formbook | 0538ad6e3f92ea13a5a3dadb18e807ce26097bbfd2f473e873a514b6dbbe8f5d

General

Target
g5f91.exe
Size 430KB
Sample201001-jdy7wp2bas
SHA256 0538ad6e3f92ea13a5a3dadb18e807ce26097bbfd2f473e873a514b6dbbe8f5d
MD5 c85b80c8a60460b16bcba9ede71fe5ff
SHA1 bc74be7970866feb94edb76a5dd62dff7722a165
SHA512 7b18f124a9e77c5078d9dc904350ae32f7bfb8eb1eca465a508fb7adc0293dc8babb6bd84b13180b2d34e20459ce60159b7d07b9ddb5c43f44f78c5149eb55b6
MD5 SHA1 SHA512

Score

10^/10

rat trojan spyware stealer formbook

Malware Config

Extracted

Family

formbook

C2

http://www.elevatedqueensnc.com/ajr/

Decoy

cokefork.com
sunsabe.com
tactical-milsim.com
johnporcaro.com
quantqubit.com
ehrbar2012.com
dailymoringpages.com
masteronlineteams.com
signocomunicaciones.com
entrepreneur-de-demain.com
eve-echoes-data.com
readingbythewindow.com
quoteshark.net
mundoeconomic.com
bootlegmask.com
sporkedmissoula.com
claricitywealthplanning.net
lyotrade.net
brandtokitchens.com
blackstorymedia.com
armstrongramps.com
shinelinks.net
xhubstory.xyz
dannisconfessions.com
mycology.supplies
virtualinspectiontraining.com
usarmedforcesforbiden.com
theduneco.net
govirtualgym.com
pricemanmmi.com
eleanorandhick.com
grosgay.com
artmasteronline.com
psm-gen.com
strikermanagementgroup.com
tdhudsonfarms.com
nefkin.net
firewoodlogsbristol.com
csbaoxing.com
firestarterelectronics.com
igreels.today
janet-lorenz.com
bookyachting.com
kayarihats.com
wd7369.com
kvhchocen.com
madfishrods.com
yourprotectionguide.com
piao.mobi
loveinspiredtees.com
cric4c.com
tapchiotoxemay.net
engelhartweb.com
cgv-so.com
easyloop.email
xn--sss-ula.com
anunaysrivastava.com
1padrepio.com
getuewbessedre.com
achrafbarrou.com
misspinkk.com
717cary.com
myworldgay.com
alfcsg.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/1504-8-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/1504-9-0x000000000041EE00-mapping.dmp	formbook
behavioral1/memory/748-11-0x0000000000000000-mapping.dmp	formbook

Deletes itself 1 IoCs

pid	Process
1644	cmd.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1688 set thread context of 1504	1688	g5f91.exe	31
PID 1504 set thread context of 1212	1504	g5f91.exe	20
PID 1504 set thread context of 1212	1504	g5f91.exe	20
PID 748 set thread context of 1212	748	msiexec.exe	20

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1164	schtasks.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
1688	g5f91.exe
1504	g5f91.exe
1504	g5f91.exe
1504	g5f91.exe
748	msiexec.exe
748	msiexec.exe
748	msiexec.exe
748	msiexec.exe
748	msiexec.exe
748	msiexec.exe
748	msiexec.exe
748	msiexec.exe
748	msiexec.exe
748	msiexec.exe
748	msiexec.exe
748	msiexec.exe
748	msiexec.exe
748	msiexec.exe
748	msiexec.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
1504	g5f91.exe
1504	g5f91.exe
1504	g5f91.exe
1504	g5f91.exe
748	msiexec.exe
748	msiexec.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1688	g5f91.exe
Token: SeDebugPrivilege	1504	g5f91.exe
Token: SeDebugPrivilege	748	msiexec.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 1164	1688	g5f91.exe	28
PID 1688 wrote to memory of 1164	1688	g5f91.exe	28
PID 1688 wrote to memory of 1164	1688	g5f91.exe	28
PID 1688 wrote to memory of 1164	1688	g5f91.exe	28
PID 1688 wrote to memory of 1608	1688	g5f91.exe	30
PID 1688 wrote to memory of 1608	1688	g5f91.exe	30
PID 1688 wrote to memory of 1608	1688	g5f91.exe	30
PID 1688 wrote to memory of 1608	1688	g5f91.exe	30
PID 1688 wrote to memory of 1504	1688	g5f91.exe	31
PID 1688 wrote to memory of 1504	1688	g5f91.exe	31
PID 1688 wrote to memory of 1504	1688	g5f91.exe	31
PID 1688 wrote to memory of 1504	1688	g5f91.exe	31
PID 1688 wrote to memory of 1504	1688	g5f91.exe	31
PID 1688 wrote to memory of 1504	1688	g5f91.exe	31
PID 1688 wrote to memory of 1504	1688	g5f91.exe	31
PID 1212 wrote to memory of 748	1212	Explorer.EXE	32
PID 1212 wrote to memory of 748	1212	Explorer.EXE	32
PID 1212 wrote to memory of 748	1212	Explorer.EXE	32
PID 1212 wrote to memory of 748	1212	Explorer.EXE	32
PID 1212 wrote to memory of 748	1212	Explorer.EXE	32
PID 1212 wrote to memory of 748	1212	Explorer.EXE	32
PID 1212 wrote to memory of 748	1212	Explorer.EXE	32
PID 748 wrote to memory of 1644	748	msiexec.exe	33
PID 748 wrote to memory of 1644	748	msiexec.exe	33
PID 748 wrote to memory of 1644	748	msiexec.exe	33
PID 748 wrote to memory of 1644	748	msiexec.exe	33

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Users\Admin\AppData\Local\Temp\g5f91.exe
  "C:\Users\Admin\AppData\Local\Temp\g5f91.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1688
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tfPErTSwFfzBj" /XML "C:\Users\Admin\AppData\Local\Temp\tmp80C.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:1164
- - C:\Users\Admin\AppData\Local\Temp\g5f91.exe
    "C:\Users\Admin\AppData\Local\Temp\g5f91.exe"
    3⤵
    PID:1608
- - C:\Users\Admin\AppData\Local\Temp\g5f91.exe
    "C:\Users\Admin\AppData\Local\Temp\g5f91.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:1504
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:748
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\g5f91.exe"
    3⤵
    - Deletes itself
    PID:1644

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/748-14-0x0000000003180000-0x00000000032AB000-memory.dmp

Download

memory/748-12-0x0000000000BB0000-0x0000000000BC4000-memory.dmp

Download

memory/1212-10-0x0000000006B60000-0x0000000006CCE000-memory.dmp

Download

memory/1504-8-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1688-5-0x0000000000AD0000-0x0000000000B03000-memory.dmp

Download

memory/1688-0-0x0000000074020000-0x000000007470E000-memory.dmp

Download

memory/1688-4-0x0000000000D00000-0x0000000000D4F000-memory.dmp

Download

memory/1688-3-0x00000000003A0000-0x00000000003A4000-memory.dmp

Download

memory/1688-1-0x0000000001210000-0x0000000001211000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads