formbook | f49e50532a7e5d312f8429c41e28848461651f671139a7590b64d9df029db998

General

Target

SCAN_20210112140930669.exe
Size

837KB
MD5

0d7f35bd5d0a8f5e0b52db592ab5509c
SHA1

5300466a9a3ca11e3f90785ed8a13115e200def6
SHA256

f49e50532a7e5d312f8429c41e28848461651f671139a7590b64d9df029db998
SHA512

978f2d13f77d724a780fe33a5740b1735d95b03dae0e6a273cbf1101d13c8e3c7981b219433975ff42db7f97488b1868aa990d660713f702568e411ffc9b00f3

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.midnightblueinc.com/2kf/

Decoy

edmondscakes.com

doublewldr.online

tickets2usa.com

heyhxry.com

weightloss-gulfport.com

prosselius.com

newviewroofers.com

jacksonarearealestate.com

catparkas.xyz

pagos2020.com

sonwsefjrahi.online

franchisethings.com

nuocvietngaynay.com

sohelvai.com

mikeyroush.com

lamesaroofing.com

betbigo138.com

amazon-service-recovery.com

clockin.net

riostrader.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2692-14-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral2/memory/2692-15-0x000000000041EB30-mapping.dmp	formbook
behavioral2/memory/1304-16-0x0000000000000000-mapping.dmp	formbook

Suspicious use of SetThreadContext 4 IoCs

Processes:

SCAN_20210112140930669.exeSCAN_20210112140930669.exerundll32.exe

description	pid	process	target process
PID 540 set thread context of 2692	540	SCAN_20210112140930669.exe	SCAN_20210112140930669.exe
PID 2692 set thread context of 3016	2692	SCAN_20210112140930669.exe	Explorer.EXE
PID 2692 set thread context of 3016	2692	SCAN_20210112140930669.exe	Explorer.EXE
PID 1304 set thread context of 3016	1304	rundll32.exe	Explorer.EXE

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1404 schtasks.exe

pid	process
1404	schtasks.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

Processes:

SCAN_20210112140930669.exeSCAN_20210112140930669.exerundll32.exe

pid	process
540	SCAN_20210112140930669.exe
2692	SCAN_20210112140930669.exe
2692	SCAN_20210112140930669.exe
2692	SCAN_20210112140930669.exe
2692	SCAN_20210112140930669.exe
2692	SCAN_20210112140930669.exe
2692	SCAN_20210112140930669.exe
1304	rundll32.exe
1304	rundll32.exe
1304	rundll32.exe
1304	rundll32.exe
1304	rundll32.exe
1304	rundll32.exe
1304	rundll32.exe
1304	rundll32.exe
1304	rundll32.exe
1304	rundll32.exe
1304	rundll32.exe
1304	rundll32.exe
1304	rundll32.exe
1304	rundll32.exe
1304	rundll32.exe
1304	rundll32.exe
1304	rundll32.exe
1304	rundll32.exe
1304	rundll32.exe
1304	rundll32.exe
1304	rundll32.exe
1304	rundll32.exe
1304	rundll32.exe
1304	rundll32.exe
1304	rundll32.exe
1304	rundll32.exe
1304	rundll32.exe
1304	rundll32.exe
1304	rundll32.exe
1304	rundll32.exe

Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

SCAN_20210112140930669.exerundll32.exe

pid	process
2692	SCAN_20210112140930669.exe
2692	SCAN_20210112140930669.exe
2692	SCAN_20210112140930669.exe
2692	SCAN_20210112140930669.exe
1304	rundll32.exe
1304	rundll32.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

SCAN_20210112140930669.exeSCAN_20210112140930669.exeExplorer.EXErundll32.exe

description	pid	process
Token: SeDebugPrivilege	540	SCAN_20210112140930669.exe
Token: SeDebugPrivilege	2692	SCAN_20210112140930669.exe
Token: SeShutdownPrivilege	3016	Explorer.EXE
Token: SeCreatePagefilePrivilege	3016	Explorer.EXE
Token: SeDebugPrivilege	1304	rundll32.exe

Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

3016 Explorer.EXE

pid	process
3016	Explorer.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

SCAN_20210112140930669.exeExplorer.EXErundll32.exe

description	pid	process	target process
PID 540 wrote to memory of 1404	540	SCAN_20210112140930669.exe	schtasks.exe
PID 540 wrote to memory of 1404	540	SCAN_20210112140930669.exe	schtasks.exe
PID 540 wrote to memory of 1404	540	SCAN_20210112140930669.exe	schtasks.exe
PID 540 wrote to memory of 2692	540	SCAN_20210112140930669.exe	SCAN_20210112140930669.exe
PID 540 wrote to memory of 2692	540	SCAN_20210112140930669.exe	SCAN_20210112140930669.exe
PID 540 wrote to memory of 2692	540	SCAN_20210112140930669.exe	SCAN_20210112140930669.exe
PID 540 wrote to memory of 2692	540	SCAN_20210112140930669.exe	SCAN_20210112140930669.exe
PID 540 wrote to memory of 2692	540	SCAN_20210112140930669.exe	SCAN_20210112140930669.exe
PID 540 wrote to memory of 2692	540	SCAN_20210112140930669.exe	SCAN_20210112140930669.exe
PID 3016 wrote to memory of 1304	3016	Explorer.EXE	rundll32.exe
PID 3016 wrote to memory of 1304	3016	Explorer.EXE	rundll32.exe
PID 3016 wrote to memory of 1304	3016	Explorer.EXE	rundll32.exe
PID 1304 wrote to memory of 2192	1304	rundll32.exe	cmd.exe
PID 1304 wrote to memory of 2192	1304	rundll32.exe	cmd.exe
PID 1304 wrote to memory of 2192	1304	rundll32.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3016

C:\Users\Admin\AppData\Local\Temp\SCAN_20210112140930669.exe
"C:\Users\Admin\AppData\Local\Temp\SCAN_20210112140930669.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:540

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TOYAehanY" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5B11.tmp"
3⤵
- Creates scheduled task(s)
PID:1404

C:\Users\Admin\AppData\Local\Temp\SCAN_20210112140930669.exe
"C:\Users\Admin\AppData\Local\Temp\SCAN_20210112140930669.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2692

C:\Windows\SysWOW64\autochk.exe
"C:\Windows\SysWOW64\autochk.exe"
2⤵
PID:1324

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\SysWOW64\rundll32.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1304

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\SCAN_20210112140930669.exe"
3⤵
PID:2192

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp5B11.tmp
MD5
3951a19122ca11d41bfbafd0749e76bb

SHA1
cb8d290688e3c2ebd90bc5eaef5c1267029285c3

SHA256
dfed047e8505d0b25d1606217b9a898777381ccd0d1f9cf00ca79271a0fbc791

SHA512
88675298aa03bcbfc5f3b8d5cb35d4bcc323849172b3fb3ef6b2ad14dfa2d78f9d5ab6390d0fcbcaa99e827dc806a6d76157f8c3ce2d50f126479809ceeff6fe

Download Submit
memory/540-11-0x0000000005F40000-0x0000000005FAC000-memory.dmp

Filesize
432KB

Download
memory/540-6-0x00000000056D0000-0x00000000056D1000-memory.dmp

Filesize
4KB

Download
memory/540-7-0x00000000051D0000-0x00000000051D1000-memory.dmp

Filesize
4KB

Download
memory/540-2-0x0000000073520000-0x0000000073C0E000-memory.dmp

Filesize
6.9MB

Download
memory/540-9-0x00000000053E0000-0x00000000053E1000-memory.dmp

Filesize
4KB

Download
memory/540-5-0x0000000005130000-0x0000000005131000-memory.dmp

Filesize
4KB

Download
memory/540-10-0x0000000005530000-0x0000000005542000-memory.dmp

Filesize
72KB

Download
memory/540-8-0x00000000050E0000-0x00000000050E1000-memory.dmp

Filesize
4KB

Download
memory/540-3-0x0000000000800000-0x0000000000801000-memory.dmp

Filesize
4KB

Download
memory/1304-16-0x0000000000000000-mapping.dmp

Download
memory/1304-18-0x00000000009C0000-0x00000000009D3000-memory.dmp

Filesize
76KB

Download
memory/1304-17-0x00000000009C0000-0x00000000009D3000-memory.dmp

Filesize
76KB

Download
memory/1404-12-0x0000000000000000-mapping.dmp

Download
memory/2192-19-0x0000000000000000-mapping.dmp

Download
memory/2692-15-0x000000000041EB30-mapping.dmp

Download
memory/2692-14-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads