formbook | a073edb1dacc3f6cbb7b416c6196f7d56a8d6d195a337952524e1e8ee5921461

Analysis

max time kernel
146s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
24/07/2024, 15:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Swift copy.exe
Size 598KB
Sample240724-sh7vmascnm
SHA256 a073edb1dacc3f6cbb7b416c6196f7d56a8d6d195a337952524e1e8ee5921461
MD5 aa175e1bf43f1c940ffd2e23f853a070
SHA1 bf01a6051d30abac10ba726e7ef40a68c17799f6
SHA512 65e1295e92dc6bd4bbf68c8769312cc024e84b1264e84b44d31cdec28f484dc9ac8026b42b83ff22848724e65ee57b0c9d777bce3896b84c497a668921e2487f
SSDEEP 12288:mYV6MorX7qzuC3QHO9FQVHPF51jgc/Ppf5/6KLrA5v5Jg:lBXu9HGaVH5hC6k5Bq
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook hc58 discovery rat spyware stealer trojan upx

Malware Config

Extracted

Family

formbook

Version

Campaign

hc58

Decoy

reunioncoins.com
slot88win.today
diamondcarp.com
poke138.site
cratermaketing.com
mutokiva.website
thstocks5.online
openaquasurge.com
prodsdigital.com
exileescape.com
iqcjuetaudtj.com
bwexhaustprofl.com
indiglobalconnect.com
pushkeyclub.com
stephvin.top
lifebione.com
hannahmegery.com
brookchivell.com
bioskyline.com
nonprofitgrants.online
dhfldhs007.com
horizonlegalservices.com
suhanszki.com
royacinnamon.com
eastcarolinaapartments.com
6jo-aqua.com
valemoda.shop
nettasfl.com
appgo88a.info
ajun455678.club
homehearthco.com
newrica.net
b8226.vip
theleonlegacy.com
smnwa.net
brightwayentertainment.net
ntitnet.com
emfblockage.com
latinopridereport.com
lensreadylooks.com
dijvhy.cfd
96722app.com
xoflaire.com
buiptr.com
clepets.com
sympathyforthedeli.com
zzxxxfxb.xyz
artificial-ace.com
neonabby.net
africanventuresvolunteering.com
the-jokers.com
opjauz.cfd
work-abroad-37879.bond
freekmagazine.com
work-abroad-27757.bond
karaokeboats.com
ro-news.site
96b52.net
texasschooltraining.com
coincentral.info
spacezaim.site
2016euro.net
parkxcity.com
ylhg779.com
abacuzz.dev

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/2748-12-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/2748-18-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/2200-22-0x00000000000D0000-0x00000000000FF000-memory.dmp	formbook

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2732-0-0x0000000000C90000-0x0000000000DE7000-memory.dmp	upx
behavioral1/memory/2732-14-0x0000000000C90000-0x0000000000DE7000-memory.dmp	upx

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/2732-14-0x0000000000C90000-0x0000000000DE7000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2732 set thread context of 2748	2732	Swift copy.exe	30
PID 2748 set thread context of 1200	2748	svchost.exe	21
PID 2200 set thread context of 1200	2200	cmstp.exe	21

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Swift copy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmstp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
2748	svchost.exe
2748	svchost.exe
2200	cmstp.exe
2200	cmstp.exe
2200	cmstp.exe
2200	cmstp.exe
2200	cmstp.exe
2200	cmstp.exe
2200	cmstp.exe
2200	cmstp.exe
2200	cmstp.exe
2200	cmstp.exe
2200	cmstp.exe
2200	cmstp.exe
2200	cmstp.exe
2200	cmstp.exe
2200	cmstp.exe
2200	cmstp.exe
2200	cmstp.exe
2200	cmstp.exe
2200	cmstp.exe
2200	cmstp.exe
2200	cmstp.exe
2200	cmstp.exe
2200	cmstp.exe
2200	cmstp.exe
2200	cmstp.exe
2200	cmstp.exe
2200	cmstp.exe
2200	cmstp.exe
2200	cmstp.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
2732	Swift copy.exe
2748	svchost.exe
2748	svchost.exe
2748	svchost.exe
2200	cmstp.exe
2200	cmstp.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2748	svchost.exe
Token: SeDebugPrivilege	2200	cmstp.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 2748	2732	Swift copy.exe	30
PID 2732 wrote to memory of 2748	2732	Swift copy.exe	30
PID 2732 wrote to memory of 2748	2732	Swift copy.exe	30
PID 2732 wrote to memory of 2748	2732	Swift copy.exe	30
PID 2732 wrote to memory of 2748	2732	Swift copy.exe	30
PID 1200 wrote to memory of 2200	1200	Explorer.EXE	49
PID 1200 wrote to memory of 2200	1200	Explorer.EXE	49
PID 1200 wrote to memory of 2200	1200	Explorer.EXE	49
PID 1200 wrote to memory of 2200	1200	Explorer.EXE	49
PID 1200 wrote to memory of 2200	1200	Explorer.EXE	49
PID 1200 wrote to memory of 2200	1200	Explorer.EXE	49
PID 1200 wrote to memory of 2200	1200	Explorer.EXE	49
PID 2200 wrote to memory of 1192	2200	cmstp.exe	50
PID 2200 wrote to memory of 1192	2200	cmstp.exe	50
PID 2200 wrote to memory of 1192	2200	cmstp.exe	50
PID 2200 wrote to memory of 1192	2200	cmstp.exe	50

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Users\Admin\AppData\Local\Temp\Swift copy.exe
  "C:\Users\Admin\AppData\Local\Temp\Swift copy.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Windows\SysWOW64\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\Swift copy.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:2748
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:2868
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:2616
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:2896
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:2856
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:2832
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:2280
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:2876
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:2636
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:2644
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:1684
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:2764
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:2592
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:2600
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:2608
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:2632
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:2652
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:2660
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:624
- C:\Windows\SysWOW64\cmstp.exe
  "C:\Windows\SysWOW64\cmstp.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Windows\SysWOW64\svchost.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1200-19-0x0000000004190000-0x0000000004246000-memory.dmp

Download

memory/1200-25-0x0000000004190000-0x0000000004246000-memory.dmp

Download

memory/2200-20-0x0000000000850000-0x0000000000868000-memory.dmp

Download

memory/2200-21-0x0000000000850000-0x0000000000868000-memory.dmp

Download

memory/2200-22-0x00000000000D0000-0x00000000000FF000-memory.dmp

Download

memory/2732-0-0x0000000000C90000-0x0000000000DE7000-memory.dmp

Download

memory/2732-11-0x0000000000150000-0x0000000000154000-memory.dmp

Download

memory/2732-14-0x0000000000C90000-0x0000000000DE7000-memory.dmp

Download

memory/2748-12-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2748-16-0x0000000000930000-0x0000000000C33000-memory.dmp

Download

memory/2748-18-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2748-17-0x0000000000260000-0x0000000000275000-memory.dmp

Download