formbook | 6832b376821170cd1a109fec9ad84f2b32adaed7f592edfd1c02a4b0f708b8d6

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 17:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
wise_deposit_note__1114218690__3287491072__en.cmd
Size 2.4MB
Sample240625-vrexbasejh
SHA256 4cb31951ae2b4f8b86b532c25762252f28525f55061d8d09a356a9c8f12029b2
MD5 42323f7609e2e5c56add77d01e27432f
SHA1 e5262c46781a8c58aaee00a529ed7597dbb2b698
SHA512 0814feee3013a4409c3171f30dc9d9d4ffe5626e6ba28a257163fa8f26380751fbd5ba7077e47e9bcd59d8b852b50822fb3383c9a6366b8619db7627d9ded44d
SSDEEP 24576:IPHN8ur54cKt8AdV30Z3ZRYwVxrhWHmmV/MBm54hRCKxBJxsv:IPHSur5M8Ar30JnrQLMEBv
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook ca63 persistence rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

ca63

Decoy

themaxrichth.online
lhzshb.com
isacarrceramics.online
duhochanquoc.website
apexmedia.pro
33311.pro
x2mjbu8gg.shop
dashcreative.online
nifle.shop
hora.lol
rclrwa.asia
aviation-training-sqj.top
a9659a62.vip
uspgh.work
hhol5.top
jinkaida-cn.cn
watchwedding.com
728ym.lat
gillieron.swiss
bingsne.online
professionaljournalism.com
senior-living-15150.bond
chatsio.com
dr-jordan.site
sador.xyz
nagaways.online
552357.pro
domainupdate.site
3v5u21668.shop
dh76044.vip
cineflickapp.online
ht31a.vip
workingcat.online
9h6db.shop
evallc.net
sun20win.digital
683ym.lat
retrosystem.fun
bgkamil.xyz
androidmobiledk.today
gsptx.online
onlineit.sbs
violetnuit.shop
kyusgwh2.top
vdqgj.asia
helpmepeas.net
4399game.asia
tent-homes-10133.bond
moki.dev
raildriver.net
lkjuy.xyz
presentdadsmatter.shop
amp-kopi77i2.xyz
cyber-security-onli.bond
rtpcmbet27.xyz
80lrlaenant8.life
urostatingr.shop
xn--fiq73f39fx0y2hq.work
zc041.xyz
34-health.shop
yunhaicm.asia
domain-2.buzz
money1lifecoachingservice.net
5301ulovp.website
siasstudios.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/3348-46-0x0000000004E90000-0x0000000005E90000-memory.dmp	formbook
behavioral2/memory/3348-50-0x0000000004E90000-0x0000000005E90000-memory.dmp	formbook
behavioral2/memory/3188-52-0x0000000000700000-0x000000000072F000-memory.dmp	formbook

Executes dropped EXE 9 IoCs

pid	Process
648	alpha.exe
1480	alpha.exe
1856	kn.exe
3780	alpha.exe
1684	kn.exe
1544	Audio.pif
4760	alpha.exe
1764	alpha.exe
4032	yrblzjxP.pif

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Pxjzlbry = "C:\\Users\\Public\\Pxjzlbry.url"	Audio.pif

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1544 set thread context of 4032	1544	Audio.pif	108
PID 3348 set thread context of 3364	3348	colorcpl.exe	57
PID 3188 set thread context of 3364	3188	NETSTAT.EXE	57

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4284	4032	WerFault.exe	108

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3188	NETSTAT.EXE

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	33	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 57 IoCs

pid	Process
1544	Audio.pif
1544	Audio.pif
3348	colorcpl.exe
3348	colorcpl.exe
3348	colorcpl.exe
3348	colorcpl.exe
3348	colorcpl.exe
3348	colorcpl.exe
3188	NETSTAT.EXE
3188	NETSTAT.EXE
3188	NETSTAT.EXE
3188	NETSTAT.EXE
3188	NETSTAT.EXE
3188	NETSTAT.EXE
3188	NETSTAT.EXE
3188	NETSTAT.EXE
3188	NETSTAT.EXE
3188	NETSTAT.EXE
3188	NETSTAT.EXE
3188	NETSTAT.EXE
3188	NETSTAT.EXE
3188	NETSTAT.EXE
3188	NETSTAT.EXE
3188	NETSTAT.EXE
3188	NETSTAT.EXE
3188	NETSTAT.EXE
3188	NETSTAT.EXE
3188	NETSTAT.EXE
3188	NETSTAT.EXE
3188	NETSTAT.EXE
3188	NETSTAT.EXE
3188	NETSTAT.EXE
3188	NETSTAT.EXE
3188	NETSTAT.EXE
3188	NETSTAT.EXE
3188	NETSTAT.EXE
3188	NETSTAT.EXE
3188	NETSTAT.EXE
3188	NETSTAT.EXE
3188	NETSTAT.EXE
3188	NETSTAT.EXE
3188	NETSTAT.EXE
3188	NETSTAT.EXE
3188	NETSTAT.EXE
3188	NETSTAT.EXE
3188	NETSTAT.EXE
3188	NETSTAT.EXE
3188	NETSTAT.EXE
3188	NETSTAT.EXE
3188	NETSTAT.EXE
3188	NETSTAT.EXE
3188	NETSTAT.EXE
3188	NETSTAT.EXE
3188	NETSTAT.EXE
3188	NETSTAT.EXE
3188	NETSTAT.EXE
3188	NETSTAT.EXE

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
3348	colorcpl.exe
3348	colorcpl.exe
3348	colorcpl.exe
3188	NETSTAT.EXE
3188	NETSTAT.EXE

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	3348	colorcpl.exe
Token: SeShutdownPrivilege	3364	Explorer.EXE
Token: SeCreatePagefilePrivilege	3364	Explorer.EXE
Token: SeShutdownPrivilege	3364	Explorer.EXE
Token: SeCreatePagefilePrivilege	3364	Explorer.EXE
Token: SeShutdownPrivilege	3364	Explorer.EXE
Token: SeCreatePagefilePrivilege	3364	Explorer.EXE
Token: SeDebugPrivilege	3188	NETSTAT.EXE

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 3904	2104	cmd.exe	91
PID 2104 wrote to memory of 3904	2104	cmd.exe	91
PID 2104 wrote to memory of 648	2104	cmd.exe	92
PID 2104 wrote to memory of 648	2104	cmd.exe	92
PID 648 wrote to memory of 800	648	alpha.exe	93
PID 648 wrote to memory of 800	648	alpha.exe	93
PID 2104 wrote to memory of 1480	2104	cmd.exe	94
PID 2104 wrote to memory of 1480	2104	cmd.exe	94
PID 1480 wrote to memory of 1856	1480	alpha.exe	95
PID 1480 wrote to memory of 1856	1480	alpha.exe	95
PID 2104 wrote to memory of 3780	2104	cmd.exe	96
PID 2104 wrote to memory of 3780	2104	cmd.exe	96
PID 3780 wrote to memory of 1684	3780	alpha.exe	97
PID 3780 wrote to memory of 1684	3780	alpha.exe	97
PID 2104 wrote to memory of 1544	2104	cmd.exe	98
PID 2104 wrote to memory of 1544	2104	cmd.exe	98
PID 2104 wrote to memory of 1544	2104	cmd.exe	98
PID 2104 wrote to memory of 4760	2104	cmd.exe	99
PID 2104 wrote to memory of 4760	2104	cmd.exe	99
PID 2104 wrote to memory of 1764	2104	cmd.exe	100
PID 2104 wrote to memory of 1764	2104	cmd.exe	100
PID 1544 wrote to memory of 4032	1544	Audio.pif	108
PID 1544 wrote to memory of 4032	1544	Audio.pif	108
PID 1544 wrote to memory of 4032	1544	Audio.pif	108
PID 1544 wrote to memory of 4032	1544	Audio.pif	108
PID 1544 wrote to memory of 4032	1544	Audio.pif	108
PID 1544 wrote to memory of 2132	1544	Audio.pif	112
PID 1544 wrote to memory of 2132	1544	Audio.pif	112
PID 1544 wrote to memory of 2132	1544	Audio.pif	112
PID 1544 wrote to memory of 3348	1544	Audio.pif	114
PID 1544 wrote to memory of 3348	1544	Audio.pif	114
PID 1544 wrote to memory of 3348	1544	Audio.pif	114
PID 1544 wrote to memory of 3348	1544	Audio.pif	114
PID 3364 wrote to memory of 3188	3364	Explorer.EXE	116
PID 3364 wrote to memory of 3188	3364	Explorer.EXE	116
PID 3364 wrote to memory of 3188	3364	Explorer.EXE	116
PID 3188 wrote to memory of 1012	3188	NETSTAT.EXE	117
PID 3188 wrote to memory of 1012	3188	NETSTAT.EXE	117
PID 3188 wrote to memory of 1012	3188	NETSTAT.EXE	117

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\wise_deposit_note__1114218690__3287491072__en.cmd"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2104
- - C:\Windows\System32\extrac32.exe
    C:\\Windows\\System32\\extrac32 /C /Y C:\\Windows\\System32\\cmd.exe "C:\\Users\\Public\\alpha.exe"
    3⤵
    PID:3904
- - C:\Users\Public\alpha.exe
    C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:648
  - - C:\Windows\system32\extrac32.exe
      extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
      4⤵
      PID:800
- - C:\Users\Public\alpha.exe
    C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\wise_deposit_note__1114218690__3287491072__en.cmd" "C:\\Users\\Public\\Audio.mp4" 9
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1480
  - - C:\Users\Public\kn.exe
      C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\wise_deposit_note__1114218690__3287491072__en.cmd" "C:\\Users\\Public\\Audio.mp4" 9
      4⤵
      Executes dropped EXE
      PID:1856
- - C:\Users\Public\alpha.exe
    C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Audio.mp4" "C:\\Users\\Public\\Libraries\\Audio.pif" 12
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3780
  - - C:\Users\Public\kn.exe
      C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Audio.mp4" "C:\\Users\\Public\\Libraries\\Audio.pif" 12
      4⤵
      Executes dropped EXE
      PID:1684
- - C:\Users\Public\Libraries\Audio.pif
    C:\Users\Public\Libraries\Audio.pif
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1544
  - - C:\Users\Public\Libraries\yrblzjxP.pif
      C:\Users\Public\Libraries\yrblzjxP.pif
      4⤵
      Executes dropped EXE
      PID:4032
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4032 -s 224
        5⤵
        Program crash
        
        PID:4284
  - - C:\Windows\SysWOW64\extrac32.exe
      C:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\Public\Libraries\Audio.pif C:\\Users\\Public\\Libraries\\Pxjzlbry.PIF
      4⤵
      PID:2132
  - - C:\Windows\SysWOW64\colorcpl.exe
      C:\Windows\System32\colorcpl.exe
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:3348
- - C:\Users\Public\alpha.exe
    C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\kn.exe" / A / F / Q / S
    3⤵
    - Executes dropped EXE
    PID:4760
- - C:\Users\Public\alpha.exe
    C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\Audio.mp4" / A / F / Q / S
    3⤵
    - Executes dropped EXE
    PID:1764
- C:\Windows\SysWOW64\NETSTAT.EXE
  "C:\Windows\SysWOW64\NETSTAT.EXE"
  2⤵
  - Suspicious use of SetThreadContext
  - Gathers network information
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3188
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Windows\SysWOW64\colorcpl.exe"
    3⤵
    PID:1012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4032 -ip 4032
1⤵
PID:3336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4324 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:8
1⤵
PID:3644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Audio.mp4

Path C:\Users\Public\Audio.mp4
Size 1.7MB
SHA256 26de6e62d11c5b463d2077c56f11c4bfddaa8e83200ab1facc29e478e15f11ff
MD5 19c1e12dd929495409539244b0ed93c7
SHA1 4cfa1823732b5b7357ddb1932d3b1547c7227619
SHA512 6b09493e2a26f8aa43e2cf34ab5973b7ab28b6ab95ad014d767bb7b4f9bb541c12f013a53c42b9f8931a304105f7da486b51749c453021d234303336fd82a2b4
SSDEEP 24576:N/bwChmEbSmbz7td2lXbRlqr5MsaVfeHnzOqX66e5S:v
MD5 SHA1 SHA512 SSDEEP

Submit Download

Audio.pif

Path C:\Users\Public\Libraries\Audio.pif
Size 890KB
SHA256 8d49b42445b075555360a8809710d34bc35d8658ced4ed1a062b6d4c2e7be2e6
MD5 a0af268716f0954964b48a4ac5c44b08
SHA1 f80f8c5083002d8e9484a45d21221e5c7f0160dc
SHA512 3f6588e1b76450cd72711b505ff81072f7055de76abcd5dab5bcc03d7a91b214422152f470ff8ffce73cbe8501e75dff6dd60371ebf7da7a6927741c09279692
SSDEEP 12288:QtczN67F1vQGpS4s7hodOZUzBaVYklyjDngeGF6OLMyWpldQ1QHFwfmxysAkmCq0:QGzNwzvZS4s7hodOKk5eD7Gd9xu+DTT
MD5 SHA1 SHA512 SSDEEP

Submit Download

yrblzjxP.pif

Path C:\Users\Public\Libraries\yrblzjxP.pif
Size 66KB
SHA256 7bcdc2e607abc65ef93afd009c3048970d9e8d1c2a18fc571562396b13ebb301
MD5 c116d3604ceafe7057d77ff27552c215
SHA1 452b14432fb5758b46f2897aeccd89f7c82a727d
SHA512 9202a00eeaf4c5be94de32fd41bfea40fc32d368955d49b7bad2b5c23c4ebc92dccb37d99f5a14e53ad674b63f1baa6efb1feb27225c86693ead3262a26d66c6
SSDEEP 1536:lR2rJpByeL+39Ua1ITgA8wpuO5CU4GGMGcT4idU:lR2lg9Ua1egkCU60U
MD5 SHA1 SHA512 SSDEEP

Submit Download

alpha.exe

Path C:\Users\Public\alpha.exe
Size 283KB
SHA256 b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450
MD5 8a2122e8162dbef04694b9c3e0b6cdee
SHA1 f1efb0fddc156e4c61c5f78a54700e4e7984d55d
SHA512 99e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397
SSDEEP 6144:k4WA1B9BxDfQWKORSqY4zOcmpdlc3gJdmtolSm:H1BhkWvSqY4zvmjOwJIT
MD5 SHA1 SHA512 SSDEEP

Submit Download

kn.exe

Path C:\Users\Public\kn.exe
Size 1.6MB
SHA256 8de7b4eb1301d6cbe4ea2c8d13b83280453eb64e3b3c80756bbd1560d65ca4d2
MD5 bd8d9943a9b1def98eb83e0fa48796c2
SHA1 70e89852f023ab7cde0173eda1208dbb580f1e4f
SHA512 95630fdddad5db60cc97ec76ee1ca02dbb00ee3de7d6957ecda8968570e067ab2a9df1cc07a3ce61161a994acbe8417c83661320b54d04609818009a82552f7b
SSDEEP 24576:aCaND6ankkViMCsJf0JhY+3hvwUJDP+t3HvDGKK1V3FuNM2GRUY/ejsSvVo2:aCiDLnPipbJ5vwES3CKGVVuNM20UXa2
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1544-28-0x0000000000400000-0x00000000004E7000-memory.dmp

Download

memory/3188-51-0x00000000000A0000-0x00000000000AB000-memory.dmp

Download

memory/3188-52-0x0000000000700000-0x000000000072F000-memory.dmp

Download

memory/3348-46-0x0000000004E90000-0x0000000005E90000-memory.dmp

Download

memory/3348-50-0x0000000004E90000-0x0000000005E90000-memory.dmp

Download

memory/3364-56-0x00000000085C0000-0x00000000086BD000-memory.dmp

Download

memory/4032-32-0x0000000000400000-0x0000000001400000-memory.dmp

Download

memory/4032-36-0x0000000000400000-0x000000000041A000-memory.dmp

Download