MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 37e7b7329552ca9f6ab3233ebe1d8ab96c4385b941b31a21ea43c4c2b85fca61. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 37e7b7329552ca9f6ab3233ebe1d8ab96c4385b941b31a21ea43c4c2b85fca61
SHA3-384 hash: d7774ff84bc8fcdba5bed4158c2232105ee95925b7ba027cae8526248ae9ce29b008f65eae261a6214625d278fd63a28
SHA1 hash: 5dc0fbd12332e524b1f3c87854e11426d249b998
MD5 hash: 72ae0dcb4e1ee4967c220fdd458eeada
humanhash: sink-glucose-ten-twenty
File name:Confirmation coupon.exe
Download: download sample
Signature FormBook
Create hunting rule
File size:1'041'004 bytes
First seen:2020-08-19 11:17:18 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash fcf1390e9ce472c7270447fc5c61a0c1 (863 x DCRat, 118 x NanoCore, 94 x njrat)
ssdeep 24576:BAOcZeJDk0dRPBO2pZY6I+0Gxg539FQZMaBQiOzw9K:bTkwZOgYixw96ZMAy
Threatray 2'452 similar samples on MalwareBazaar
TLSH 43251202B7C68871E0321D325A35BB129D7C7D201F24EE6EB7E40A7DDE751D1A624BA2
Reporter abuse_ch
Tags:exe FormBook


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: franceloc-postfix.filnet.fr
Sending IP: 194.187.193.119
From: Cláudia Diniz <info@wip-hausschutz.de>
Reply-To: finance.booking.com@outlook.com
Subject: GROUP CONFIRMATION.
Attachment: Confirmation coupon.rar (contains "Confirmation coupon.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
100
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/48437/
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

SecuriteInfo.com.Gen.Variant.Johnnie.221809.751.14920.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Searching for the window
Creating a file in the %AppData% subdirectories
Sending a UDP request
Enabling the 'hidden' option for recently created files
Creating a process from a recently created file
Creating a file
Creating a file in the %temp% directory
Adding an access-denied ACE
Launching a process
Launching cmd.exe command interpreter
Setting browser functions hooks
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Unauthorized injection to a system process
Unauthorized injection to a browser process
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/437645
Signature
Allocates memory in foreign processes
Drops PE files with a suspicious file extension
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected AntiVM autoit script
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 271327 Sample: Confirmation coupon.exe Startdate: 20/08/2020 Architecture: WINDOWS Score: 100 42 www.prestige-europe.com 2->42 56 Malicious sample detected (through community Yara rule) 2->56 58 Yara detected FormBook 2->58 60 Yara detected AntiVM autoit script 2->60 62 3 other signatures 2->62 12 Confirmation coupon.exe 85 2->12         started        signatures3 process4 file5 38 C:\Users\user\AppData\...\jnpcpkqq.pif, PE32 12->38 dropped 15 jnpcpkqq.pif 3 12->15         started        process6 file7 40 C:\Users\user\AppData\Local\...\RegSvcs.exe, PE32 15->40 dropped 48 Machine Learning detection for dropped file 15->48 50 Writes to foreign memory regions 15->50 52 Allocates memory in foreign processes 15->52 54 2 other signatures 15->54 19 RegSvcs.exe 15->19         started        22 RegSvcs.exe 15->22         started        signatures8 process9 signatures10 64 Modifies the context of a thread in another process (thread injection) 19->64 66 Maps a DLL or memory area into another process 19->66 68 Sample uses process hollowing technique 19->68 24 explorer.exe 19->24 injected 70 Tries to detect virtualization through RDTSC time measurements 22->70 72 Queues an APC in another process (thread injection) 22->72 process11 dnsIp12 44 www.nesiacraft.com 24->44 46 www.hcijq.info 24->46 27 cmd.exe 24->27         started        30 colorcpl.exe 24->30         started        32 autoconv.exe 24->32         started        process13 signatures14 74 Modifies the context of a thread in another process (thread injection) 27->74 76 Maps a DLL or memory area into another process 27->76 78 Tries to detect virtualization through RDTSC time measurements 27->78 34 cmd.exe 1 27->34         started        process15 process16 36 conhost.exe 34->36         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/37e7b7329552ca9f6ab3233ebe1d8ab96c4385b941b31a21ea43c4c2b85fca61/
Threat name:
Win32.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2020-08-19 00:00:35 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=g7t3omuvklfj62vtem7l4hmkxfwehbnzigzruipkipcmfoc7zjqq._file
Verdict:
malicious
Similar samples:
10189128ff7ff4ae10111c65ca809615595304636a0d0e451ee34bf23ee900a2
FormBook
1678611ad4996f718c0a8998ce194dfe117bf47529c4ccad51a6816ecf4f1bb4
FormBook
5c5e4e31bde29168e03fa8cce36bab9b577568137edab59f68f8968616546ed9
FormBook
7307a0ff8927e1ec7690e4aaf7fcdf16dbef7455d847536625d833ee709a470c
FormBook
86c92d4b2244153a1f601168307d0c60f413631574d9c0ed3fe4c6fa890d6c26
FormBook
9cd4df25010125f2ef3eeef44503b3c2b58435af758fe7213d053a60f018f3d8
FormBook
a943fc4408c2f59f2df0afabf3836e5adae92a8f4a4b1da0270e313d8ea78445
FormBook
d6c73d397215d259bfb6168e9c0a6c29bb8e684509877e0ec62aba0c817a25fa
FormBook
fb0d1b0c62204ebfb2e04bcc607e562f398bf0cd40a275ace02ca34bed1d355d
FormBook
fc1fbab23528029108a690e17c533f4c5de405b84159d95ef976bbae3fbead7e
FormBook
+ 2'442 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
rat persistence spyware trojan stealer family:formbook
Link:
https://tria.ge/reports/200819-xg3bty66ce/
Behaviour
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Suspicious use of SetThreadContext
Adds Run key to start application
Loads dropped DLL
Reads user/profile data of web browsers
Executes dropped EXE
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.fex-tracks.com/hx232/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Noon
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/37e7b7329552ca9f6ab3233ebe1d8ab96c4385b941b31a21ea43c4c2b85fca61

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

rar a9d20de79009e68c2547b41762e1a48b172aa41ed5124bb295d58dfac1c695d4

FormBook

Executable exe 37e7b7329552ca9f6ab3233ebe1d8ab96c4385b941b31a21ea43c4c2b85fca61

(this sample)

  
Dropped by
MD5 d4efb9f8618e779b0b7a303da0389df0
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/48437/
  
Dropped by
SHA256 a9d20de79009e68c2547b41762e1a48b172aa41ed5124bb295d58dfac1c695d4

Comments