formbook | f48a16e3da0c253c8d6e017129afab39e789b84acc445bba0cb47f1a79daa074

General

Target

a328bc2d66baa94dc748b1a450a0ede9601ff9ccec5ff2cfd043e669383ba295.exe
Size

240KB
MD5

5c52be5501bfd96e7aa76bfa04b54e00
SHA1

83efb1f56aff4dd969222f6ffd747be0a6d7a072
SHA256

a328bc2d66baa94dc748b1a450a0ede9601ff9ccec5ff2cfd043e669383ba295
SHA512

fed8633986c845d02d1a4a791d23fd0c4850b70b5e9ad2f7a107b350a7fccc7b991c2c061dbd13efc7649bcf773d456eed068deaa7e56c25cfff19894096de20
SSDEEP

6144:HNeZmwyfaJ1I8cPNeraTn7t7OgwtQ5KzlQJzRRjaXNya5:HNlhCvI82jF7OPtQEUzRRu9ya5

Score

10^/10

formbook mh76 discovery rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

mh76

Decoy

healthgovcalottery.net

wenxinliao.com

rooterphd.com

bbobbo.one

american-mes-de-dezembro.xyz

mintager.com

thespecialtstore.com

wemakegreenhomes.com

occurandmental.xyz

fidelityrealtytitle.com

numerisat.asia

wearestallions.com

supxl.com

rajacumi.com

renaziv.online

blixtindustries.com

fjljq.com

exploretrivenicamping.com

authenticusspa.com

uucloud.press

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Formbook family
formbook

Formbook payload 4 IoCs

rat

resource	yara_rule
behavioral1/memory/2944-18-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/2944-15-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/2944-21-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/2948-31-0x00000000000D0000-0x00000000000FF000-memory.dmp	formbook

Executes dropped EXE 2 IoCs

pid	Process
3004	agvoj.exe
2944	agvoj.exe

Loads dropped DLL 3 IoCs

pid	Process
1760	a328bc2d66baa94dc748b1a450a0ede9601ff9ccec5ff2cfd043e669383ba295.exe
1760	a328bc2d66baa94dc748b1a450a0ede9601ff9ccec5ff2cfd043e669383ba295.exe
3004	agvoj.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3004 set thread context of 2944	3004	agvoj.exe	32
PID 2944 set thread context of 1284	2944	agvoj.exe	21
PID 2944 set thread context of 1284	2944	agvoj.exe	21
PID 2948 set thread context of 1284	2948	raserver.exe	21

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a328bc2d66baa94dc748b1a450a0ede9601ff9ccec5ff2cfd043e669383ba295.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agvoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agvoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	raserver.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
2944	agvoj.exe
2944	agvoj.exe
2944	agvoj.exe
2948	raserver.exe
2948	raserver.exe
2948	raserver.exe
2948	raserver.exe
2948	raserver.exe
2948	raserver.exe
2948	raserver.exe
2948	raserver.exe
2948	raserver.exe
2948	raserver.exe
2948	raserver.exe
2948	raserver.exe
2948	raserver.exe
2948	raserver.exe
2948	raserver.exe
2948	raserver.exe
2948	raserver.exe
2948	raserver.exe
2948	raserver.exe
2948	raserver.exe
2948	raserver.exe
2948	raserver.exe
2948	raserver.exe
2948	raserver.exe
2948	raserver.exe
2948	raserver.exe
2948	raserver.exe
2948	raserver.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
2944	agvoj.exe
2944	agvoj.exe
2944	agvoj.exe
2944	agvoj.exe
2948	raserver.exe
2948	raserver.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2944	agvoj.exe
Token: SeDebugPrivilege	2948	raserver.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1284	Explorer.EXE
1284	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1284	Explorer.EXE
1284	Explorer.EXE

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 3004	1760	a328bc2d66baa94dc748b1a450a0ede9601ff9ccec5ff2cfd043e669383ba295.exe	30
PID 1760 wrote to memory of 3004	1760	a328bc2d66baa94dc748b1a450a0ede9601ff9ccec5ff2cfd043e669383ba295.exe	30
PID 1760 wrote to memory of 3004	1760	a328bc2d66baa94dc748b1a450a0ede9601ff9ccec5ff2cfd043e669383ba295.exe	30
PID 1760 wrote to memory of 3004	1760	a328bc2d66baa94dc748b1a450a0ede9601ff9ccec5ff2cfd043e669383ba295.exe	30
PID 3004 wrote to memory of 2944	3004	agvoj.exe	32
PID 3004 wrote to memory of 2944	3004	agvoj.exe	32
PID 3004 wrote to memory of 2944	3004	agvoj.exe	32
PID 3004 wrote to memory of 2944	3004	agvoj.exe	32
PID 3004 wrote to memory of 2944	3004	agvoj.exe	32
PID 3004 wrote to memory of 2944	3004	agvoj.exe	32
PID 3004 wrote to memory of 2944	3004	agvoj.exe	32
PID 2944 wrote to memory of 2948	2944	agvoj.exe	33
PID 2944 wrote to memory of 2948	2944	agvoj.exe	33
PID 2944 wrote to memory of 2948	2944	agvoj.exe	33
PID 2944 wrote to memory of 2948	2944	agvoj.exe	33
PID 2948 wrote to memory of 2912	2948	raserver.exe	34
PID 2948 wrote to memory of 2912	2948	raserver.exe	34
PID 2948 wrote to memory of 2912	2948	raserver.exe	34
PID 2948 wrote to memory of 2912	2948	raserver.exe	34

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1284
- C:\Users\Admin\AppData\Local\Temp\a328bc2d66baa94dc748b1a450a0ede9601ff9ccec5ff2cfd043e669383ba295.exe
  "C:\Users\Admin\AppData\Local\Temp\a328bc2d66baa94dc748b1a450a0ede9601ff9ccec5ff2cfd043e669383ba295.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1760
- - C:\Users\Admin\AppData\Local\Temp\agvoj.exe
    C:\Users\Admin\AppData\Local\Temp\agvoj.exe C:\Users\Admin\AppData\Local\Temp\ggtxe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3004
  - - C:\Users\Admin\AppData\Local\Temp\agvoj.exe
      C:\Users\Admin\AppData\Local\Temp\agvoj.exe C:\Users\Admin\AppData\Local\Temp\ggtxe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2944
    - - C:\Windows\SysWOW64\raserver.exe
        
        "C:\Windows\SysWOW64\raserver.exe"
        5⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2948
      - C:\Windows\SysWOW64\cmd.exe
        
        /c del "C:\Users\Admin\AppData\Local\Temp\agvoj.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\agvoj.exe

Filesize
65KB

MD5
7e62ddeae0b2e64a1e2a2974d98a1c68

SHA1
133f1f1ab8d1c223556ca51e4295d190ba9d0a59

SHA256
58455bbff5636ff36755899c69ca4483f99a3fb0a7d5803cb8699d25e669f9e0

SHA512
94d3e72000b82d31c0c2401935108e33e5abfa92ab525ca0ddbe6084c300150125d9787df4fa0805501b8c2f7b1ebd37d2301731a9ea07a26f66498ddab30779

Download Submit
C:\Users\Admin\AppData\Local\Temp\ggtxe

Filesize
5KB

MD5
7e1c1889c241520714b99a279389e6ad

SHA1
6475ee3bc756107ba2ac134dc90229cf30b0ec98

SHA256
aedb19f73791ee830083f8df7f4696e6876cc9cd73fb3927b7844d7122c32ec2

SHA512
1204c351142c12c3974e5bf5f3503b2ef09756a71cb4ab4905a4e180fbd8051e5b372f6e1cade1ea1d4bca3e511df64c996b0851b7919f69633da6e9c5c48c4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\v3ig42xmsp4

Filesize
185KB

MD5
ecd0070d9b3e44f4fc6b891832486bf7

SHA1
1685f2b64e69ab8b6d9b12b2683c960d2e41b794

SHA256
bc87b335ceb2f903ecc2f983dfdecabf411c0b038546c8fc43a63cf9d8522d32

SHA512
e7ac8bb1a238789225f0d7a228af9f66cd80d1709096fb4ee9b6485e12d856fac42aeb60528a347402f57df2dc421c74cdd41af9c7736399bb36daa8f9d0bc74

Download Submit
memory/1284-19-0x0000000006EC0000-0x0000000006FDB000-memory.dmp

Filesize
1.1MB

Download
memory/1284-34-0x0000000007D00000-0x0000000007E78000-memory.dmp

Filesize
1.5MB

Download
memory/1284-22-0x0000000000210000-0x0000000000310000-memory.dmp

Filesize
1024KB

Download
memory/1284-23-0x0000000007B80000-0x0000000007CF5000-memory.dmp

Filesize
1.5MB

Download
memory/1284-24-0x0000000006EC0000-0x0000000006FDB000-memory.dmp

Filesize
1.1MB

Download
memory/1284-30-0x0000000007B80000-0x0000000007CF5000-memory.dmp

Filesize
1.5MB

Download
memory/2944-18-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2944-15-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2944-21-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2948-29-0x00000000007B0000-0x00000000007CC000-memory.dmp

Filesize
112KB

Download
memory/2948-28-0x00000000007B0000-0x00000000007CC000-memory.dmp

Filesize
112KB

Download
memory/2948-31-0x00000000000D0000-0x00000000000FF000-memory.dmp

Filesize
188KB

Download
memory/3004-12-0x0000000000230000-0x0000000000232000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing