formbook | 3631cef235754ade0b7e46898abd5c69f736439897e28b16c141b3e1c8780389

General

Target

QUOTE 367490.xls
Size

1.4MB
MD5

affd47cfa5f9b6138138bbcf3d9bd01a
SHA1

09f8d0372d30cee602b51543fb1e47e41bf99146
SHA256

3631cef235754ade0b7e46898abd5c69f736439897e28b16c141b3e1c8780389
SHA512

d2d05d70343f55f307989cb1f34d02255b80bb8181b3b230ae4d582cc5b2a6ed73f53ee40790266b2e4cf114913dbc6a0b5ef8a4aaded7f945dd1d39edb5f6c0
SSDEEP

24576:K9u9VNZylw6VMOZymw6VqViNhuuvvtg3oqVUbXQwNgZffsLMy5w/x:K9uPR6VMYe6VCiNhv3tsMXXNhLr5E

Score

10^/10

formbook ms14 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ms14

Decoy

adjoinstaff.online

kmmdznky.cfd

keyviewgroup.com

kidomarketing.com

jroxtqpq.cfd

jdevmx.com

genqaagz.cfd

1cdpwp.cfd

francegoldvip.com

2qy218.xyz

peterscanner.com

trullys.com

aniwatch.top

windyhillcnc.com

pokazhu.com

r74jsy.cfd

paulgadgets.com

lindanewtee.com

lasik-de-de-8808230.zone

critone.site

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 4 IoCs

rat

resource	yara_rule
behavioral1/memory/564-90-0x0000000000400000-0x0000000001462000-memory.dmp	formbook
behavioral1/memory/564-95-0x0000000000400000-0x0000000001462000-memory.dmp	formbook
behavioral1/memory/2132-101-0x0000000000080000-0x00000000000AE000-memory.dmp	formbook
behavioral1/memory/2132-105-0x0000000000080000-0x00000000000AE000-memory.dmp	formbook

Blocklisted process makes network request 1 IoCs

flow	pid	Process
3	2816	EQNEDT32.EXE

Downloads MZ/PE file

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	IBM_INC.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	IBM_INC.exe

Executes dropped EXE 1 IoCs

pid	Process
2740	IBM_INC.exe

Loads dropped DLL 4 IoCs

pid	Process
2816	EQNEDT32.EXE
2740	IBM_INC.exe
2740	IBM_INC.exe
564	IBM_INC.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
564	IBM_INC.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2740	IBM_INC.exe
564	IBM_INC.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2740 set thread context of 564	2740	IBM_INC.exe	33
PID 564 set thread context of 1208	564	IBM_INC.exe	6
PID 2132 set thread context of 1208	2132	ipconfig.exe	6

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 12 IoCs

installer

resource	yara_rule
behavioral1/files/0x0006000000016fc8-67.dat	nsis_installer_1
behavioral1/files/0x0006000000016fc8-67.dat	nsis_installer_2
behavioral1/files/0x0006000000016fc8-68.dat	nsis_installer_1
behavioral1/files/0x0006000000016fc8-68.dat	nsis_installer_2
behavioral1/files/0x0006000000016fc8-71.dat	nsis_installer_1
behavioral1/files/0x0006000000016fc8-71.dat	nsis_installer_2
behavioral1/files/0x0006000000016fc8-72.dat	nsis_installer_1
behavioral1/files/0x0006000000016fc8-72.dat	nsis_installer_2
behavioral1/files/0x0006000000016fc8-84.dat	nsis_installer_1
behavioral1/files/0x0006000000016fc8-84.dat	nsis_installer_2
behavioral1/files/0x0006000000016fc8-86.dat	nsis_installer_1
behavioral1/files/0x0006000000016fc8-86.dat	nsis_installer_2

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2132	ipconfig.exe

Launches Equation Editor 1 TTPs 1 IoCs

Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

exploit

Exploitation for Client Execution

T1203

pid	Process
2816	EQNEDT32.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3004	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
564	IBM_INC.exe
564	IBM_INC.exe
2132	ipconfig.exe
2132	ipconfig.exe
2132	ipconfig.exe
2132	ipconfig.exe
2132	ipconfig.exe
2132	ipconfig.exe
2132	ipconfig.exe
2132	ipconfig.exe
2132	ipconfig.exe
2132	ipconfig.exe
2132	ipconfig.exe
2132	ipconfig.exe
2132	ipconfig.exe
2132	ipconfig.exe
2132	ipconfig.exe
2132	ipconfig.exe
2132	ipconfig.exe
2132	ipconfig.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1208	Explorer.EXE

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
2740	IBM_INC.exe
564	IBM_INC.exe
564	IBM_INC.exe
564	IBM_INC.exe
2132	ipconfig.exe
2132	ipconfig.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	564	IBM_INC.exe
Token: SeDebugPrivilege	2132	ipconfig.exe
Token: SeShutdownPrivilege	1208	Explorer.EXE
Token: SeShutdownPrivilege	1208	Explorer.EXE

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3004	EXCEL.EXE
3004	EXCEL.EXE
3004	EXCEL.EXE
3004	EXCEL.EXE
3004	EXCEL.EXE

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 2740	2816	EQNEDT32.EXE	29
PID 2816 wrote to memory of 2740	2816	EQNEDT32.EXE	29
PID 2816 wrote to memory of 2740	2816	EQNEDT32.EXE	29
PID 2816 wrote to memory of 2740	2816	EQNEDT32.EXE	29
PID 2740 wrote to memory of 564	2740	IBM_INC.exe	33
PID 2740 wrote to memory of 564	2740	IBM_INC.exe	33
PID 2740 wrote to memory of 564	2740	IBM_INC.exe	33
PID 2740 wrote to memory of 564	2740	IBM_INC.exe	33
PID 2740 wrote to memory of 564	2740	IBM_INC.exe	33
PID 1208 wrote to memory of 2132	1208	Explorer.EXE	35
PID 1208 wrote to memory of 2132	1208	Explorer.EXE	35
PID 1208 wrote to memory of 2132	1208	Explorer.EXE	35
PID 1208 wrote to memory of 2132	1208	Explorer.EXE	35
PID 2132 wrote to memory of 2100	2132	ipconfig.exe	36
PID 2132 wrote to memory of 2100	2132	ipconfig.exe	36
PID 2132 wrote to memory of 2100	2132	ipconfig.exe	36
PID 2132 wrote to memory of 2100	2132	ipconfig.exe	36

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
  "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\QUOTE 367490.xls"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:3004
- C:\Windows\SysWOW64\ipconfig.exe
  "C:\Windows\SysWOW64\ipconfig.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Gathers network information
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2132
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\IBM_INC.exe"
    3⤵
    PID:2100

C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Users\Admin\AppData\Local\Temp\IBM_INC.exe
  "C:\Users\Admin\AppData\Local\Temp\IBM_INC.exe"
  2⤵
  - Checks QEMU agent file
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\Users\Admin\AppData\Local\Temp\IBM_INC.exe
    "C:\Users\Admin\AppData\Local\Temp\IBM_INC.exe"
    3⤵
    - Checks QEMU agent file
    - Loads dropped DLL
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Exploitation for Client Execution

1

T1203

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

4

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\8EEE3394.emf

Filesize
1.4MB

MD5
a01b9617553432807b9b58025b338d97

SHA1
439bdcc450408b9735b2428c2d53d2e6977fa58c

SHA256
7a0426ed2e2349916969ff7087c0f76089fb8ce7f4627f3d11ccbc1aaefcedce

SHA512
312cc2563fa865d6a939fea85a520627c73ed9a95bafc98c89495f21d535dc658825be74b64f0f5c5815d1d234fc6e77a71779247e4973e39ba8dccec2f09bee

Download Submit
C:\Users\Admin\AppData\Local\Temp\IBM_INC.exe

Filesize
402KB

MD5
492d80094e553a4d75e2922a847f1314

SHA1
940135286f07e89f6ece6a211382009ba9a9e905

SHA256
b101cf0ec986e1879a51d9c395a8c48e35dbee7d2e48846260d52ed42e125764

SHA512
ea5ff009c7760d0deaca665eef5d0356d61245acafdf0469a180171ae08c0fee75bcc22ec8bc2df5501c86f3e798aa28eb0d994ad81d652b7185b94740759a8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IBM_INC.exe

Filesize
402KB

MD5
492d80094e553a4d75e2922a847f1314

SHA1
940135286f07e89f6ece6a211382009ba9a9e905

SHA256
b101cf0ec986e1879a51d9c395a8c48e35dbee7d2e48846260d52ed42e125764

SHA512
ea5ff009c7760d0deaca665eef5d0356d61245acafdf0469a180171ae08c0fee75bcc22ec8bc2df5501c86f3e798aa28eb0d994ad81d652b7185b94740759a8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IBM_INC.exe

Filesize
402KB

MD5
492d80094e553a4d75e2922a847f1314

SHA1
940135286f07e89f6ece6a211382009ba9a9e905

SHA256
b101cf0ec986e1879a51d9c395a8c48e35dbee7d2e48846260d52ed42e125764

SHA512
ea5ff009c7760d0deaca665eef5d0356d61245acafdf0469a180171ae08c0fee75bcc22ec8bc2df5501c86f3e798aa28eb0d994ad81d652b7185b94740759a8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IBM_INC.exe

Filesize
402KB

MD5
492d80094e553a4d75e2922a847f1314

SHA1
940135286f07e89f6ece6a211382009ba9a9e905

SHA256
b101cf0ec986e1879a51d9c395a8c48e35dbee7d2e48846260d52ed42e125764

SHA512
ea5ff009c7760d0deaca665eef5d0356d61245acafdf0469a180171ae08c0fee75bcc22ec8bc2df5501c86f3e798aa28eb0d994ad81d652b7185b94740759a8a

Download Submit
\Users\Admin\AppData\Local\Temp\IBM_INC.exe

Filesize
402KB

MD5
492d80094e553a4d75e2922a847f1314

SHA1
940135286f07e89f6ece6a211382009ba9a9e905

SHA256
b101cf0ec986e1879a51d9c395a8c48e35dbee7d2e48846260d52ed42e125764

SHA512
ea5ff009c7760d0deaca665eef5d0356d61245acafdf0469a180171ae08c0fee75bcc22ec8bc2df5501c86f3e798aa28eb0d994ad81d652b7185b94740759a8a

Download Submit
\Users\Admin\AppData\Local\Temp\IBM_INC.exe

Filesize
402KB

MD5
492d80094e553a4d75e2922a847f1314

SHA1
940135286f07e89f6ece6a211382009ba9a9e905

SHA256
b101cf0ec986e1879a51d9c395a8c48e35dbee7d2e48846260d52ed42e125764

SHA512
ea5ff009c7760d0deaca665eef5d0356d61245acafdf0469a180171ae08c0fee75bcc22ec8bc2df5501c86f3e798aa28eb0d994ad81d652b7185b94740759a8a

Download Submit
\Users\Admin\AppData\Local\Temp\nsd8A47.tmp\System.dll

Filesize
11KB

MD5
fccff8cb7a1067e23fd2e2b63971a8e1

SHA1
30e2a9e137c1223a78a0f7b0bf96a1c361976d91

SHA256
6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e

SHA512
f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c

Download Submit
memory/564-89-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/564-94-0x0000000034BD0000-0x0000000034ED3000-memory.dmp

Filesize
3.0MB

Download
memory/564-96-0x00000000000B0000-0x00000000000C4000-memory.dmp

Filesize
80KB

Download
memory/564-95-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/564-91-0x0000000001470000-0x0000000004A62000-memory.dmp

Filesize
53.9MB

Download
memory/564-87-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/564-88-0x0000000077AE0000-0x0000000077C89000-memory.dmp

Filesize
1.7MB

Download
memory/564-98-0x0000000001470000-0x0000000004A62000-memory.dmp

Filesize
53.9MB

Download
memory/564-90-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1208-112-0x00000000094F0000-0x0000000009624000-memory.dmp

Filesize
1.2MB

Download
memory/1208-109-0x00000000094F0000-0x0000000009624000-memory.dmp

Filesize
1.2MB

Download
memory/1208-111-0x00000000094F0000-0x0000000009624000-memory.dmp

Filesize
1.2MB

Download
memory/1208-106-0x0000000007520000-0x00000000076BE000-memory.dmp

Filesize
1.6MB

Download
memory/1208-97-0x0000000007520000-0x00000000076BE000-memory.dmp

Filesize
1.6MB

Download
memory/2132-105-0x0000000000080000-0x00000000000AE000-memory.dmp

Filesize
184KB

Download
memory/2132-107-0x0000000001E30000-0x0000000001EC3000-memory.dmp

Filesize
588KB

Download
memory/2132-101-0x0000000000080000-0x00000000000AE000-memory.dmp

Filesize
184KB

Download
memory/2132-99-0x0000000000890000-0x000000000089A000-memory.dmp

Filesize
40KB

Download
memory/2132-103-0x0000000002100000-0x0000000002403000-memory.dmp

Filesize
3.0MB

Download
memory/2132-100-0x0000000000890000-0x000000000089A000-memory.dmp

Filesize
40KB

Download
memory/2740-85-0x000000006D120000-0x000000006D126000-memory.dmp

Filesize
24KB

Download
memory/2740-83-0x0000000077CD0000-0x0000000077DA6000-memory.dmp

Filesize
856KB

Download
memory/2740-82-0x0000000077AE0000-0x0000000077C89000-memory.dmp

Filesize
1.7MB

Download
memory/3004-54-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/3004-81-0x0000000073EDD000-0x0000000073EE8000-memory.dmp

Filesize
44KB

Download
memory/3004-55-0x0000000073EDD000-0x0000000073EE8000-memory.dmp

Filesize
44KB

Download
memory/3004-121-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/3004-136-0x0000000073EDD000-0x0000000073EE8000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads