MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 70ecffff57ecd39682bc7de003d937b43d0b0c9bfaadd315d236627475608e54. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 70ecffff57ecd39682bc7de003d937b43d0b0c9bfaadd315d236627475608e54
SHA3-384 hash: a1804cc9c98a0d8c4b1c3b4295ed461f48542c2e1162caa65925bc765aa618f04da3e1e22935db6b0a38878c7904d52d
SHA1 hash: 02e6e93f273ff9d0af6bdfccfc6135d3b64abf31
MD5 hash: 7800cc595357b99af119a838cc346ca6
humanhash: illinois-wyoming-december-eleven
File name:regasm.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:820'736 bytes
First seen:2020-08-17 18:37:02 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 90971096b3f3ef49ea4900e0dc05049a (10 x FormBook, 9 x AgentTesla, 4 x Loki)
ssdeep 12288:9gftlTxIDJRRtYRNeuawx2+8zVQLlcqPTxUHYY3UmNUSSAOalMoXi6EFIySz:9g1JxIwP5YxaZ0dD6Sp1ytG
Threatray 2'242 similar samples on MalwareBazaar
TLSH B2059D32B1E04837D173DA3C5D1B6E67982EBD132B289B466BE07D485F3965036252CF
Reporter abuse_ch
Tags:exe FormBook


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: mail.geres.eu
Sending IP: 91.121.61.178
From: Clémentine LARATTE <c.laratte@geres.eu>
Subject: Inquiry from Geres Malaysia
Attachment: RFQ Geres Malaysia.xlsx

FormBook payload URL:
http://smlflstdyeconsultationlifesecurecen1ter.duckdns.org/smldoc/regasm.exe

FormBook C2:
http://www.ranges-xx.com/uts2/

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/47272/
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Trojan.GenericKD.43676699.3150.4339.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Launching a process
Launching cmd.exe command interpreter
Sending a UDP request
Setting browser functions hooks
Unauthorized injection to a system process
Unauthorized injection to a browser process
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/434576
Signature
Benign windows process drops PE files
Contains functionality to detect sleep reduction / modifications
Detected FormBook malware
Detected unpacking (changes PE section rights)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 269658 Sample: regasm.exe Startdate: 18/08/2020 Architecture: WINDOWS Score: 100 60 Malicious sample detected (through community Yara rule) 2->60 62 Detected unpacking (changes PE section rights) 2->62 64 Yara detected FormBook 2->64 66 5 other signatures 2->66 10 regasm.exe 2->10         started        process3 signatures4 84 Detected unpacking (changes PE section rights) 10->84 86 Maps a DLL or memory area into another process 10->86 88 Tries to detect virtualization through RDTSC time measurements 10->88 90 Contains functionality to detect sleep reduction / modifications 10->90 13 regasm.exe 10->13         started        process5 signatures6 92 Modifies the context of a thread in another process (thread injection) 13->92 94 Maps a DLL or memory area into another process 13->94 96 Sample uses process hollowing technique 13->96 98 Queues an APC in another process (thread injection) 13->98 16 explorer.exe 3 6 13->16 injected process7 dnsIp8 48 www.jncddz.com 104.164.148.212, 49737, 49738, 49739 EGIHOSTINGUS United States 16->48 50 www.glamandfab.com 207.148.248.143, 49734, 80 BIZLAND-SDUS United States 16->50 52 www.shoes3d.online 16->52 42 C:\Users\user\AppData\...\s2pxcfmort.exe, PE32 16->42 dropped 68 System process connects to network (likely due to code injection or exploit) 16->68 70 Benign windows process drops PE files 16->70 21 cmd.exe 1 17 16->21         started        25 s2pxcfmort.exe 16->25         started        27 s2pxcfmort.exe 16->27         started        29 6 other processes 16->29 file9 signatures10 process11 file12 44 C:\Users\user\AppData\...\798logrv.ini, data 21->44 dropped 46 C:\Users\user\AppData\...\798logri.ini, data 21->46 dropped 72 Detected FormBook malware 21->72 74 Tries to steal Mail credentials (via file access) 21->74 76 Tries to harvest and steal browser information (history, passwords, etc) 21->76 78 Modifies the context of a thread in another process (thread injection) 21->78 31 cmd.exe 1 21->31         started        80 Maps a DLL or memory area into another process 25->80 33 s2pxcfmort.exe 25->33         started        36 s2pxcfmort.exe 27->36         started        82 Tries to detect virtualization through RDTSC time measurements 29->82 38 s2pxcfmort.exe 29->38         started        signatures13 process14 signatures15 40 conhost.exe 31->40         started        54 Modifies the context of a thread in another process (thread injection) 33->54 56 Maps a DLL or memory area into another process 33->56 58 Sample uses process hollowing technique 33->58 process16
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/70ecffff57ecd39682bc7de003d937b43d0b0c9bfaadd315d236627475608e54/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-08-17 06:05:36 UTC
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=odwp772x5tjznav4pxqahwjxwq6qwde37kw5gfosgzrhi5larzka._file
Verdict:
malicious
Label(s):
netwirerc
Create hunting rule
Similar samples:
07f7b852dc1cd3c5527fef6c09019b723a9e17ddc6b236c16e992784940b7a81
Formbook
1e82d551bb0693edad6a527c0355b59476d25afc326168b616205fe186ca5a30
Formbook
2351032596ba226e2ae00a4967cd8f85b158b5b2cfc1869d919bf5a2eea3c129
Formbook
26f40af0e83d93213e01539affe12f208bdb65f2dd98223b1662c22eb4e243b5
Formbook
3c3a52620a36e8ef2806ffad5a241444d93b7eb839c3b3cfa4697e130d349dcc
Formbook
5bd5a94befaf51c0702273d144aa5d31fc88e7f677ea33ea98408450e1b535d7
Formbook
887de911a26e0008429adcba8abc212d36423fae62d40aa1df57e2883db77d45
Formbook
8b013f7d0015d773fb1bd83c18bfd34180dbc1e10beb848fd699420f9f7278ca
Formbook
e224e30554ce3a83c6ef2ca1c81b50ca377486f55bed19078658578bbef844f0
Formbook
ffe68860d3d4320a2152bb2f3a636eb0f484f9f81a14b112c5f349b7c3d79f76
Formbook
+ 2'232 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
rat trojan spyware stealer family:formbook persistence
Link:
https://tria.ge/reports/200817-h9sza2sbpn/
Behaviour
Enumerates system info in registry
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Suspicious use of SetThreadContext
Deletes itself
Reads user/profile data of web browsers
Adds policy Run key to start application
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.ranges-xx.com/uts2/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/70ecffff57ecd39682bc7de003d937b43d0b0c9bfaadd315d236627475608e54

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

Excel file xlsx b4380edc2ba9f308ac8505936eaf1f70317fcf14b97a4295fd04414aa50de070

Formbook

Executable exe 70ecffff57ecd39682bc7de003d937b43d0b0c9bfaadd315d236627475608e54

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/435075/
  
Dropped by
MD5 72c6373e70bcd8be4f04e3f678d2c1e5
  
Dropped by
SHA256 b4380edc2ba9f308ac8505936eaf1f70317fcf14b97a4295fd04414aa50de070
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/47272/

Comments