formbook | 0ce0682abb75b00b32858e270246e168799e2618f671edd3da16680586fb306f

General

Target

REQ-22-TM-0421.exe
Size

339KB
MD5

03c5bcabede556bfc4239b8b5cd82c96
SHA1

f4adc8324ab83478fd1e8d276bde2fec5a37cdef
SHA256

345c796d9c9e422f8d60c79b8979b9de8df2748c6c3e5b78ff3f44a99024b31b
SHA512

5ea449eb53ff8cf669fcd6cffea586cc1a1d88b67fa70c0ff2f72a2e9e8c575edcb0073fa0608cd729e6c7d353480044b6d1cfd10f57089dfac45a7e1d467213
SSDEEP

6144:9kwNabEIE9NpesIQroOyxdbt4v3AWP147fIYSp4CNuVszpRj6ZlXzQ4xypW:HIEPpC8SfbY/4kDVDpRjExyY

Score

10^/10

formbook m5oe rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

m5oe

Decoy

HdR8hG6r12hBYuHY4zv6YeeFPQ==

tD1V9gswYvgQXEGd

1xKtJ1LdqRYMRMC84U1A

MbhjiWb7Lz8z7KIWl3UyUIJwA6Tb

joVB5Xggy2RtE+odsZg=

TrduAIay6Y3SvoIK20xI

pSna7LOsXXwXT/zz3Iow4g==

QnthmO4Qst5gC3sDoA==

eAirzOOgO7SOCenz3Iow4g==

xg0uSbfLTg==

YWQXwyGRzPEHzGrDFE8CBSE=

ujLnfuXoH9dbgHIK20xI

291v0XsGFrYQXEGd

MRvTd/qMuaHpjCM=

X131fLC6VWX4MsvCb2IPjIfq8wlksWfg

Y9Bur8DbgqFt/Yni86MMCCE=

q6RTBmJkmy5pWTmmCCrvmuCDPw==

mQS26DojT+EQXEGd

sjHQ+Kav2Wx9FeodsZg=

JA24UKnTA5re1LhcQaVo/w==

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

avzthbaywy.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\International\Geo\Nation	avzthbaywy.exe

Executes dropped EXE 2 IoCs

Processes:

avzthbaywy.exeavzthbaywy.exe

pid process

2992 avzthbaywy.exe
2956 avzthbaywy.exe
Loads dropped DLL 3 IoCs

Processes:

REQ-22-TM-0421.exeavzthbaywy.execolorcpl.exe

pid process

2168 REQ-22-TM-0421.exe
2992 avzthbaywy.exe
2440 colorcpl.exe

pid	process
2992	avzthbaywy.exe
2956	avzthbaywy.exe

pid	process
2168	REQ-22-TM-0421.exe
2992	avzthbaywy.exe
2440	colorcpl.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

avzthbaywy.exeavzthbaywy.execolorcpl.exe

description	pid	process	target process
PID 2992 set thread context of 2956	2992	avzthbaywy.exe	avzthbaywy.exe
PID 2956 set thread context of 1408	2956	avzthbaywy.exe	Explorer.EXE
PID 2440 set thread context of 1408	2440	colorcpl.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

colorcpl.exe

description	ioc	process
Key created	\Registry\User\S-1-5-21-330940541-141609230-1670313778-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	colorcpl.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

Processes:

avzthbaywy.execolorcpl.exe

pid	process
2956	avzthbaywy.exe
2956	avzthbaywy.exe
2956	avzthbaywy.exe
2956	avzthbaywy.exe
2440	colorcpl.exe
2440	colorcpl.exe
2440	colorcpl.exe
2440	colorcpl.exe
2440	colorcpl.exe
2440	colorcpl.exe
2440	colorcpl.exe
2440	colorcpl.exe
2440	colorcpl.exe
2440	colorcpl.exe
2440	colorcpl.exe
2440	colorcpl.exe
2440	colorcpl.exe
2440	colorcpl.exe
2440	colorcpl.exe
2440	colorcpl.exe
2440	colorcpl.exe
2440	colorcpl.exe
2440	colorcpl.exe
2440	colorcpl.exe
2440	colorcpl.exe
2440	colorcpl.exe
2440	colorcpl.exe
2440	colorcpl.exe
2440	colorcpl.exe
2440	colorcpl.exe
2440	colorcpl.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1408 Explorer.EXE
Suspicious behavior: MapViewOfSection 8 IoCs

Processes:

avzthbaywy.exeavzthbaywy.execolorcpl.exe

pid process

2992 avzthbaywy.exe
2956 avzthbaywy.exe
2956 avzthbaywy.exe
2956 avzthbaywy.exe
2440 colorcpl.exe
2440 colorcpl.exe
2440 colorcpl.exe
2440 colorcpl.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

avzthbaywy.execolorcpl.exe

description pid process

Token: SeDebugPrivilege 2956 avzthbaywy.exe
Token: SeDebugPrivilege 2440 colorcpl.exe

pid	process
1408	Explorer.EXE

pid	process
2992	avzthbaywy.exe
2956	avzthbaywy.exe
2956	avzthbaywy.exe
2956	avzthbaywy.exe
2440	colorcpl.exe
2440	colorcpl.exe
2440	colorcpl.exe
2440	colorcpl.exe

description	pid	process
Token: SeDebugPrivilege	2956	avzthbaywy.exe
Token: SeDebugPrivilege	2440	colorcpl.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

REQ-22-TM-0421.exeavzthbaywy.exeExplorer.EXEcolorcpl.exe

description	pid	process	target process
PID 2168 wrote to memory of 2992	2168	REQ-22-TM-0421.exe	avzthbaywy.exe
PID 2168 wrote to memory of 2992	2168	REQ-22-TM-0421.exe	avzthbaywy.exe
PID 2168 wrote to memory of 2992	2168	REQ-22-TM-0421.exe	avzthbaywy.exe
PID 2168 wrote to memory of 2992	2168	REQ-22-TM-0421.exe	avzthbaywy.exe
PID 2992 wrote to memory of 2956	2992	avzthbaywy.exe	avzthbaywy.exe
PID 2992 wrote to memory of 2956	2992	avzthbaywy.exe	avzthbaywy.exe
PID 2992 wrote to memory of 2956	2992	avzthbaywy.exe	avzthbaywy.exe
PID 2992 wrote to memory of 2956	2992	avzthbaywy.exe	avzthbaywy.exe
PID 2992 wrote to memory of 2956	2992	avzthbaywy.exe	avzthbaywy.exe
PID 1408 wrote to memory of 2440	1408	Explorer.EXE	colorcpl.exe
PID 1408 wrote to memory of 2440	1408	Explorer.EXE	colorcpl.exe
PID 1408 wrote to memory of 2440	1408	Explorer.EXE	colorcpl.exe
PID 1408 wrote to memory of 2440	1408	Explorer.EXE	colorcpl.exe
PID 2440 wrote to memory of 1908	2440	colorcpl.exe	Firefox.exe
PID 2440 wrote to memory of 1908	2440	colorcpl.exe	Firefox.exe
PID 2440 wrote to memory of 1908	2440	colorcpl.exe	Firefox.exe
PID 2440 wrote to memory of 1908	2440	colorcpl.exe	Firefox.exe
PID 2440 wrote to memory of 1908	2440	colorcpl.exe	Firefox.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1408

C:\Users\Admin\AppData\Local\Temp\REQ-22-TM-0421.exe
"C:\Users\Admin\AppData\Local\Temp\REQ-22-TM-0421.exe"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2168

C:\Users\Admin\AppData\Local\Temp\avzthbaywy.exe
"C:\Users\Admin\AppData\Local\Temp\avzthbaywy.exe" C:\Users\Admin\AppData\Local\Temp\jndtnuycnvd.r
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2992

C:\Users\Admin\AppData\Local\Temp\avzthbaywy.exe
"C:\Users\Admin\AppData\Local\Temp\avzthbaywy.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2956

C:\Windows\SysWOW64\colorcpl.exe
"C:\Windows\SysWOW64\colorcpl.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2440

C:\Program Files\Mozilla Firefox\Firefox.exe
"C:\Program Files\Mozilla Firefox\Firefox.exe"
3⤵
PID:1908

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\er4pdx_h.zip
Filesize
472KB

MD5
f24f874f0a201b7c919019d8cc45cc5a

SHA1
c2f99e749ce8b66b9da7cd793dc9b254c395f8c5

SHA256
e1090bd71e36c943af572d13d23adcb824a38d01d8ec110bb63f29b5c9a26031

SHA512
5c40b2c48e598d30e3f47c67479dc19352080a16ccf7a7eff7034e595cad1643308c070d3ac4f4fed7bcc99f4a507bc5463c7944d81baa8f0b65b3e3a839140a

Download Submit
C:\Users\Admin\AppData\Local\Temp\gfcscamx.xf
Filesize
185KB

MD5
bd816dca0e1567244d663d7aa2df97cc

SHA1
a9502193aa173a9a08f7065c91d22fe530502d5d

SHA256
95b69b89e0b9a28a697a7191873431cc4bf37f45b7cbbb6c2980e96ce35332ef

SHA512
fbd62496698edb400702babefa306d37def3a8550598a647d77e5bcbc03ef8cfe436fa962fcca7e8d67ce0a3744746d3a5531a569bb4c151b44ca4915fabbd9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\jndtnuycnvd.r
Filesize
5KB

MD5
e51ae249af6e2d93c78cbd20d825fe00

SHA1
c0c3b47d4b4b00923d1e488a8752bf6345c04f23

SHA256
ae9c90758dc2e2eca3589500b04e29ff8ecf242726b82339b185eeaa6fe05906

SHA512
a72ecde32a10182218bd89b7dbaf5d38ce9f038b72ea3cb4cb1b235059987759024cb675207e144a0613c1e57b7e654d6770680a4413583c4d9021ca8ff63a6f

Download Submit
\Users\Admin\AppData\Local\Temp\avzthbaywy.exe
Filesize
289KB

MD5
13c80abd753e9c38782524743504a0dd

SHA1
709129996e9d1474f57ed77eb38794d82f9805c4

SHA256
d718c0c41640eefcd910fd40f970e3e47a025352602bd8c0e53ab7baeaba1aa0

SHA512
828830e4ac3c8757ae9d8602415570768903620912d8dcaac87207b9cf054e6ae5a14b2372451160776901a067079a853ef5606114848afee2b440f6279b662f

Download Submit
\Users\Admin\AppData\Local\Temp\sqlite3.dll
Filesize
902KB

MD5
50338cc1fa2582fa0cad8a8fa7ceb4d2

SHA1
ae697ef05b6bec38fb79ff4512ae50a303dcdbce

SHA256
0815a80fa73286d8c6bf0982471c61833821d9f10a20612deaa134562e7a3cda

SHA512
02a006e26b1d08cb53a4b3dab23ce6a6756a7275f8b3ef00b7412f10cff75411685a3542c5dc330dad7c9f7ff26288a2e94254d00bf53c1394e7252e000c9a61

Download Submit
memory/1408-22-0x0000000007150000-0x00000000072C8000-memory.dmp

Filesize
1.5MB

Download
memory/1408-36-0x000000000AA60000-0x000000000ABA3000-memory.dmp

Filesize
1.3MB

Download
memory/1408-33-0x0000000007150000-0x00000000072C8000-memory.dmp

Filesize
1.5MB

Download
memory/1408-32-0x000000000AA60000-0x000000000ABA3000-memory.dmp

Filesize
1.3MB

Download
memory/1408-31-0x000000000AA60000-0x000000000ABA3000-memory.dmp

Filesize
1.3MB

Download
memory/2440-24-0x0000000000ED0000-0x0000000000EE8000-memory.dmp

Filesize
96KB

Download
memory/2440-23-0x0000000000ED0000-0x0000000000EE8000-memory.dmp

Filesize
96KB

Download
memory/2440-78-0x0000000061E00000-0x0000000061ECD000-memory.dmp

Filesize
820KB

Download
memory/2440-25-0x0000000000080000-0x00000000000AD000-memory.dmp

Filesize
180KB

Download
memory/2440-26-0x00000000022F0000-0x00000000025F3000-memory.dmp

Filesize
3.0MB

Download
memory/2440-27-0x0000000000080000-0x00000000000AD000-memory.dmp

Filesize
180KB

Download
memory/2440-29-0x00000000004F0000-0x000000000057F000-memory.dmp

Filesize
572KB

Download
memory/2956-20-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2956-18-0x0000000000AA0000-0x0000000000DA3000-memory.dmp

Filesize
3.0MB

Download
memory/2956-17-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2956-16-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2956-12-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2956-21-0x0000000000120000-0x0000000000130000-memory.dmp

Filesize
64KB

Download
memory/2992-8-0x00000000000A0000-0x00000000000A2000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads