MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a09022457c7802a48a3f2ef32b8008da65fb4b28b43c8e6ac37c44f0a3ecc028. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a09022457c7802a48a3f2ef32b8008da65fb4b28b43c8e6ac37c44f0a3ecc028
SHA3-384 hash: 43ea108be7aeaec831175c775d48a0a82f9b2b88e056cab28dab7ea57429c5f374d31330f006c3be6bacc085eb60ac03
SHA1 hash: 18c11a225dd33e64dd7440712c47a8bd9ffc7b66
MD5 hash: f0c9e48019fa38ed13d89031cd5f2f16
humanhash: william-bakerloo-monkey-paris
File name:INQUIRY.exe
Download: download sample
Signature FormBook
Create hunting rule
File size:743'936 bytes
First seen:2020-08-17 08:25:35 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:gnPVlTnUYqOIdaBwJMwv406VZymcyP+qayGa:wrD9TCJMwNScXB
Threatray 2'240 similar samples on MalwareBazaar
TLSH 83F49DC16148B8D6D1672B705C76EEB0053EBEF9222096083E0737679973F96265BC8E
Reporter abuse_ch
Tags:exe FormBook


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: sg1.productsgood.com
Sending IP: 45.125.192.99
From: Lizzy Wu <support@haisokbr.go.th>
Subject: Purchase Oder
Attachment: INQUIRY.rar (contains "INQUIRY.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/46821/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Unauthorized injection to a recently created process
Creating a file
Launching a process
Launching cmd.exe command interpreter
Forced shutdown of a system process
Unauthorized injection to a system process
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/432896
Signature
.NET source code contains potential unpacker
Benign windows process drops PE files
Detected FormBook malware
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected AntiVM_3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 268754 Sample: INQUIRY.exe Startdate: 17/08/2020 Architecture: WINDOWS Score: 100 56 www.bannresolar.com 2->56 64 Malicious sample detected (through community Yara rule) 2->64 66 Yara detected AntiVM_3 2->66 68 Yara detected FormBook 2->68 70 6 other signatures 2->70 11 INQUIRY.exe 3 2->11         started        signatures3 process4 file5 54 C:\Users\user\AppData\...\INQUIRY.exe.log, ASCII 11->54 dropped 94 Tries to detect virtualization through RDTSC time measurements 11->94 96 Injects a PE file into a foreign processes 11->96 15 INQUIRY.exe 11->15         started        signatures6 process7 signatures8 98 Modifies the context of a thread in another process (thread injection) 15->98 100 Maps a DLL or memory area into another process 15->100 102 Sample uses process hollowing technique 15->102 104 Queues an APC in another process (thread injection) 15->104 18 explorer.exe 4 6 15->18 injected process9 dnsIp10 58 www.chemoly.com 63.250.47.220, 49730, 80 NAMECHEAP-NETUS United States 18->58 60 www.rxmedia.services 18->60 62 192.168.2.1 unknown unknown 18->62 48 C:\Users\user\AppData\...\z8wl_rhznu.exe, PE32 18->48 dropped 78 System process connects to network (likely due to code injection or exploit) 18->78 80 Benign windows process drops PE files 18->80 23 systray.exe 1 17 18->23         started        27 z8wl_rhznu.exe 2 18->27         started        29 z8wl_rhznu.exe 3 18->29         started        31 2 other processes 18->31 file11 signatures12 process13 file14 50 C:\Users\user\AppData\...\087logrv.ini, data 23->50 dropped 52 C:\Users\user\AppData\...\087logri.ini, data 23->52 dropped 82 Detected FormBook malware 23->82 84 Tries to steal Mail credentials (via file access) 23->84 86 Tries to harvest and steal browser information (history, passwords, etc) 23->86 92 2 other signatures 23->92 33 cmd.exe 1 23->33         started        88 Injects a PE file into a foreign processes 27->88 35 z8wl_rhznu.exe 27->35         started        38 z8wl_rhznu.exe 27->38         started        40 z8wl_rhznu.exe 27->40         started        42 z8wl_rhznu.exe 29->42         started        44 z8wl_rhznu.exe 29->44         started        90 Tries to detect virtualization through RDTSC time measurements 31->90 signatures15 process16 signatures17 46 conhost.exe 33->46         started        72 Modifies the context of a thread in another process (thread injection) 42->72 74 Maps a DLL or memory area into another process 42->74 76 Sample uses process hollowing technique 42->76 process18
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/a09022457c7802a48a3f2ef32b8008da65fb4b28b43c8e6ac37c44f0a3ecc028/
Threat name:
ByteCode-MSIL.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2020-08-17 05:07:40 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ucicerl4pabkjcr7f3zsxaai3js7wsziwq6i42wdprcpbi7myaua._file
Verdict:
malicious
Similar samples:
2ad145ebeae4ff20eeb893b16658fe43d7557f30c746edc355a5dceb393bf8bb
FormBook
347aa505ad319b4d8ee54aabe34dfc2af12b4747af23c6b635821ba9aedd0e32
FormBook
3b81d08379c1f899938518da9bcaccb302565f2f51cd754c201a8c57efe2f380
FormBook
5ea463243b051351c219469515fb9b39d01c5c3c4f4698bd6164e36070622d35
FormBook
6b307cbe4f1e8d769af95142d574e77a50654e25cce234f48da6c5e7a7aa4b99
FormBook
6f95416c1006a499c7012c6cde49a27f83223c665cf9b28764030afeb04bf697
FormBook
700f8405954cf77a38e6b103b33e4c7164202e9126b3b76044be35510b2bf440
FormBook
d05efc3d09d7c08668da10c09101815e0af2f3376a03512e959ca467835b9c26
FormBook
e2ee2925682e188e41fcdf49f0274de4617fc3a9506ad31be7a9caeca6d21b38
FormBook
eb1cf2b146f8b3e00e50f11059dc62dc6cd9aaf359c25cb4dd82834a4d28c8e8
FormBook
+ 2'230 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
rat trojan spyware stealer family:formbook
Link:
https://tria.ge/reports/200817-9vjx99e9je/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Deletes itself
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.chemoly.com/dth/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a09022457c7802a48a3f2ef32b8008da65fb4b28b43c8e6ac37c44f0a3ecc028

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

rar c50d14a3cba28ef65b475833c802e8a9ce51fcefb72a452d8f5daa45a97c1842

FormBook

Executable exe a09022457c7802a48a3f2ef32b8008da65fb4b28b43c8e6ac37c44f0a3ecc028

(this sample)

  
Dropped by
MD5 6499b551d3c4cb8967b3d5f6570a5217
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/46821/
  
Dropped by
SHA256 c50d14a3cba28ef65b475833c802e8a9ce51fcefb72a452d8f5daa45a97c1842

Comments