formbook | 9b0bfd03394e34336bb2dc5bc9001243a95c553ca2cdaf3d79820787a4e39226

Analysis

max time kernel
149s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25-12-2024 06:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

jetsjets6654.exe
Size

1.2MB
MD5

957242e6d5769a32406189f7f05f50af
SHA1

42297b45d76f9c475842fe6cbc60426aea470d8c
SHA256

3eeec1884c0a7d2c7c49991d08bcf731f563fd55faff77cf02b5c6f73f34b5f1
SHA512

e812a0d87b4c3af2bc2f7c25cb11256414a1b9577e405f8e0cfa86384bbdb998da21fdd015c17c57188db4e107b746acc0d579504b81050c6e1af05b101c305a
SSDEEP

24576:iAOcZXp00Sjm2GbobhjkmK3cLSzv7w84UopeOH+2UNUquptQZCU:oDl44U3hvUUbJZupXU

Score

10^/10

formbook je14 discovery rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

je14

Decoy

innervisionbuildings.com

theenergysocialite.com

565548.com

panghr.com

onlyonesolutions.com

stjohnzone6.com

cnotes.rest

helfeb.online

xixi-s-inc.club

easilyentered.com

theshopx.store

mrclean-ac.com

miamibeachwateradventures.com

jpearce.co.uk

seseragi-bunkou.com

minimaddie.com

commbank-help-849c3.com

segohandelsonderneming.com

namthanhreal.com

fototerapi.online

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Formbook family
formbook

Formbook payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/3036-91-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/2280-96-0x0000000000400000-0x0000000000961000-memory.dmp	formbook
behavioral1/memory/1384-102-0x0000000000070000-0x000000000009F000-memory.dmp	formbook

Executes dropped EXE 1 IoCs

pid	Process
2512	kgxqxqi.pif

Loads dropped DLL 4 IoCs

pid	Process
2688	jetsjets6654.exe
2688	jetsjets6654.exe
2688	jetsjets6654.exe
2688	jetsjets6654.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 2512 set thread context of 3036	2512	kgxqxqi.pif	32
PID 2512 set thread context of 2280	2512	kgxqxqi.pif	31
PID 2280 set thread context of 1112	2280	RegSvcs.exe	20
PID 3036 set thread context of 1112	3036	RegSvcs.exe	20
PID 1384 set thread context of 1112	1384	cscript.exe	20

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jetsjets6654.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kgxqxqi.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
3036	RegSvcs.exe
2280	RegSvcs.exe
2280	RegSvcs.exe
3036	RegSvcs.exe
1384	cscript.exe
1852	cscript.exe
1384	cscript.exe
1384	cscript.exe
1384	cscript.exe
1384	cscript.exe
1384	cscript.exe
1384	cscript.exe
1384	cscript.exe
1384	cscript.exe
1384	cscript.exe
1384	cscript.exe
1384	cscript.exe
1384	cscript.exe
1384	cscript.exe
1384	cscript.exe
1384	cscript.exe
1384	cscript.exe
1384	cscript.exe
1384	cscript.exe
1384	cscript.exe
1384	cscript.exe
1384	cscript.exe
1384	cscript.exe
1384	cscript.exe
1384	cscript.exe
1384	cscript.exe
1384	cscript.exe
1384	cscript.exe
1384	cscript.exe

Suspicious behavior: MapViewOfSection 8 IoCs

pid	Process
2280	RegSvcs.exe
3036	RegSvcs.exe
2280	RegSvcs.exe
2280	RegSvcs.exe
3036	RegSvcs.exe
3036	RegSvcs.exe
1384	cscript.exe
1384	cscript.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2280	RegSvcs.exe
Token: SeDebugPrivilege	3036	RegSvcs.exe
Token: SeDebugPrivilege	1384	cscript.exe
Token: SeDebugPrivilege	1852	cscript.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1112	Explorer.EXE
1112	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1112	Explorer.EXE
1112	Explorer.EXE

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 2512	2688	jetsjets6654.exe	30
PID 2688 wrote to memory of 2512	2688	jetsjets6654.exe	30
PID 2688 wrote to memory of 2512	2688	jetsjets6654.exe	30
PID 2688 wrote to memory of 2512	2688	jetsjets6654.exe	30
PID 2512 wrote to memory of 2280	2512	kgxqxqi.pif	31
PID 2512 wrote to memory of 2280	2512	kgxqxqi.pif	31
PID 2512 wrote to memory of 2280	2512	kgxqxqi.pif	31
PID 2512 wrote to memory of 2280	2512	kgxqxqi.pif	31
PID 2512 wrote to memory of 2280	2512	kgxqxqi.pif	31
PID 2512 wrote to memory of 2280	2512	kgxqxqi.pif	31
PID 2512 wrote to memory of 2280	2512	kgxqxqi.pif	31
PID 2512 wrote to memory of 3036	2512	kgxqxqi.pif	32
PID 2512 wrote to memory of 3036	2512	kgxqxqi.pif	32
PID 2512 wrote to memory of 3036	2512	kgxqxqi.pif	32
PID 2512 wrote to memory of 3036	2512	kgxqxqi.pif	32
PID 2512 wrote to memory of 3036	2512	kgxqxqi.pif	32
PID 2512 wrote to memory of 3036	2512	kgxqxqi.pif	32
PID 2512 wrote to memory of 3036	2512	kgxqxqi.pif	32
PID 2512 wrote to memory of 3036	2512	kgxqxqi.pif	32
PID 2512 wrote to memory of 3036	2512	kgxqxqi.pif	32
PID 2512 wrote to memory of 3036	2512	kgxqxqi.pif	32
PID 2512 wrote to memory of 2280	2512	kgxqxqi.pif	31
PID 2512 wrote to memory of 2280	2512	kgxqxqi.pif	31
PID 1112 wrote to memory of 1852	1112	Explorer.EXE	33
PID 1112 wrote to memory of 1852	1112	Explorer.EXE	33
PID 1112 wrote to memory of 1852	1112	Explorer.EXE	33
PID 1112 wrote to memory of 1852	1112	Explorer.EXE	33
PID 1112 wrote to memory of 1384	1112	Explorer.EXE	34
PID 1112 wrote to memory of 1384	1112	Explorer.EXE	34
PID 1112 wrote to memory of 1384	1112	Explorer.EXE	34
PID 1112 wrote to memory of 1384	1112	Explorer.EXE	34
PID 1384 wrote to memory of 376	1384	cscript.exe	35
PID 1384 wrote to memory of 376	1384	cscript.exe	35
PID 1384 wrote to memory of 376	1384	cscript.exe	35
PID 1384 wrote to memory of 376	1384	cscript.exe	35

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Users\Admin\AppData\Local\Temp\jetsjets6654.exe
  "C:\Users\Admin\AppData\Local\Temp\jetsjets6654.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\2_44\kgxqxqi.pif
    "C:\2_44\kgxqxqi.pif" bslxdvw.ewe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2512
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:2280
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:3036
- C:\Windows\SysWOW64\cscript.exe
  "C:\Windows\SysWOW64\cscript.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1852
- C:\Windows\SysWOW64\cscript.exe
  "C:\Windows\SysWOW64\cscript.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1384
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\2_44\ahlaua.wee

Filesize
370KB

MD5
1f7784b35717cf5181ee1c018937792c

SHA1
66d56f668f55e4258f850213229e719b2b01de50

SHA256
a21e8ca9bbb50777a3835572ed47b631721845992ad1023bd71e11850c5f7306

SHA512
1cbc109083f22de2ee7eb43ad1ff601120a3b8e558ad032e58779e91f81b82f38480c2b76eb7ce201102fb8392d3043309e16b6877d4ba4f40e2204822ecf647

Download Submit
C:\2_44\dqpro.mp3

Filesize
37KB

MD5
39dd82a2f9cbca0b7cc3175df545834f

SHA1
e7abbd2ddb91092e5a9eaa8360da0cdc23485781

SHA256
3ee3bb319091cc00f0e950a54f65642878059fb600bc321a2ad8a91aed28375d

SHA512
7e3e43472a184ece773555b9ae3aba6d86fe1466e30d3031dfaa4da3b070fd3e02834faec2523698773a96fd13ef586ab3ba6fe64197abdce307d70da8dc0eb6

Download Submit
\2_44\kgxqxqi.pif

Filesize
1.3MB

MD5
92b9ea22338dcd34bc1d8bef60a635a4

SHA1
b7da7f7f1533e073463ba02f986e5c17e15d39c3

SHA256
21dd8e3960c9e3f987a40d30fdb7ebbe9139dfa9b5e5700e36cbd209f36269d0

SHA512
ff8922aab4ef89f6c67921274a35c558f88e419e43312252a744123e25981f2f297c6bc00ac57d462f66cf99ce24cc642a2fbf84861c0875d30486271fb712f5

Download Submit
memory/1112-106-0x0000000006A00000-0x0000000006AF5000-memory.dmp

Filesize
980KB

Download
memory/1384-98-0x0000000000580000-0x00000000005A2000-memory.dmp

Filesize
136KB

Download
memory/1384-102-0x0000000000070000-0x000000000009F000-memory.dmp

Filesize
188KB

Download
memory/1852-99-0x0000000000580000-0x00000000005A2000-memory.dmp

Filesize
136KB

Download
memory/2280-94-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2280-92-0x0000000000400000-0x0000000000961000-memory.dmp

Filesize
5.4MB

Download
memory/2280-96-0x0000000000400000-0x0000000000961000-memory.dmp

Filesize
5.4MB

Download
memory/3036-86-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3036-88-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3036-90-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3036-91-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download