MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e2ee2925682e188e41fcdf49f0274de4617fc3a9506ad31be7a9caeca6d21b38. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e2ee2925682e188e41fcdf49f0274de4617fc3a9506ad31be7a9caeca6d21b38
SHA3-384 hash: 1062efa9a18a7b831b530bf43e1eceac2df6635e54018fe3a45676c5332997ae782dffd13927185be83e8ddada41a1c1
SHA1 hash: 7945e93f8d91479802ae223f66d11fe56728e690
MD5 hash: 56d8fb3908247ecd23aec0911b5a1f18
humanhash: spaghetti-golf-massachusetts-enemy
File name:Company Inquiry.exe
Download: download sample
Signature FormBook
Create hunting rule
File size:747'008 bytes
First seen:2020-08-17 08:08:13 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:mUj+qaqx+9X50dvNN7mU2bMxID23N+cCwOzMGa:MBKj9NJm+xlQ
Threatray 2'240 similar samples on MalwareBazaar
TLSH B1F49EC1A148B8D6C1572B705C26AEB1067EBFE92320950C3E0737679973F97265BC8E
Reporter abuse_ch
Tags:exe FormBook


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: sg1.productsgood.com
Sending IP: 45.125.192.99
From: Gregg Ferstman <support@haisokbr.go.th>
Subject: New Business/Company Cooperation
Attachment: Company Inquiry.r00 (contains "Company Inquiry.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/46789/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Launching a process
Creating a file
Launching cmd.exe command interpreter
Unauthorized injection to a system process
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/432821
Signature
.NET source code contains potential unpacker
Allocates memory in foreign processes
Benign windows process drops PE files
Detected FormBook malware
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: Suspicious Svchost Process
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Writes to foreign memory regions
Yara detected AntiVM_3
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 268719 Sample: Company Inquiry.exe Startdate: 17/08/2020 Architecture: WINDOWS Score: 100 52 Malicious sample detected (through community Yara rule) 2->52 54 Yara detected AntiVM_3 2->54 56 Yara detected FormBook 2->56 58 5 other signatures 2->58 10 Company Inquiry.exe 3 2->10         started        process3 file4 44 C:\Users\user\...\Company Inquiry.exe.log, ASCII 10->44 dropped 72 Writes to foreign memory regions 10->72 74 Allocates memory in foreign processes 10->74 76 Injects a PE file into a foreign processes 10->76 14 RegSvcs.exe 10->14         started        17 RegSvcs.exe 10->17         started        signatures5 process6 signatures7 78 Modifies the context of a thread in another process (thread injection) 14->78 80 Maps a DLL or memory area into another process 14->80 82 Sample uses process hollowing technique 14->82 84 Queues an APC in another process (thread injection) 14->84 19 explorer.exe 1 6 14->19 injected 86 Tries to detect virtualization through RDTSC time measurements 17->86 process8 dnsIp9 46 sbsfe-p9r.geo.mf0.yahoodns.net 67.195.197.24, 49748, 49749, 49750 YAHOO-3US United States 19->46 48 www.mindguidelearning.com 173.230.144.64, 49746, 80 LINODE-APLinodeLLCUS United States 19->48 50 2 other IPs or domains 19->50 38 C:\Users\user\AppData\...\servicess0h.exe, PE32 19->38 dropped 60 System process connects to network (likely due to code injection or exploit) 19->60 62 Benign windows process drops PE files 19->62 24 svchost.exe 19->24         started        28 servicess0h.exe 19->28         started        30 autoconv.exe 19->30         started        file10 signatures11 process12 file13 40 C:\Users\user\AppData\...\5Q7logrv.ini, data 24->40 dropped 42 C:\Users\user\AppData\...\5Q7logri.ini, data 24->42 dropped 64 Detected FormBook malware 24->64 66 Tries to steal Mail credentials (via file access) 24->66 68 Tries to harvest and steal browser information (history, passwords, etc) 24->68 70 3 other signatures 24->70 32 cmd.exe 24->32         started        34 conhost.exe 28->34         started        signatures14 process15 process16 36 conhost.exe 32->36         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/e2ee2925682e188e41fcdf49f0274de4617fc3a9506ad31be7a9caeca6d21b38/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-17 03:49:50 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4lxcsjlifymi4qp435e7aj2n4rqx7q5jkbvngg7hvhfozjwsdm4a._file
Verdict:
malicious
Similar samples:
179043e8eb7c06144c67f58b2c2900ad10303862c0e5cd7e1fe5a4faf853f103
FormBook
2ad145ebeae4ff20eeb893b16658fe43d7557f30c746edc355a5dceb393bf8bb
FormBook
344d949f94b4420c0cd7772fa786e17059d5599df223a93ef999ea2c663ad8be
FormBook
5ea463243b051351c219469515fb9b39d01c5c3c4f4698bd6164e36070622d35
FormBook
6b307cbe4f1e8d769af95142d574e77a50654e25cce234f48da6c5e7a7aa4b99
FormBook
6f95416c1006a499c7012c6cde49a27f83223c665cf9b28764030afeb04bf697
FormBook
700f8405954cf77a38e6b103b33e4c7164202e9126b3b76044be35510b2bf440
FormBook
a09022457c7802a48a3f2ef32b8008da65fb4b28b43c8e6ac37c44f0a3ecc028
FormBook
d05efc3d09d7c08668da10c09101815e0af2f3376a03512e959ca467835b9c26
FormBook
f80c8e9d0e8ed0ffa6b7d8620a0eb890deb7c9dc84dca3198b3d2625bf5d1099
FormBook
+ 2'230 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
rat trojan spyware stealer family:formbook persistence
Link:
https://tria.ge/reports/200817-pgec6ahlds/
Behaviour
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Suspicious use of SetThreadContext
Reads user/profile data of web browsers
Adds policy Run key to start application
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.chemoly.com/dth/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.55
Link:
https://yomi.yoroi.company/submissions/e2ee2925682e188e41fcdf49f0274de4617fc3a9506ad31be7a9caeca6d21b38

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip 6854299d35256c70e4c3dfa2039ec9aa9ba2f381a9b73c21985cf2521f775e93

FormBook

Executable exe e2ee2925682e188e41fcdf49f0274de4617fc3a9506ad31be7a9caeca6d21b38

(this sample)

  
Dropped by
MD5 915d1197c4f0cf12c3d2ac74e518ad75
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/46789/
  
Dropped by
SHA256 6854299d35256c70e4c3dfa2039ec9aa9ba2f381a9b73c21985cf2521f775e93

Comments