formbook | 2d8474bdd8b6122aa79a3b86f729f9aa4f83a2ccf6a51ab510d753b47fc01189

General

Target

N5teSBoBlVySUoq.exe
Size

501KB
MD5

6c914ab41b3b8fcd47d2b52458aa98ac
SHA1

dc01e0c3bca0facd2f4838ac42b94ff0c3c88bd1
SHA256

2d8474bdd8b6122aa79a3b86f729f9aa4f83a2ccf6a51ab510d753b47fc01189
SHA512

44cb0d199025cbf4bc6b6fedca53bc6aed9f676c436ded8a88eefef12a846d3ed8fb612bc9713cea6a7bd2d07fac88a009e1c659379cec43aa571fa69d800984

Score

10^/10

rat trojan spyware stealer formbook

Malware Config

Extracted

Family

formbook

C2

http://www.mansiobok.info/h8ofs/

Decoy

totum-community.com

fintechguardian.com

playwithyourkid.com

jeanstrousers.com

alimentosprobioticos.com

innovationembassies.net

qmfwig.men

choose-vida.com

mcmontagem.com

2math4all.com

ubersize.com

epicmediasv.com

kombipetektemizligi.com

provinsijawabarat.com

godhasanaddress.com

neural.link

mobiola.biz

kuckoorock.com

hideawaytrails.com

coolbrunettegirlsvideo.site

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3880-13-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral2/memory/3880-13-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral2/memory/3880-14-0x000000000041ED70-mapping.dmp	formbook
behavioral2/memory/3788-15-0x0000000000000000-mapping.dmp	formbook

Suspicious use of SetThreadContext 3 IoCs

Processes:

N5teSBoBlVySUoq.exeN5teSBoBlVySUoq.execmstp.exe

description	pid	Process	procid_target
PID 3908 set thread context of 3880	3908	N5teSBoBlVySUoq.exe	76
PID 3880 set thread context of 2940	3880	N5teSBoBlVySUoq.exe	56
PID 3788 set thread context of 2940	3788	cmstp.exe	56

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

schtasks.exe

pid	Process
3812	schtasks.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

Processes:

N5teSBoBlVySUoq.exeN5teSBoBlVySUoq.execmstp.exe

pid	Process
3908	N5teSBoBlVySUoq.exe
3908	N5teSBoBlVySUoq.exe
3880	N5teSBoBlVySUoq.exe
3880	N5teSBoBlVySUoq.exe
3880	N5teSBoBlVySUoq.exe
3880	N5teSBoBlVySUoq.exe
3788	cmstp.exe
3788	cmstp.exe
3788	cmstp.exe
3788	cmstp.exe
3788	cmstp.exe
3788	cmstp.exe
3788	cmstp.exe
3788	cmstp.exe
3788	cmstp.exe
3788	cmstp.exe
3788	cmstp.exe
3788	cmstp.exe
3788	cmstp.exe
3788	cmstp.exe
3788	cmstp.exe
3788	cmstp.exe
3788	cmstp.exe
3788	cmstp.exe
3788	cmstp.exe
3788	cmstp.exe
3788	cmstp.exe
3788	cmstp.exe
3788	cmstp.exe
3788	cmstp.exe
3788	cmstp.exe
3788	cmstp.exe
3788	cmstp.exe
3788	cmstp.exe
3788	cmstp.exe
3788	cmstp.exe
3788	cmstp.exe
3788	cmstp.exe

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

N5teSBoBlVySUoq.execmstp.exe

pid	Process
3880	N5teSBoBlVySUoq.exe
3880	N5teSBoBlVySUoq.exe
3880	N5teSBoBlVySUoq.exe
3788	cmstp.exe
3788	cmstp.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

N5teSBoBlVySUoq.exeN5teSBoBlVySUoq.execmstp.exe

description	pid	Process
Token: SeDebugPrivilege	3908	N5teSBoBlVySUoq.exe
Token: SeDebugPrivilege	3880	N5teSBoBlVySUoq.exe
Token: SeDebugPrivilege	3788	cmstp.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

N5teSBoBlVySUoq.exeExplorer.EXEcmstp.exe

description	pid	Process	procid_target
PID 3908 wrote to memory of 3812	3908	N5teSBoBlVySUoq.exe	73
PID 3908 wrote to memory of 3812	3908	N5teSBoBlVySUoq.exe	73
PID 3908 wrote to memory of 3812	3908	N5teSBoBlVySUoq.exe	73
PID 3908 wrote to memory of 3852	3908	N5teSBoBlVySUoq.exe	75
PID 3908 wrote to memory of 3852	3908	N5teSBoBlVySUoq.exe	75
PID 3908 wrote to memory of 3852	3908	N5teSBoBlVySUoq.exe	75
PID 3908 wrote to memory of 3880	3908	N5teSBoBlVySUoq.exe	76
PID 3908 wrote to memory of 3880	3908	N5teSBoBlVySUoq.exe	76
PID 3908 wrote to memory of 3880	3908	N5teSBoBlVySUoq.exe	76
PID 3908 wrote to memory of 3880	3908	N5teSBoBlVySUoq.exe	76
PID 3908 wrote to memory of 3880	3908	N5teSBoBlVySUoq.exe	76
PID 3908 wrote to memory of 3880	3908	N5teSBoBlVySUoq.exe	76
PID 2940 wrote to memory of 3788	2940	Explorer.EXE	77
PID 2940 wrote to memory of 3788	2940	Explorer.EXE	77
PID 2940 wrote to memory of 3788	2940	Explorer.EXE	77
PID 3788 wrote to memory of 2164	3788	cmstp.exe	78
PID 3788 wrote to memory of 2164	3788	cmstp.exe	78
PID 3788 wrote to memory of 2164	3788	cmstp.exe	78

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Users\Admin\AppData\Local\Temp\N5teSBoBlVySUoq.exe
  "C:\Users\Admin\AppData\Local\Temp\N5teSBoBlVySUoq.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3908
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\zaXeAacuXXqx" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4702.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:3812
- - C:\Users\Admin\AppData\Local\Temp\N5teSBoBlVySUoq.exe
    "C:\Users\Admin\AppData\Local\Temp\N5teSBoBlVySUoq.exe"
    3⤵
    PID:3852
- - C:\Users\Admin\AppData\Local\Temp\N5teSBoBlVySUoq.exe
    "C:\Users\Admin\AppData\Local\Temp\N5teSBoBlVySUoq.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:3880
- C:\Windows\SysWOW64\cmstp.exe
  "C:\Windows\SysWOW64\cmstp.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3788
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\N5teSBoBlVySUoq.exe"
    3⤵
    PID:2164

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp4702.tmp

Download Submit
memory/2164-18-0x0000000000000000-mapping.dmp

Download
memory/3788-19-0x00000000060F0000-0x0000000006212000-memory.dmp

Filesize
1.1MB

Download
memory/3788-17-0x0000000001110000-0x0000000001126000-memory.dmp

Filesize
88KB

Download
memory/3788-16-0x0000000001110000-0x0000000001126000-memory.dmp

Filesize
88KB

Download
memory/3788-15-0x0000000000000000-mapping.dmp

Download
memory/3812-11-0x0000000000000000-mapping.dmp

Download
memory/3880-14-0x000000000041ED70-mapping.dmp

Download
memory/3880-13-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3908-5-0x00000000051B0000-0x00000000051B1000-memory.dmp

Filesize
4KB

Download
memory/3908-10-0x00000000055D0000-0x0000000005600000-memory.dmp

Filesize
192KB

Download
memory/3908-9-0x0000000005580000-0x00000000055C5000-memory.dmp

Filesize
276KB

Download
memory/3908-8-0x0000000005120000-0x000000000512B000-memory.dmp

Filesize
44KB

Download
memory/3908-7-0x0000000005330000-0x0000000005331000-memory.dmp

Filesize
4KB

Download
memory/3908-6-0x0000000005060000-0x0000000005061000-memory.dmp

Filesize
4KB

Download
memory/3908-0-0x0000000073FF0000-0x00000000746DE000-memory.dmp

Filesize
6.9MB

Download
memory/3908-4-0x0000000005610000-0x0000000005611000-memory.dmp

Filesize
4KB

Download
memory/3908-3-0x0000000005070000-0x0000000005071000-memory.dmp

Filesize
4KB

Download
memory/3908-1-0x0000000000690000-0x0000000000691000-memory.dmp

Filesize
4KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads