089fb8ce7f4627f3d11ccbc1aaefcedce

SHA512
312cc2563fa865d6a939fea85a520627c73ed9a95bafc98c89495f21d535dc658825be74b64f0f5c5815d1d234fc6e77a71779247e4973e39ba8dccec2f09bee

Download Submit
C:\Users\Admin\AppData\Local\Temp\IBM_Centitos.exe

Filesize
255KB

MD5
5cad52271422b36941487ad44a7ade44

SHA1
0fa6ba3c9799301fcdb529abcb5d7098c5c3fdba

SHA256
0cffea5daeb941cc6235f4de2fe2ba348ff08742d196ffc68bc8d7f1109596fd

SHA512
b2a583bff19ace982d3f722c60d5331711a966b000f748e251b83f52eba32185f7469bcc4c0f298d7f0f3876518b0848410667067d2f3187b439a18a6ae192ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\IBM_Centitos.exe

Filesize
255KB

MD5
5cad52271422b36941487ad44a7ade44

SHA1
0fa6ba3c9799301fcdb529abcb5d7098c5c3fdba

SHA256
0cffea5daeb941cc6235f4de2fe2ba348ff08742d196ffc68bc8d7f1109596fd

SHA512
b2a583bff19ace982d3f722c60d5331711a966b000f748e251b83f52eba32185f7469bcc4c0f298d7f0f3876518b0848410667067d2f3187b439a18a6ae192ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\IBM_Centitos.exe

Filesize
255KB

MD5
5cad52271422b36941487ad44a7ade44

SHA1
0fa6ba3c9799301fcdb529abcb5d7098c5c3fdba

SHA256
0cffea5daeb941cc6235f4de2fe2ba348ff08742d196ffc68bc8d7f1109596fd

SHA512
b2a583bff19ace982d3f722c60d5331711a966b000f748e251b83f52eba32185f7469bcc4c0f298d7f0f3876518b0848410667067d2f3187b439a18a6ae192ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\IBM_Centitos.exe

Filesize
255KB

MD5
5cad52271422b36941487ad44a7ade44

SHA1
0fa6ba3c9799301fcdb529abcb5d7098c5c3fdba

SHA256
0cffea5daeb941cc6235f4de2fe2ba348ff08742d196ffc68bc8d7f1109596fd

SHA512
b2a583bff19ace982d3f722c60d5331711a966b000f748e251b83f52eba32185f7469bcc4c0f298d7f0f3876518b0848410667067d2f3187b439a18a6ae192ab

Download Submit
\Users\Admin\AppData\Local\Temp\IBM_Centitos.exe

Filesize
255KB

MD5
5cad52271422b36941487ad44a7ade44

SHA1
0fa6ba3c9799301fcdb529abcb5d7098c5c3fdba

SHA256
0cffea5daeb941cc6235f4de2fe2ba348ff08742d196ffc68bc8d7f1109596fd

SHA512
b2a583bff19ace982d3f722c60d5331711a966b000f748e251b83f52eba32185f7469bcc4c0f298d7f0f3876518b0848410667067d2f3187b439a18a6ae192ab

Download Submit
\Users\Admin\AppData\Local\Temp\IBM_Centitos.exe

Filesize
255KB

MD5
5cad52271422b36941487ad44a7ade44

SHA1
0fa6ba3c9799301fcdb529abcb5d7098c5c3fdba

SHA256
0cffea5daeb941cc6235f4de2fe2ba348ff08742d196ffc68bc8d7f1109596fd

SHA512
b2a583bff19ace982d3f722c60d5331711a966b000f748e251b83f52eba32185f7469bcc4c0f298d7f0f3876518b0848410667067d2f3187b439a18a6ae192ab

Download Submit
\Users\Admin\AppData\Local\Temp\nso81AF.tmp\System.dll

Filesize
11KB

MD5
375e8a08471dc6f85f3828488b1147b3

SHA1
1941484ac710fc301a7d31d6f1345e32a21546af

SHA256
4c86b238e64ecfaabe322a70fd78db229a663ccc209920f3385596a6e3205f78

SHA512
5ba29db13723ddf27b265a4548606274b850d076ae1f050c64044f8ccd020585ad766c85c3e20003a22f356875f76fb3679c89547b0962580d8e5a42b082b9a8

Download Submit
memory/1192-117-0x0000000007380000-0x00000000074EA000-memory.dmp

Filesize
1.4MB

Download
memory/1192-99-0x00000000048F0000-0x0000000004A24000-memory.dmp

Filesize
1.2MB

Download
memory/1192-139-0x000007FEF6260000-0x000007FEF63A3000-memory.dmp

Filesize
1.3MB

Download
memory/1192-140-0x000007FEE35F0000-0x000007FEE35FA000-memory.dmp

Filesize
40KB

Download
memory/1192-118-0x0000000077AC3000-0x0000000077AC4000-memory.dmp

Filesize
4KB

Download
memory/1192-136-0x0000000007380000-0x00000000074EA000-memory.dmp

Filesize
1.4MB

Download
memory/1192-137-0x0000000007380000-0x00000000074EA000-memory.dmp

Filesize
1.4MB

Download
memory/2488-54-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2488-82-0x000000007405D000-0x0000000074068000-memory.dmp

Filesize
44KB

Download
memory/2488-55-0x000000007405D000-0x0000000074068000-memory.dmp

Filesize
44KB

Download
memory/2488-119-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2488-134-0x000000007405D000-0x0000000074068000-memory.dmp

Filesize
44KB

Download
memory/2672-89-0x0000000077BB0000-0x0000000077D59000-memory.dmp

Filesize
1.7MB

Download
memory/2672-98-0x0000000035EF0000-0x0000000035F04000-memory.dmp

Filesize
80KB

Download
memory/2672-97-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2672-95-0x0000000036350000-0x0000000036653000-memory.dmp

Filesize
3.0MB

Download
memory/2672-100-0x0000000001470000-0x0000000006139000-memory.dmp

Filesize
76.8MB

Download
memory/2672-94-0x0000000001470000-0x0000000006139000-memory.dmp

Filesize
76.8MB

Download
memory/2672-93-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2672-91-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2672-90-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2672-88-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2856-84-0x0000000077DA0000-0x0000000077E76000-memory.dmp

Filesize
856KB

Download
memory/2856-86-0x0000000010000000-0x0000000010006000-memory.dmp

Filesize
24KB

Download
memory/2856-83-0x0000000077BB0000-0x0000000077D59000-memory.dmp

Filesize
1.7MB

Download
memory/2928-109-0x0000000001D90000-0x0000000001E23000-memory.dmp

Filesize
588KB

Download
memory/2928-107-0x0000000000080000-0x00000000000AE000-memory.dmp

Filesize
184KB

Download
memory/2928-106-0x0000000002080000-0x0000000002383000-memory.dmp

Filesize
3.0MB

Download
memory/2928-105-0x0000000000080000-0x00000000000AE000-memory.dmp

Filesize
184KB

Download
memory/2928-104-0x00000000004B0000-0x00000000004C8000-memory.dmp

Filesize
96KB

Download
memory/2928-101-0x00000000004B0000-0x00000000004C8000-memory.dmp

Filesize
96KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads