formbook | c6b1ba9ffe05a03d88f24ae7fe9c3543976d9c392862d4c2ca6ca2d53c4befd6

Analysis

max time kernel
148s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 08:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PURCHASING ORDER.exe
Size 621KB
Sample240719-j15csa1app
SHA256 c6b1ba9ffe05a03d88f24ae7fe9c3543976d9c392862d4c2ca6ca2d53c4befd6
MD5 6daa7c8e19391e18c373678daaf6f1f2
SHA1 f4173eea04bd72474293a1144171771bf7575578
SHA512 96812cd74ade57ae0724e10f30399aa1d0456dbcdc12948153b0935d469b52fca23124b1281cee82e59281b2ce07ba6fb518248b14e1be3e39fee032ae347e19
SSDEEP 12288:RQiuaKWgPglHRO2/IJeDp3kQHurvjA7ZT2WLJyV6YN9Z5:RDngolHg2/IJeD2QH68DoV6Y3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook hy08 execution rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

hy08

Decoy

weazc.top
servoceimmpajhnuz.info
vqemkdhi.xyz
wergol.com
spa-mk.com
rtpsid88.life
tatetits.fun
raidsa.xyz
suojiansuode.net
jointhejunction.com
wudai.net
typeboot.shop
mksport-app.com
miocloud.ovh
taipan77pandan.com
wwwhg58a.com
khuahamiksai31.pro
carpedatumllc.net
safebinders.com
krx21.com
qyld9yp.icu
ischover.com
lineagegenetics.com
breakfreesoar.com
os9user.com
m1rmen.tech
cttlca.click
privacysift.com
gilggak.com
horxncnt.xyz
strategyguys.info
egyptflickcasino.online
5536canoga.com
ilpradio.com
shahgoldentravel.com
autismtour.com
alivioquantico.com
valo.games
manhuafeifei.xyz
bihungoreng22.click
btc158.com
500728.party
hemcksqa.net
agclcdstf460.xyz
flywatchsecurity.com
bedazzledbabe.com
btcrenaissance.net
mavincrm.com
65618.asia
axgventures.com
arelenegrace.com
cryptosmartguide.xyz
bodgion.xyz
21556934.com
cheaplaptops.biz
v2e5g.xyz
yc23w.top
24khome.com
cdncf.xyz
marabudigital.online
3sqre.lol
entgab679y.top
b10a.shop
mekanbahis104.com
avai66.xyz

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/2632-16-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/2632-22-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1516-27-0x00000000000D0000-0x00000000000FF000-memory.dmp	formbook

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2792	powershell.exe

Deletes itself 1 IoCs

pid	Process
676	cmd.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2176 set thread context of 2632	2176	PURCHASING ORDER.exe	35
PID 2632 set thread context of 1236	2632	PURCHASING ORDER.exe	21
PID 2632 set thread context of 1236	2632	PURCHASING ORDER.exe	21
PID 1516 set thread context of 1236	1516	rundll32.exe	21

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2780	schtasks.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
2632	PURCHASING ORDER.exe
2632	PURCHASING ORDER.exe
2792	powershell.exe
2632	PURCHASING ORDER.exe
1516	rundll32.exe
1516	rundll32.exe
1516	rundll32.exe
1516	rundll32.exe
1516	rundll32.exe
1516	rundll32.exe
1516	rundll32.exe
1516	rundll32.exe
1516	rundll32.exe
1516	rundll32.exe
1516	rundll32.exe
1516	rundll32.exe
1516	rundll32.exe
1516	rundll32.exe
1516	rundll32.exe
1516	rundll32.exe
1516	rundll32.exe
1516	rundll32.exe
1516	rundll32.exe
1516	rundll32.exe
1516	rundll32.exe
1516	rundll32.exe
1516	rundll32.exe
1516	rundll32.exe
1516	rundll32.exe
1516	rundll32.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
2632	PURCHASING ORDER.exe
2632	PURCHASING ORDER.exe
2632	PURCHASING ORDER.exe
2632	PURCHASING ORDER.exe
1516	rundll32.exe
1516	rundll32.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2632	PURCHASING ORDER.exe
Token: SeDebugPrivilege	2792	powershell.exe
Token: SeDebugPrivilege	1516	rundll32.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2792	2176	PURCHASING ORDER.exe	31
PID 2176 wrote to memory of 2792	2176	PURCHASING ORDER.exe	31
PID 2176 wrote to memory of 2792	2176	PURCHASING ORDER.exe	31
PID 2176 wrote to memory of 2792	2176	PURCHASING ORDER.exe	31
PID 2176 wrote to memory of 2780	2176	PURCHASING ORDER.exe	33
PID 2176 wrote to memory of 2780	2176	PURCHASING ORDER.exe	33
PID 2176 wrote to memory of 2780	2176	PURCHASING ORDER.exe	33
PID 2176 wrote to memory of 2780	2176	PURCHASING ORDER.exe	33
PID 2176 wrote to memory of 2632	2176	PURCHASING ORDER.exe	35
PID 2176 wrote to memory of 2632	2176	PURCHASING ORDER.exe	35
PID 2176 wrote to memory of 2632	2176	PURCHASING ORDER.exe	35
PID 2176 wrote to memory of 2632	2176	PURCHASING ORDER.exe	35
PID 2176 wrote to memory of 2632	2176	PURCHASING ORDER.exe	35
PID 2176 wrote to memory of 2632	2176	PURCHASING ORDER.exe	35
PID 2176 wrote to memory of 2632	2176	PURCHASING ORDER.exe	35
PID 1236 wrote to memory of 1516	1236	Explorer.EXE	36
PID 1236 wrote to memory of 1516	1236	Explorer.EXE	36
PID 1236 wrote to memory of 1516	1236	Explorer.EXE	36
PID 1236 wrote to memory of 1516	1236	Explorer.EXE	36
PID 1236 wrote to memory of 1516	1236	Explorer.EXE	36
PID 1236 wrote to memory of 1516	1236	Explorer.EXE	36
PID 1236 wrote to memory of 1516	1236	Explorer.EXE	36
PID 1516 wrote to memory of 676	1516	rundll32.exe	37
PID 1516 wrote to memory of 676	1516	rundll32.exe	37
PID 1516 wrote to memory of 676	1516	rundll32.exe	37
PID 1516 wrote to memory of 676	1516	rundll32.exe	37

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Users\Admin\AppData\Local\Temp\PURCHASING ORDER.exe
  "C:\Users\Admin\AppData\Local\Temp\PURCHASING ORDER.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2176
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\HZvDRVV.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2792
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HZvDRVV" /XML "C:\Users\Admin\AppData\Local\Temp\tmp120A.tmp"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2780
- - C:\Users\Admin\AppData\Local\Temp\PURCHASING ORDER.exe
    "C:\Users\Admin\AppData\Local\Temp\PURCHASING ORDER.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:2632
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\SysWOW64\rundll32.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1516
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\PURCHASING ORDER.exe"
    3⤵
    - Deletes itself
    PID:676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp120A.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp120A.tmp
Size 1KB
SHA256 53598ea33eca9e2bdec9c33e327e9d574fd9c5f32f3428ced72a4551bbad0a54
MD5 f08a226e1ed97a1a48095545ce7f0261
SHA1 34735834a92b6b8767737003077d115389fedc6a
SHA512 260f343a1ab78b95ad7e4178e7d4e61a84d2320c247c157cf4400b062e361093f1cb396de283d70b00dc9c85f60fb432d68ce030ec91fd770abc000b06e33290
MD5 SHA1 SHA512

Submit Download

memory/1236-23-0x00000000067E0000-0x000000000697A000-memory.dmp

Download

memory/1236-21-0x0000000000010000-0x0000000000020000-memory.dmp

Download

memory/1516-27-0x00000000000D0000-0x00000000000FF000-memory.dmp

Download

memory/1516-26-0x0000000000CA0000-0x0000000000CAE000-memory.dmp

Download

memory/1516-24-0x0000000000CA0000-0x0000000000CAE000-memory.dmp

Download

memory/2176-4-0x00000000004B0000-0x00000000004BE000-memory.dmp

Download

memory/2176-17-0x0000000074080000-0x000000007476E000-memory.dmp

Download

memory/2176-5-0x0000000004DD0000-0x0000000004E46000-memory.dmp

Download

memory/2176-0-0x000000007408E000-0x000000007408F000-memory.dmp

Download

memory/2176-3-0x0000000074080000-0x000000007476E000-memory.dmp

Download

memory/2176-2-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/2176-1-0x0000000000110000-0x00000000001B2000-memory.dmp

Download

memory/2632-11-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2632-16-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2632-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2632-13-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2632-22-0x0000000000400000-0x000000000042F000-memory.dmp

Download