formbook | f49e50532a7e5d312f8429c41e28848461651f671139a7590b64d9df029db998

General

Target

SCAN_20210112140930669.exe
Size

837KB
MD5

0d7f35bd5d0a8f5e0b52db592ab5509c
SHA1

5300466a9a3ca11e3f90785ed8a13115e200def6
SHA256

f49e50532a7e5d312f8429c41e28848461651f671139a7590b64d9df029db998
SHA512

978f2d13f77d724a780fe33a5740b1735d95b03dae0e6a273cbf1101d13c8e3c7981b219433975ff42db7f97488b1868aa990d660713f702568e411ffc9b00f3

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.midnightblueinc.com/2kf/

Decoy

edmondscakes.com

doublewldr.online

tickets2usa.com

heyhxry.com

weightloss-gulfport.com

prosselius.com

newviewroofers.com

jacksonarearealestate.com

catparkas.xyz

pagos2020.com

sonwsefjrahi.online

franchisethings.com

nuocvietngaynay.com

sohelvai.com

mikeyroush.com

lamesaroofing.com

betbigo138.com

amazon-service-recovery.com

clockin.net

riostrader.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/556-10-0x000000000041EB30-mapping.dmp	formbook
behavioral1/memory/556-9-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/1636-11-0x0000000000000000-mapping.dmp	formbook

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

848 cmd.exe

pid	process
848	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

SCAN_20210112140930669.exeSCAN_20210112140930669.exesvchost.exe

description	pid	process	target process
PID 1424 set thread context of 556	1424	SCAN_20210112140930669.exe	SCAN_20210112140930669.exe
PID 556 set thread context of 1260	556	SCAN_20210112140930669.exe	Explorer.EXE
PID 1636 set thread context of 1260	1636	svchost.exe	Explorer.EXE

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1368 schtasks.exe

pid	process
1368	schtasks.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

Processes:

SCAN_20210112140930669.exeSCAN_20210112140930669.exesvchost.exe

pid	process
1424	SCAN_20210112140930669.exe
1424	SCAN_20210112140930669.exe
1424	SCAN_20210112140930669.exe
556	SCAN_20210112140930669.exe
556	SCAN_20210112140930669.exe
1636	svchost.exe
1636	svchost.exe
1636	svchost.exe
1636	svchost.exe
1636	svchost.exe
1636	svchost.exe
1636	svchost.exe
1636	svchost.exe
1636	svchost.exe
1636	svchost.exe
1636	svchost.exe
1636	svchost.exe
1636	svchost.exe
1636	svchost.exe
1636	svchost.exe
1636	svchost.exe
1636	svchost.exe

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

SCAN_20210112140930669.exesvchost.exe

pid process

556 SCAN_20210112140930669.exe
556 SCAN_20210112140930669.exe
556 SCAN_20210112140930669.exe
1636 svchost.exe
1636 svchost.exe

pid	process
556	SCAN_20210112140930669.exe
556	SCAN_20210112140930669.exe
556	SCAN_20210112140930669.exe
1636	svchost.exe
1636	svchost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

SCAN_20210112140930669.exeSCAN_20210112140930669.exesvchost.exe

description	pid	process
Token: SeDebugPrivilege	1424	SCAN_20210112140930669.exe
Token: SeDebugPrivilege	556	SCAN_20210112140930669.exe
Token: SeDebugPrivilege	1636	svchost.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

Explorer.EXE

pid process

1260 Explorer.EXE
1260 Explorer.EXE
1260 Explorer.EXE
1260 Explorer.EXE
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

Explorer.EXE

pid process

1260 Explorer.EXE
1260 Explorer.EXE
1260 Explorer.EXE
1260 Explorer.EXE

pid	process
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE

pid	process
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

SCAN_20210112140930669.exeExplorer.EXEsvchost.exe

description	pid	process	target process
PID 1424 wrote to memory of 1368	1424	SCAN_20210112140930669.exe	schtasks.exe
PID 1424 wrote to memory of 1368	1424	SCAN_20210112140930669.exe	schtasks.exe
PID 1424 wrote to memory of 1368	1424	SCAN_20210112140930669.exe	schtasks.exe
PID 1424 wrote to memory of 1368	1424	SCAN_20210112140930669.exe	schtasks.exe
PID 1424 wrote to memory of 1032	1424	SCAN_20210112140930669.exe	SCAN_20210112140930669.exe
PID 1424 wrote to memory of 1032	1424	SCAN_20210112140930669.exe	SCAN_20210112140930669.exe
PID 1424 wrote to memory of 1032	1424	SCAN_20210112140930669.exe	SCAN_20210112140930669.exe
PID 1424 wrote to memory of 1032	1424	SCAN_20210112140930669.exe	SCAN_20210112140930669.exe
PID 1424 wrote to memory of 556	1424	SCAN_20210112140930669.exe	SCAN_20210112140930669.exe
PID 1424 wrote to memory of 556	1424	SCAN_20210112140930669.exe	SCAN_20210112140930669.exe
PID 1424 wrote to memory of 556	1424	SCAN_20210112140930669.exe	SCAN_20210112140930669.exe
PID 1424 wrote to memory of 556	1424	SCAN_20210112140930669.exe	SCAN_20210112140930669.exe
PID 1424 wrote to memory of 556	1424	SCAN_20210112140930669.exe	SCAN_20210112140930669.exe
PID 1424 wrote to memory of 556	1424	SCAN_20210112140930669.exe	SCAN_20210112140930669.exe
PID 1424 wrote to memory of 556	1424	SCAN_20210112140930669.exe	SCAN_20210112140930669.exe
PID 1260 wrote to memory of 1636	1260	Explorer.EXE	svchost.exe
PID 1260 wrote to memory of 1636	1260	Explorer.EXE	svchost.exe
PID 1260 wrote to memory of 1636	1260	Explorer.EXE	svchost.exe
PID 1260 wrote to memory of 1636	1260	Explorer.EXE	svchost.exe
PID 1636 wrote to memory of 848	1636	svchost.exe	cmd.exe
PID 1636 wrote to memory of 848	1636	svchost.exe	cmd.exe
PID 1636 wrote to memory of 848	1636	svchost.exe	cmd.exe
PID 1636 wrote to memory of 848	1636	svchost.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1260

C:\Users\Admin\AppData\Local\Temp\SCAN_20210112140930669.exe
"C:\Users\Admin\AppData\Local\Temp\SCAN_20210112140930669.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1424

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TOYAehanY" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3E7.tmp"
3⤵
- Creates scheduled task(s)
PID:1368

C:\Users\Admin\AppData\Local\Temp\SCAN_20210112140930669.exe
"C:\Users\Admin\AppData\Local\Temp\SCAN_20210112140930669.exe"
3⤵
PID:1032

C:\Users\Admin\AppData\Local\Temp\SCAN_20210112140930669.exe
"C:\Users\Admin\AppData\Local\Temp\SCAN_20210112140930669.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:556

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\SysWOW64\svchost.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1636

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\SCAN_20210112140930669.exe"
3⤵
- Deletes itself
PID:848

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp3E7.tmp
MD5
2c9429ea3c33b47465d3c0f4b2e1144b

SHA1
582a968b6c65a0b43c904b9ae1049d3c2a51bd24

SHA256
4a5284eba9982a6b8be86d133a4e28b9befaed79631d20c847fed2b455265875

SHA512
f22463e30c18ca0de29a66ebd0292e86fe7a55527dc0f03af88122526c4b95f9096df44dc6476a936c489494901bd6552f0df6ccbf2ba7c46ace6b2c5e337cb7

Download Submit
memory/556-10-0x000000000041EB30-mapping.dmp

Download
memory/556-9-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/848-13-0x0000000000000000-mapping.dmp

Download
memory/1368-7-0x0000000000000000-mapping.dmp

Download
memory/1424-2-0x0000000074520000-0x0000000074C0E000-memory.dmp

Filesize
6.9MB

Download
memory/1424-3-0x0000000000E10000-0x0000000000E11000-memory.dmp

Filesize
4KB

Download
memory/1424-5-0x00000000002D0000-0x00000000002E2000-memory.dmp

Filesize
72KB

Download
memory/1424-6-0x0000000005090000-0x00000000050FC000-memory.dmp

Filesize
432KB

Download
memory/1636-11-0x0000000000000000-mapping.dmp

Download
memory/1636-12-0x0000000000180000-0x0000000000188000-memory.dmp

Filesize
32KB

Download
memory/1636-14-0x00000000018E0000-0x00000000019AD000-memory.dmp

Filesize
820KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads