formbook | d577dfa0273275bc6013e1c893a3da5e8744dd7a7dd52a7b072032b86e93c1b8

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 13:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d577dfa0273275bc6013e1c893a3da5e8744dd7a7dd52a7b072032b86e93c1b8.exe
Size 1.5MB
Sample240703-qkhbmszdll
SHA256 d577dfa0273275bc6013e1c893a3da5e8744dd7a7dd52a7b072032b86e93c1b8
MD5 caf053b7452bb345a2e751ecf92fe668
SHA1 b50eab859ed3e6462cbca4e386353b65d19e5932
SHA512 d9ab02ae288a5db1bc41f4ae67a0564b909b34b98b8bd492ce334c57df0e1704af35348d980629813dd17e6a10c09fefcafb29c23c07bb694d0453d4aec9035e
SSDEEP 24576:qisp/COjcSNvhPgdqC6AdpHtcGoWNLBMK61vxuxHdH8hgC/aJ1MmVkkkkkkWxkj:qDC4Pgp6AvHtRDvV08x9HOaTVkkkkkk
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook ca63 persistence rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

ca63

Decoy

themaxrichth.online
lhzshb.com
isacarrceramics.online
duhochanquoc.website
apexmedia.pro
33311.pro
x2mjbu8gg.shop
dashcreative.online
nifle.shop
hora.lol
rclrwa.asia
aviation-training-sqj.top
a9659a62.vip
uspgh.work
hhol5.top
jinkaida-cn.cn
watchwedding.com
728ym.lat
gillieron.swiss
bingsne.online
professionaljournalism.com
senior-living-15150.bond
chatsio.com
dr-jordan.site
sador.xyz
nagaways.online
552357.pro
domainupdate.site
3v5u21668.shop
dh76044.vip
cineflickapp.online
ht31a.vip
workingcat.online
9h6db.shop
evallc.net
sun20win.digital
683ym.lat
retrosystem.fun
bgkamil.xyz
androidmobiledk.today
gsptx.online
onlineit.sbs
violetnuit.shop
kyusgwh2.top
vdqgj.asia
helpmepeas.net
4399game.asia
tent-homes-10133.bond
moki.dev
raildriver.net
lkjuy.xyz
presentdadsmatter.shop
amp-kopi77i2.xyz
cyber-security-onli.bond
rtpcmbet27.xyz
80lrlaenant8.life
urostatingr.shop
xn--fiq73f39fx0y2hq.work
zc041.xyz
34-health.shop
yunhaicm.asia
domain-2.buzz
money1lifecoachingservice.net
5301ulovp.website
siasstudios.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/1028-17-0x0000000004830000-0x0000000005830000-memory.dmp	formbook
behavioral2/memory/1028-20-0x0000000004830000-0x0000000005830000-memory.dmp	formbook
behavioral2/memory/4748-22-0x0000000000880000-0x00000000008AF000-memory.dmp	formbook

Executes dropped EXE 1 IoCs

pid	Process
1300	jdavnpzT.pif

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tzpnvadj = "C:\\Users\\Public\\Tzpnvadj.url"	d577dfa0273275bc6013e1c893a3da5e8744dd7a7dd52a7b072032b86e93c1b8.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3368 set thread context of 1300	3368	d577dfa0273275bc6013e1c893a3da5e8744dd7a7dd52a7b072032b86e93c1b8.exe	86
PID 1028 set thread context of 3516	1028	colorcpl.exe	56
PID 4748 set thread context of 3516	4748	chkdsk.exe	56

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3468	1300	WerFault.exe	86

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	chkdsk.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	23	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 56 IoCs

pid	Process
3368	d577dfa0273275bc6013e1c893a3da5e8744dd7a7dd52a7b072032b86e93c1b8.exe
3368	d577dfa0273275bc6013e1c893a3da5e8744dd7a7dd52a7b072032b86e93c1b8.exe
1028	colorcpl.exe
1028	colorcpl.exe
1028	colorcpl.exe
1028	colorcpl.exe
4748	chkdsk.exe
4748	chkdsk.exe
4748	chkdsk.exe
4748	chkdsk.exe
4748	chkdsk.exe
4748	chkdsk.exe
4748	chkdsk.exe
4748	chkdsk.exe
4748	chkdsk.exe
4748	chkdsk.exe
4748	chkdsk.exe
4748	chkdsk.exe
4748	chkdsk.exe
4748	chkdsk.exe
4748	chkdsk.exe
4748	chkdsk.exe
4748	chkdsk.exe
4748	chkdsk.exe
4748	chkdsk.exe
4748	chkdsk.exe
4748	chkdsk.exe
4748	chkdsk.exe
4748	chkdsk.exe
4748	chkdsk.exe
4748	chkdsk.exe
4748	chkdsk.exe
4748	chkdsk.exe
4748	chkdsk.exe
4748	chkdsk.exe
4748	chkdsk.exe
4748	chkdsk.exe
4748	chkdsk.exe
4748	chkdsk.exe
4748	chkdsk.exe
4748	chkdsk.exe
4748	chkdsk.exe
4748	chkdsk.exe
4748	chkdsk.exe
4748	chkdsk.exe
4748	chkdsk.exe
4748	chkdsk.exe
4748	chkdsk.exe
4748	chkdsk.exe
4748	chkdsk.exe
4748	chkdsk.exe
4748	chkdsk.exe
4748	chkdsk.exe
4748	chkdsk.exe
4748	chkdsk.exe
4748	chkdsk.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
1028	colorcpl.exe
1028	colorcpl.exe
1028	colorcpl.exe
4748	chkdsk.exe
4748	chkdsk.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1028	colorcpl.exe
Token: SeShutdownPrivilege	3516	Explorer.EXE
Token: SeCreatePagefilePrivilege	3516	Explorer.EXE
Token: SeShutdownPrivilege	3516	Explorer.EXE
Token: SeCreatePagefilePrivilege	3516	Explorer.EXE
Token: SeDebugPrivilege	4748	chkdsk.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 1300	3368	d577dfa0273275bc6013e1c893a3da5e8744dd7a7dd52a7b072032b86e93c1b8.exe	86
PID 3368 wrote to memory of 1300	3368	d577dfa0273275bc6013e1c893a3da5e8744dd7a7dd52a7b072032b86e93c1b8.exe	86
PID 3368 wrote to memory of 1300	3368	d577dfa0273275bc6013e1c893a3da5e8744dd7a7dd52a7b072032b86e93c1b8.exe	86
PID 3368 wrote to memory of 1300	3368	d577dfa0273275bc6013e1c893a3da5e8744dd7a7dd52a7b072032b86e93c1b8.exe	86
PID 3368 wrote to memory of 1300	3368	d577dfa0273275bc6013e1c893a3da5e8744dd7a7dd52a7b072032b86e93c1b8.exe	86
PID 3368 wrote to memory of 4696	3368	d577dfa0273275bc6013e1c893a3da5e8744dd7a7dd52a7b072032b86e93c1b8.exe	92
PID 3368 wrote to memory of 4696	3368	d577dfa0273275bc6013e1c893a3da5e8744dd7a7dd52a7b072032b86e93c1b8.exe	92
PID 3368 wrote to memory of 4696	3368	d577dfa0273275bc6013e1c893a3da5e8744dd7a7dd52a7b072032b86e93c1b8.exe	92
PID 3368 wrote to memory of 1028	3368	d577dfa0273275bc6013e1c893a3da5e8744dd7a7dd52a7b072032b86e93c1b8.exe	93
PID 3368 wrote to memory of 1028	3368	d577dfa0273275bc6013e1c893a3da5e8744dd7a7dd52a7b072032b86e93c1b8.exe	93
PID 3368 wrote to memory of 1028	3368	d577dfa0273275bc6013e1c893a3da5e8744dd7a7dd52a7b072032b86e93c1b8.exe	93
PID 3368 wrote to memory of 1028	3368	d577dfa0273275bc6013e1c893a3da5e8744dd7a7dd52a7b072032b86e93c1b8.exe	93
PID 3516 wrote to memory of 4748	3516	Explorer.EXE	94
PID 3516 wrote to memory of 4748	3516	Explorer.EXE	94
PID 3516 wrote to memory of 4748	3516	Explorer.EXE	94
PID 4748 wrote to memory of 5012	4748	chkdsk.exe	95
PID 4748 wrote to memory of 5012	4748	chkdsk.exe	95
PID 4748 wrote to memory of 5012	4748	chkdsk.exe	95

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3516
- C:\Users\Admin\AppData\Local\Temp\d577dfa0273275bc6013e1c893a3da5e8744dd7a7dd52a7b072032b86e93c1b8.exe
  "C:\Users\Admin\AppData\Local\Temp\d577dfa0273275bc6013e1c893a3da5e8744dd7a7dd52a7b072032b86e93c1b8.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3368
- - C:\Users\Public\Libraries\jdavnpzT.pif
    C:\Users\Public\Libraries\jdavnpzT.pif
    3⤵
    - Executes dropped EXE
    PID:1300
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1300 -s 224
      4⤵
      Program crash
      PID:3468
- - C:\Windows\SysWOW64\extrac32.exe
    C:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\Admin\AppData\Local\Temp\d577dfa0273275bc6013e1c893a3da5e8744dd7a7dd52a7b072032b86e93c1b8.exe C:\\Users\\Public\\Libraries\\Tzpnvadj.PIF
    3⤵
    PID:4696
- - C:\Windows\SysWOW64\colorcpl.exe
    C:\Windows\System32\colorcpl.exe
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:1028
- C:\Windows\SysWOW64\chkdsk.exe
  "C:\Windows\SysWOW64\chkdsk.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4748
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Windows\SysWOW64\colorcpl.exe"
    3⤵
    PID:5012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1300 -ip 1300
1⤵
PID:2020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jdavnpzT.pif

Path C:\Users\Public\Libraries\jdavnpzT.pif
Size 66KB
SHA256 7bcdc2e607abc65ef93afd009c3048970d9e8d1c2a18fc571562396b13ebb301
MD5 c116d3604ceafe7057d77ff27552c215
SHA1 452b14432fb5758b46f2897aeccd89f7c82a727d
SHA512 9202a00eeaf4c5be94de32fd41bfea40fc32d368955d49b7bad2b5c23c4ebc92dccb37d99f5a14e53ad674b63f1baa6efb1feb27225c86693ead3262a26d66c6
SSDEEP 1536:lR2rJpByeL+39Ua1ITgA8wpuO5CU4GGMGcT4idU:lR2lg9Ua1egkCU60U
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1028-17-0x0000000004830000-0x0000000005830000-memory.dmp

Download

memory/1028-20-0x0000000004830000-0x0000000005830000-memory.dmp

Download

memory/1300-5-0x0000000000400000-0x0000000001400000-memory.dmp

Download

memory/1300-9-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/3368-0-0x0000000002240000-0x0000000002241000-memory.dmp

Download

memory/3368-1-0x0000000000400000-0x0000000000582000-memory.dmp

Download

memory/3516-26-0x0000000008760000-0x00000000088A5000-memory.dmp

Download

memory/4748-21-0x00000000005A0000-0x00000000005AA000-memory.dmp

Download

memory/4748-22-0x0000000000880000-0x00000000008AF000-memory.dmp

Download