formbook | 8d802f0a6cf29072e9d1e038384ca8ab28efe59d054bff97d0fa799a7b71b65f

Analysis

max time kernel
147s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
15/02/2024, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Supplier Compliance Purchase order PO 2135850 QTNIU81408875 20240215.exe
Size 607KB
Sample240215-thcj6abc37
SHA256 8d802f0a6cf29072e9d1e038384ca8ab28efe59d054bff97d0fa799a7b71b65f
MD5 fcaa494bd1ccbbb063a75e74fb63b47c
SHA1 6a145cdec95c7427bba1f2a03019b1bf79510980
SHA512 c24b45e8abcd5f6411220b9bc3d1ecff618d7d220e7947ab922d318f4e0fefcac5e7d18d94dbc7950f07172720ca0a277a999e6e4b3d3faa167368e7b0bed7c1
SSDEEP 12288:fBMrJB3v3G42hgCqQGLAs/zJGqjOn9/x6Xs:fBYB3vBwj6As/dFj2pV
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook pz08 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

pz08

Decoy

deespresence.com
fanyablack.com
papermoonnursery.com
sunriseclohting.store
jenstandsforarkansas.com
lkhtalentconsulting.com
baerana.com
hyperphit.com
davidianbrant.com
itkagear.com
web-findmy.site
liveforwardventures.com
skyenglearn.online
studio-sticky.store
yassa-hany.online
tacoshack479.com
bigtexture.xyz
erxkula.shop
go-bloggers.com
qwdlwys.site
taylorpritchett.com
yobo-by.com
trendsdrop.com
boostyourselftoday.com
taxibactrungnam.com
sgzycp.net
anti-theft-device-82641.bond
ytytyt016.xyz
loveyourhome.style
ithinkmoney.com
bertric.info
permanentday.space
kxn.ink
onlythumbs.online
techrihno.com
washing-machine-46612.bond
phdop.xyz
nordens-media.com
gourmetfoodfactory.com
ketoalycetiworks.buzz
amplilim.site
usetruerreview.com
inprime.xyz
aloyoga-uae.com
quickfibrokers.com
primadesignerhomes.com
greatlifehacks.online
thewipglobal.com
tobegoodlife.net
hotelfincamalvasia.com
trevts.com
ae-skinlab.com
grammarhome.com
cld005.com
first-solution.online
keylabcerrajeria.com
besttravelsgate.com
friskiwear.com
hedrickmanufactory.com
pinewell.world
5819995.com
c2help.live
kai3.center
plantasdasminas.com
rdlva.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 5 IoCs

rat

resource	yara_rule
behavioral1/memory/2808-12-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/2808-17-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/2384-24-0x00000000028B0000-0x00000000028F0000-memory.dmp	formbook
behavioral1/memory/2760-30-0x00000000000F0000-0x000000000011F000-memory.dmp	formbook
behavioral1/memory/2760-32-0x00000000000F0000-0x000000000011F000-memory.dmp	formbook

Deletes itself 1 IoCs

pid	Process
2592	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1716 set thread context of 2808	1716	Supplier Compliance Purchase order PO 2135850 QTNIU81408875 20240215.exe	31
PID 2808 set thread context of 1184	2808	Supplier Compliance Purchase order PO 2135850 QTNIU81408875 20240215.exe	17
PID 2760 set thread context of 1184	2760	cmstp.exe	17

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
1716	Supplier Compliance Purchase order PO 2135850 QTNIU81408875 20240215.exe
2808	Supplier Compliance Purchase order PO 2135850 QTNIU81408875 20240215.exe
2808	Supplier Compliance Purchase order PO 2135850 QTNIU81408875 20240215.exe
2384	powershell.exe
2760	cmstp.exe
2760	cmstp.exe
2760	cmstp.exe
2760	cmstp.exe
2760	cmstp.exe
2760	cmstp.exe
2760	cmstp.exe
2760	cmstp.exe
2760	cmstp.exe
2760	cmstp.exe
2760	cmstp.exe
2760	cmstp.exe
2760	cmstp.exe
2760	cmstp.exe
2760	cmstp.exe
2760	cmstp.exe
2760	cmstp.exe
2760	cmstp.exe
2760	cmstp.exe
2760	cmstp.exe
2760	cmstp.exe
2760	cmstp.exe
2760	cmstp.exe
2760	cmstp.exe
2760	cmstp.exe
2760	cmstp.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
2808	Supplier Compliance Purchase order PO 2135850 QTNIU81408875 20240215.exe
2808	Supplier Compliance Purchase order PO 2135850 QTNIU81408875 20240215.exe
2808	Supplier Compliance Purchase order PO 2135850 QTNIU81408875 20240215.exe
2760	cmstp.exe
2760	cmstp.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1716	Supplier Compliance Purchase order PO 2135850 QTNIU81408875 20240215.exe
Token: SeDebugPrivilege	2808	Supplier Compliance Purchase order PO 2135850 QTNIU81408875 20240215.exe
Token: SeDebugPrivilege	2384	powershell.exe
Token: SeDebugPrivilege	2760	cmstp.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 2384	1716	Supplier Compliance Purchase order PO 2135850 QTNIU81408875 20240215.exe	28
PID 1716 wrote to memory of 2384	1716	Supplier Compliance Purchase order PO 2135850 QTNIU81408875 20240215.exe	28
PID 1716 wrote to memory of 2384	1716	Supplier Compliance Purchase order PO 2135850 QTNIU81408875 20240215.exe	28
PID 1716 wrote to memory of 2384	1716	Supplier Compliance Purchase order PO 2135850 QTNIU81408875 20240215.exe	28
PID 1716 wrote to memory of 2708	1716	Supplier Compliance Purchase order PO 2135850 QTNIU81408875 20240215.exe	30
PID 1716 wrote to memory of 2708	1716	Supplier Compliance Purchase order PO 2135850 QTNIU81408875 20240215.exe	30
PID 1716 wrote to memory of 2708	1716	Supplier Compliance Purchase order PO 2135850 QTNIU81408875 20240215.exe	30
PID 1716 wrote to memory of 2708	1716	Supplier Compliance Purchase order PO 2135850 QTNIU81408875 20240215.exe	30
PID 1716 wrote to memory of 2808	1716	Supplier Compliance Purchase order PO 2135850 QTNIU81408875 20240215.exe	31
PID 1716 wrote to memory of 2808	1716	Supplier Compliance Purchase order PO 2135850 QTNIU81408875 20240215.exe	31
PID 1716 wrote to memory of 2808	1716	Supplier Compliance Purchase order PO 2135850 QTNIU81408875 20240215.exe	31
PID 1716 wrote to memory of 2808	1716	Supplier Compliance Purchase order PO 2135850 QTNIU81408875 20240215.exe	31
PID 1716 wrote to memory of 2808	1716	Supplier Compliance Purchase order PO 2135850 QTNIU81408875 20240215.exe	31
PID 1716 wrote to memory of 2808	1716	Supplier Compliance Purchase order PO 2135850 QTNIU81408875 20240215.exe	31
PID 1716 wrote to memory of 2808	1716	Supplier Compliance Purchase order PO 2135850 QTNIU81408875 20240215.exe	31
PID 1184 wrote to memory of 2760	1184	Explorer.EXE	32
PID 1184 wrote to memory of 2760	1184	Explorer.EXE	32
PID 1184 wrote to memory of 2760	1184	Explorer.EXE	32
PID 1184 wrote to memory of 2760	1184	Explorer.EXE	32
PID 1184 wrote to memory of 2760	1184	Explorer.EXE	32
PID 1184 wrote to memory of 2760	1184	Explorer.EXE	32
PID 1184 wrote to memory of 2760	1184	Explorer.EXE	32
PID 2760 wrote to memory of 2592	2760	cmstp.exe	33
PID 2760 wrote to memory of 2592	2760	cmstp.exe	33
PID 2760 wrote to memory of 2592	2760	cmstp.exe	33
PID 2760 wrote to memory of 2592	2760	cmstp.exe	33

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Users\Admin\AppData\Local\Temp\Supplier Compliance Purchase order PO 2135850 QTNIU81408875 20240215.exe
  "C:\Users\Admin\AppData\Local\Temp\Supplier Compliance Purchase order PO 2135850 QTNIU81408875 20240215.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1716
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Supplier Compliance Purchase order PO 2135850 QTNIU81408875 20240215.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2384
- - C:\Users\Admin\AppData\Local\Temp\Supplier Compliance Purchase order PO 2135850 QTNIU81408875 20240215.exe
    "C:\Users\Admin\AppData\Local\Temp\Supplier Compliance Purchase order PO 2135850 QTNIU81408875 20240215.exe"
    3⤵
    PID:2708
- - C:\Users\Admin\AppData\Local\Temp\Supplier Compliance Purchase order PO 2135850 QTNIU81408875 20240215.exe
    "C:\Users\Admin\AppData\Local\Temp\Supplier Compliance Purchase order PO 2135850 QTNIU81408875 20240215.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:2808
- C:\Windows\SysWOW64\cmstp.exe
  "C:\Windows\SysWOW64\cmstp.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\Supplier Compliance Purchase order PO 2135850 QTNIU81408875 20240215.exe"
    3⤵
    - Deletes itself
    PID:2592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1184-15-0x0000000003B30000-0x0000000003C30000-memory.dmp

Download

memory/1184-19-0x0000000004F90000-0x00000000050FF000-memory.dmp

Download

memory/1716-1-0x0000000074810000-0x0000000074EFE000-memory.dmp

Download

memory/1716-2-0x0000000000F20000-0x0000000000F60000-memory.dmp

Download

memory/1716-3-0x00000000004C0000-0x00000000004D2000-memory.dmp

Download

memory/1716-4-0x00000000004E0000-0x00000000004F2000-memory.dmp

Download

memory/1716-5-0x00000000052C0000-0x0000000005336000-memory.dmp

Download

memory/1716-0-0x0000000001010000-0x00000000010AE000-memory.dmp

Download

memory/1716-16-0x0000000074810000-0x0000000074EFE000-memory.dmp

Download

memory/2384-27-0x0000000074860000-0x0000000074E0B000-memory.dmp

Download

memory/2384-22-0x0000000074860000-0x0000000074E0B000-memory.dmp

Download

memory/2384-24-0x00000000028B0000-0x00000000028F0000-memory.dmp

Download

memory/2384-25-0x00000000028B0000-0x00000000028F0000-memory.dmp

Download

memory/2384-26-0x00000000028B0000-0x00000000028F0000-memory.dmp

Download

memory/2384-23-0x0000000074860000-0x0000000074E0B000-memory.dmp

Download

memory/2760-28-0x0000000000CB0000-0x0000000000CC8000-memory.dmp

Download

memory/2760-29-0x0000000000CB0000-0x0000000000CC8000-memory.dmp

Download

memory/2760-30-0x00000000000F0000-0x000000000011F000-memory.dmp

Download

memory/2760-31-0x00000000020D0000-0x00000000023D3000-memory.dmp

Download

memory/2760-32-0x00000000000F0000-0x000000000011F000-memory.dmp

Download

memory/2760-35-0x0000000000A70000-0x0000000000B03000-memory.dmp

Download

memory/2808-8-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2808-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2808-17-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2808-18-0x0000000000150000-0x0000000000164000-memory.dmp

Download

memory/2808-12-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2808-6-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2808-13-0x0000000000850000-0x0000000000B53000-memory.dmp

Download