MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c1d948fee0541e31cfa3affa9d99a6ad6cf287601f3ddae9238c3ca379a4686c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 14


Intelligence 14 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c1d948fee0541e31cfa3affa9d99a6ad6cf287601f3ddae9238c3ca379a4686c
SHA3-384 hash: 2971f25efe294b8665bb3c9f950b986135f612c7a68695ed634b275c3bf924d063f7e3e83ab1fa1f81e985456b856f7e
SHA1 hash: 94f3d18e57d6483c03cae67478bb559a2e3ae0f8
MD5 hash: 2ebf7f5b65c0e71bf0f36e8e9bbde1c3
humanhash: double-early-item-utah
File name:Payment (2).exe
Download: download sample
Signature Formbook
Create hunting rule
File size:979'968 bytes
First seen:2023-05-05 14:11:33 UTC
Last seen:2023-05-06 02:18:47 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash cfa071bbdd35135a86e6a3f78e55c174 (1 x Formbook, 1 x ModiLoader)
ssdeep 12288:0nONo4ehvLMuotC0NgicDPP2sBJ79D67KI04YCE+PhcimEwz8dQNHTcFpI2qjS:0nOPeFGhgicDnDRZBCEMcihwId+jT
Threatray 84 similar samples on MalwareBazaar
TLSH T18725AF26E2E08833D1B33E385C0B5B95A925BD103D28F58A67E53E8C8F756603539F57
TrID 68.5% (.EXE) Win32 Executable Borland Delphi 7 (664796/42/58)
27.0% (.EXE) Win32 Executable Borland Delphi 6 (262638/61)
1.4% (.EXE) Win32 Executable Delphi generic (14182/79/4)
1.3% (.SCR) Windows screen saver (13097/50/3)
0.4% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 74e0d4c2d494d09c (1 x Formbook, 1 x ModiLoader)
Reporter cocaman
Tags:exe FormBook payment

Intelligence

File Origin
# of uploads :
2
# of downloads :
299
Origin country :
CH CH
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Payment (2).exe
Verdict:
Malicious activity
Analysis date:
2023-05-05 14:13:23 UTC
Tags:
dbatloader
Link:
https://app.any.run/tasks/bd2c7643-75bf-43a3-91f3-d9374d6314fd

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/386964/
Detection(s):
SecuriteInfo.com.Win32.PWSX-gen.29088.22571.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
Sending a custom TCP request
DNS request
Creating a file
Running batch commands
Creating a process with a hidden window
Launching cmd.exe command interpreter
Launching a process
Creating a process from a recently created file
Searching for the window
Using the Windows Management Instrumentation requests
Searching for synchronization primitives
Reading critical registry keys
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a system process
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/82746/overview
Behaviour
MalwareBazaar
CheckCmdLine
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
89%
Tags:
anti-debug anti-vm greyware keylogger overlay packed
Link:
https://www.filescan.io/uploads/64550eb6ed8cdc2625ae1998/reports/2817fc1c-8ce1-402b-a76c-23254da65673/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_70%
Link:
https://www.hybrid-analysis.com/sample/c1d948fee0541e31cfa3affa9d99a6ad6cf287601f3ddae9238c3ca379a4686c
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/925b7bd3-6bb1-4cf4-bf3e-8cd3f195d571
Result
Threat name:
DBatLoader, FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1227005
Signature
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Creates a thread in another existing process (thread injection)
DLL side loading technique detected
Drops executables to the windows directory (C:\Windows) and starts them
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Suspicious powershell command line found
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Writes to foreign memory regions
Yara detected DBatLoader
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 859981 Sample: Payment_(2).exe Startdate: 05/05/2023 Architecture: WINDOWS Score: 100 103 Found malware configuration 2->103 105 Malicious sample detected (through community Yara rule) 2->105 107 Multi AV Scanner detection for dropped file 2->107 109 6 other signatures 2->109 10 Payment_(2).exe 1 23 2->10         started        15 Dkpcyzkl.exe 15 2->15         started        process3 dnsIp4 67 web.fe.1drv.com 10->67 69 onedrive.live.com 10->69 75 2 other IPs or domains 10->75 55 C:\Users\Public\Libraries\netutils.dll, PE32+ 10->55 dropped 57 C:\Users\Public\Libraries\easinvoker.exe, PE32+ 10->57 dropped 59 C:\Users\Public\Libraries\Dkpcyzkl.exe, PE32 10->59 dropped 61 C:\Users\...\Dkpcyzkl.exe:Zone.Identifier, ASCII 10->61 dropped 121 Writes to foreign memory regions 10->121 123 Allocates memory in foreign processes 10->123 125 Creates a thread in another existing process (thread injection) 10->125 17 cmd.exe 3 10->17         started        20 iexpress.exe 10->20         started        71 web.fe.1drv.com 15->71 73 onedrive.live.com 15->73 77 2 other IPs or domains 15->77 127 Multi AV Scanner detection for dropped file 15->127 129 Injects a PE file into a foreign processes 15->129 22 iexpress.exe 15->22         started        file5 signatures6 process7 signatures8 89 Uses ping.exe to sleep 17->89 91 Drops executables to the windows directory (C:\Windows) and starts them 17->91 93 Uses ping.exe to check the status of other devices and networks 17->93 24 easinvoker.exe 17->24         started        26 PING.EXE 1 17->26         started        29 xcopy.exe 2 17->29         started        35 6 other processes 17->35 95 Modifies the context of a thread in another process (thread injection) 22->95 97 Maps a DLL or memory area into another process 22->97 99 Sample uses process hollowing technique 22->99 101 2 other signatures 22->101 32 explorer.exe 22->32 injected process9 dnsIp10 37 cmd.exe 1 24->37         started        79 127.0.0.1 unknown unknown 26->79 63 C:\Windows \System32\easinvoker.exe, PE32+ 29->63 dropped 81 dreamvision.store 34.120.137.41, 49703, 80 GOOGLEUS United States 32->81 83 192.168.2.1 unknown unknown 32->83 85 2 other IPs or domains 32->85 87 System process connects to network (likely due to code injection or exploit) 32->87 40 chkdsk.exe 32->40         started        42 cmstp.exe 32->42         started        65 C:\Windows \System32\netutils.dll, PE32+ 35->65 dropped file11 signatures12 process13 signatures14 111 Suspicious powershell command line found 37->111 113 Adds a directory exclusion to Windows Defender 37->113 44 powershell.exe 23 37->44         started        47 conhost.exe 37->47         started        115 Modifies the context of a thread in another process (thread injection) 40->115 117 Maps a DLL or memory area into another process 40->117 119 Tries to detect virtualization through RDTSC time measurements 40->119 49 cmd.exe 40->49         started        process15 signatures16 131 DLL side loading technique detected 44->131 51 conhost.exe 44->51         started        53 conhost.exe 49->53         started        process17
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c1d948fee0541e31cfa3affa9d99a6ad6cf287601f3ddae9238c3ca379a4686c/
Threat name:
Win32.Trojan.SpyNoon
Create hunting rule
Status:
Malicious
First seen:
2023-05-05 14:12:11 UTC
File Type:
PE (Exe)
Extracted files:
45
AV detection:
16 of 24 (66.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=yhmur7xakqpddt5dv75j3gngvvwpfb3ad465v2jdrq6kg6nenbwa._file
Verdict:
malicious
Similar samples:
0c068a04f71f9fb987981519ad4fa540d88babba65a76c10e3640cf0d39e49f2
Formbook
28e3150ea7c783636a71ebf55144b06e47fa4e4d0866ac9a5419d8d019b7128a
Formbook
552685bd9d5668183267fa60f76af8584611e11d439085d660ae54147ca5f355
Formbook
55b7f1bd4c56855427d9f9cec42bc93f75995193f023f4242b7f6e958868f619
Formbook
73e786d5242a65d25c8ec6f8b76bc4745b200df7cc5a393529219220df8eb126
Formbook
a2231cdfce2e5ec3adcdb8535b1663da96d390e65c0f0c83c385a96d97790f0e
Formbook
c885f1740970c383d1624b7f64dfb335fc7c0324bfa45deb96577e0d25bff7ae
Formbook
d64087bb6c3f3db707e9728a3800ad308ea6ce7e4b33a4dae2ee15101df4e134
Formbook
+ 74 additional samples on MalwareBazaar
Result
Malware family:
modiloader
Create hunting rule
Score:
  10/10
Tags:
family:formbook family:modiloader campaign:bs92 persistence rat spyware stealer trojan
Link:
https://tria.ge/reports/230505-rht34ach3w/
Behaviour
Enumerates system info in registry
Modifies registry class
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Formbook payload
ModiLoader Second Stage
Formbook
ModiLoader, DBatLoader
Unpacked files
SH256 hash:
556fca4d416f72eff2796918d788bcc0c6334ac2f89371b3897e1795a8c3f889
MD5 hash:
26825acb26d4f00bb7a7a2ad828008ec
SHA1 hash:
824cb73a81857df6808c2a6cc45a83f8eaf1dfa1
Detections:
win_dbatloader_g1
Create hunting rule
Link:
https://www.unpac.me/results/21e277ba-b4ae-461a-b2bf-80a5ff31751d/
Parent samples :
969af9f6016a316693a0d710460a4b6576185a2907c999985f2642ef26889584
c1d948fee0541e31cfa3affa9d99a6ad6cf287601f3ddae9238c3ca379a4686c
41d598443c6324a957f6de00a7dee27e5f21d5f9168ab8eb82e5180621771674
SH256 hash:
c1d948fee0541e31cfa3affa9d99a6ad6cf287601f3ddae9238c3ca379a4686c
MD5 hash:
2ebf7f5b65c0e71bf0f36e8e9bbde1c3
SHA1 hash:
94f3d18e57d6483c03cae67478bb559a2e3ae0f8
Detections:
DbatLoaderStage1
Create hunting rule
Link:
https://www.unpac.me/results/21e277ba-b4ae-461a-b2bf-80a5ff31751d/
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/c1d948fee054/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c1d948fee0541e31cfa3affa9d99a6ad6cf287601f3ddae9238c3ca379a4686c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:CMD_Ping_Localhost
Create hunting rule
Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar c5ef403f6eb24be53ab7293ad56c54f6853df005b6b9d34c48f0132d794a32d9

Formbook

Executable exe c1d948fee0541e31cfa3affa9d99a6ad6cf287601f3ddae9238c3ca379a4686c

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 c5ef403f6eb24be53ab7293ad56c54f6853df005b6b9d34c48f0132d794a32d9
Cape
Cape
https://www.capesandbox.com/analysis/386964/
  
Dropped by
MD5 d90dc4011ae0968a98859f42a06277d4

Comments