MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 413e8df7f149aa643aaa1ef70e953ab2112827b652f1cf05b6420ed6a119962d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 13


Intelligence 13 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 413e8df7f149aa643aaa1ef70e953ab2112827b652f1cf05b6420ed6a119962d
SHA3-384 hash: 3a6934f7e72ae5ccada6a26b87c91b29d31b68f5a6f62d7a814b656955ec0f657bce95b14ce846068077ebc159a7f30e
SHA1 hash: b29c935913a55c9bad3979d05d97a6ebda871604
MD5 hash: deea7525a547ed7a9ef6c81b04478f3e
humanhash: kitten-jig-september-dakota
File name:Se adjunta el pedido, proforma.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:731'136 bytes
First seen:2021-11-25 15:49:32 UTC
Last seen:2021-12-06 14:55:28 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash d5a5a85102968ed0997ce91809ca5aad (3 x Formbook)
ssdeep 12288:wTDxfHlE1XHBC/qo3R7HaZRZEBTV3bXKRfwUCm0gRS+:w3RFIHBCN3hHWeBTwFcH
Threatray 9'855 similar samples on MalwareBazaar
TLSH T14DF47DB2B2E04433E05B36F88E0F52AD663B3D715610C582A9F52F1D0FBD665799B0A3
File icon (PE):PE icon
dhash icon e0e4a3a6a4b8b8a8 (37 x Formbook, 9 x AZORult, 9 x Loki)
Reporter pr0xylife
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
5
# of downloads :
124
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Se adjunta el pedido, proforma.exe
Verdict:
Malicious activity
Analysis date:
2021-11-25 15:54:25 UTC
Tags:
installer trojan formbook stealer
Link:
https://app.any.run/tasks/2925f506-65fc-4d25-8532-f95aa1212781

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Gathering data
Detection(s):
SecuriteInfo.com.Trojan.Siggen15.51722.16497.15900.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
DNS request
Sending a custom TCP request
Creating a file
Launching a process
Launching cmd.exe command interpreter
Sending an HTTP GET request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Forced shutdown of a system process
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
67%
Tags:
fareit keylogger packed remcos
Link:
https://www.filescan.io/uploads/619fb0aff36138de3f3caf1e/reports/a68e6ed8-e72b-4c6f-9928-dd88847ac6e0/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/7d19b236-9333-4ac8-8e3d-4132c57e599c
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/896212
Signature
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Creates a thread in another existing process (thread injection)
Found malware configuration
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 528688 Sample: Se adjunta el pedido, profo... Startdate: 25/11/2021 Architecture: WINDOWS Score: 100 44 www.pkem.top 2->44 46 www.hagenbicycles.com 2->46 48 3 other IPs or domains 2->48 68 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->68 70 Found malware configuration 2->70 72 Malicious sample detected (through community Yara rule) 2->72 74 4 other signatures 2->74 11 Se adjunta el pedido, proforma.exe 1 18 2->11         started        signatures3 process4 dnsIp5 58 cdn.discordapp.com 162.159.134.233, 443, 49759, 49760 CLOUDFLARENETUS United States 11->58 40 C:\Users\user\Contacts\...\Lxtcsmeg.exe, PE32 11->40 dropped 42 C:\Users\...\Lxtcsmeg.exe:Zone.Identifier, ASCII 11->42 dropped 92 Writes to foreign memory regions 11->92 94 Allocates memory in foreign processes 11->94 96 Creates a thread in another existing process (thread injection) 11->96 98 Injects a PE file into a foreign processes 11->98 16 mobsync.exe 11->16         started        file6 signatures7 process8 signatures9 60 Modifies the context of a thread in another process (thread injection) 16->60 62 Maps a DLL or memory area into another process 16->62 64 Sample uses process hollowing technique 16->64 66 2 other signatures 16->66 19 explorer.exe 2 16->19 injected process10 process11 21 Lxtcsmeg.exe 13 19->21         started        25 Lxtcsmeg.exe 13 19->25         started        27 cscript.exe 19->27         started        dnsIp12 50 162.159.130.233, 443, 49763 CLOUDFLARENETUS United States 21->50 52 cdn.discordapp.com 21->52 76 Multi AV Scanner detection for dropped file 21->76 78 Writes to foreign memory regions 21->78 80 Allocates memory in foreign processes 21->80 29 logagent.exe 21->29         started        54 162.159.135.233, 443, 49764 CLOUDFLARENETUS United States 25->54 56 cdn.discordapp.com 25->56 82 Creates a thread in another existing process (thread injection) 25->82 84 Injects a PE file into a foreign processes 25->84 32 mobsync.exe 25->32         started        86 Modifies the context of a thread in another process (thread injection) 27->86 88 Maps a DLL or memory area into another process 27->88 90 Tries to detect virtualization through RDTSC time measurements 27->90 34 cmd.exe 1 27->34         started        36 explorer.exe 1 186 27->36         started        signatures13 process14 signatures15 100 Tries to detect virtualization through RDTSC time measurements 29->100 38 conhost.exe 34->38         started        process16
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/413e8df7f149aa643aaa1ef70e953ab2112827b652f1cf05b6420ed6a119962d/
Threat name:
Win32.Trojan.Remcos
Create hunting rule
Status:
Malicious
First seen:
2021-11-25 00:10:51 UTC
File Type:
PE (Exe)
Extracted files:
40
AV detection:
20 of 28 (71.43%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ie7i357rjgvgiovkd33q5fj2wiisqj5wkly46bnwiihnniizsywq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
1e5bb5e00fddfcc62c8bfe71b46a4c8c6c22986c7a51931d16b8ddc465170d72
Formbook
2863a8690acd578ea41d8ef458f493c7bab50c34d8d6fd668f8ef56d429094de
Formbook
8968808899b3e810e675fc87e6ff0f61c82b444183fd7f8febdb276eee05e683
Formbook
b88385613d90ebbd240b11a3847fc2117c0d832fdf7a3c45f1ed68692ed68038
Formbook
c11992880daecda35958fd14fcf3b6e5d32a6bda8c904a888ede0dcbb1f91aa6
Formbook
d544f115e860d3282bd996d7b12ac92c10097d68d135667cca0f847ca754f8ef
Formbook
d9acad219b9fa52e4258fafd8c85b9e473b8f99435f4d9af4dbb953fae94a17d
Formbook
e50290f9b9cf781a2d64f7e3190de28d2b673cd24099675d3b65a80ab70cf9e1
Formbook
+ 9'845 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader campaign:euv4 loader persistence rat suricata
Link:
https://tria.ge/reports/211125-s9x5haffem/
Behaviour
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Suspicious use of SetThreadContext
Adds Run key to start application
Adds policy Run key to start application
Executes dropped EXE
Xloader Payload
Xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
Malware Config
C2 Extraction:
http://www.rematedeldia.com/euv4/
Unpacked files
SH256 hash:
c0d655ca0862ee8f069564e3e7fcb17d930e0c877a31e749f4ad1b73a38e855a
MD5 hash:
7f01373693adbbd15ca15fff811a2c1a
SHA1 hash:
bf4ef40f0feaf42aeac4767ff93bfe83e1f0c89d
Detections:
win_temple_loader_w0
Create hunting rule
Link:
https://www.unpac.me/results/b9f8deca-7c55-4b30-bc86-6c92f606bf33/
Parent samples :
bfbe11d6ffb3c82c59ac2cf85176583ff2ea5449d926584a59181286611f48f3
22e4c6c1d3eb1e8a93d2b36b152ef39cff53bc933ff80153057788fadf6615db
839d28f4d38455750ddf9ddffdd57d0cc6ee009714f407a8698e65e96eb9fa71
9bfd468b402317eb1dc711af78f4340d855cbf234a4736188283a6fa6f8d3cb2
2863a8690acd578ea41d8ef458f493c7bab50c34d8d6fd668f8ef56d429094de
41469a749da51e8aa7e1ea159041bf74f712dd4f23f076188f547ee0c0f7933f
413e8df7f149aa643aaa1ef70e953ab2112827b652f1cf05b6420ed6a119962d
34443c2f4cf165f96c3eaffb93f2a7b3628ebed8ed119b3ef2ad3e5dc450e0a0
fe367e5f3b5894117d3b699784bc5da3cb4083608c94879895b279b2bc2f32a4
SH256 hash:
413e8df7f149aa643aaa1ef70e953ab2112827b652f1cf05b6420ed6a119962d
MD5 hash:
deea7525a547ed7a9ef6c81b04478f3e
SHA1 hash:
b29c935913a55c9bad3979d05d97a6ebda871604
Link:
https://www.unpac.me/results/b9f8deca-7c55-4b30-bc86-6c92f606bf33/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/413e8df7f149/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/413e8df7f149aa643aaa1ef70e953ab2112827b652f1cf05b6420ed6a119962d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/209399/

Comments