formbook | be770e407dcedcafe214f75273fbbbd7264c1c7c48dbc6da8764add43296adce

General

Target

SCAN_20210112_132640143,pdf.exe
Size

842KB
MD5

e079c68325f24f2ddd7c677d3d90393c
SHA1

9230905d50e7a13937bb1f076f63f0da962864c1
SHA256

be770e407dcedcafe214f75273fbbbd7264c1c7c48dbc6da8764add43296adce
SHA512

022a7f5285d9dfe6222761da6586a39915f2e03a0b494c47abcf32da2fe53dde7c963a089cf13c2dd68bce7fc88a532e8435dd6c319144597e037a2ec8bb019a

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.alterhigh.com/rmck/

Decoy

alltechengwork.com

shegotit.club

transactionshelper.com

aarhamworld.com

iitiansparth.com

beattymortgagepro.com

minipipette.com

bthefutureclothing.com

dressmids.com

multitype.one

searchtigo.com

thewildernessshed.store

pizzony.com

telescopiostop.com

commercialroof.guru

afiliatexcatalogo.com

hhzthg.com

keluojia.com

abergele.wales

finnexiia.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/956-9-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/956-10-0x000000000041ECE0-mapping.dmp	formbook
behavioral1/memory/1404-12-0x0000000000000000-mapping.dmp	formbook

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1708 cmd.exe

pid	process
1708	cmd.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

SCAN_20210112_132640143,pdf.exeSCAN_20210112_132640143,pdf.exemsiexec.exe

description	pid	process	target process
PID 1184 set thread context of 956	1184	SCAN_20210112_132640143,pdf.exe	SCAN_20210112_132640143,pdf.exe
PID 956 set thread context of 1256	956	SCAN_20210112_132640143,pdf.exe	Explorer.EXE
PID 956 set thread context of 1256	956	SCAN_20210112_132640143,pdf.exe	Explorer.EXE
PID 1404 set thread context of 1256	1404	msiexec.exe	Explorer.EXE

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1348 schtasks.exe

pid	process
1348	schtasks.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

Processes:

SCAN_20210112_132640143,pdf.exemsiexec.exe

pid	process
956	SCAN_20210112_132640143,pdf.exe
956	SCAN_20210112_132640143,pdf.exe
956	SCAN_20210112_132640143,pdf.exe
1404	msiexec.exe
1404	msiexec.exe
1404	msiexec.exe
1404	msiexec.exe
1404	msiexec.exe
1404	msiexec.exe
1404	msiexec.exe
1404	msiexec.exe
1404	msiexec.exe
1404	msiexec.exe
1404	msiexec.exe
1404	msiexec.exe
1404	msiexec.exe
1404	msiexec.exe

Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

SCAN_20210112_132640143,pdf.exemsiexec.exe

pid	process
956	SCAN_20210112_132640143,pdf.exe
956	SCAN_20210112_132640143,pdf.exe
956	SCAN_20210112_132640143,pdf.exe
956	SCAN_20210112_132640143,pdf.exe
1404	msiexec.exe
1404	msiexec.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

SCAN_20210112_132640143,pdf.exemsiexec.exe

description pid process

Token: SeDebugPrivilege 956 SCAN_20210112_132640143,pdf.exe
Token: SeDebugPrivilege 1404 msiexec.exe

description	pid	process
Token: SeDebugPrivilege	956	SCAN_20210112_132640143,pdf.exe
Token: SeDebugPrivilege	1404	msiexec.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

SCAN_20210112_132640143,pdf.exeExplorer.EXEmsiexec.exe

description	pid	process	target process
PID 1184 wrote to memory of 1348	1184	SCAN_20210112_132640143,pdf.exe	schtasks.exe
PID 1184 wrote to memory of 1348	1184	SCAN_20210112_132640143,pdf.exe	schtasks.exe
PID 1184 wrote to memory of 1348	1184	SCAN_20210112_132640143,pdf.exe	schtasks.exe
PID 1184 wrote to memory of 1348	1184	SCAN_20210112_132640143,pdf.exe	schtasks.exe
PID 1184 wrote to memory of 956	1184	SCAN_20210112_132640143,pdf.exe	SCAN_20210112_132640143,pdf.exe
PID 1184 wrote to memory of 956	1184	SCAN_20210112_132640143,pdf.exe	SCAN_20210112_132640143,pdf.exe
PID 1184 wrote to memory of 956	1184	SCAN_20210112_132640143,pdf.exe	SCAN_20210112_132640143,pdf.exe
PID 1184 wrote to memory of 956	1184	SCAN_20210112_132640143,pdf.exe	SCAN_20210112_132640143,pdf.exe
PID 1184 wrote to memory of 956	1184	SCAN_20210112_132640143,pdf.exe	SCAN_20210112_132640143,pdf.exe
PID 1184 wrote to memory of 956	1184	SCAN_20210112_132640143,pdf.exe	SCAN_20210112_132640143,pdf.exe
PID 1184 wrote to memory of 956	1184	SCAN_20210112_132640143,pdf.exe	SCAN_20210112_132640143,pdf.exe
PID 1256 wrote to memory of 1404	1256	Explorer.EXE	msiexec.exe
PID 1256 wrote to memory of 1404	1256	Explorer.EXE	msiexec.exe
PID 1256 wrote to memory of 1404	1256	Explorer.EXE	msiexec.exe
PID 1256 wrote to memory of 1404	1256	Explorer.EXE	msiexec.exe
PID 1256 wrote to memory of 1404	1256	Explorer.EXE	msiexec.exe
PID 1256 wrote to memory of 1404	1256	Explorer.EXE	msiexec.exe
PID 1256 wrote to memory of 1404	1256	Explorer.EXE	msiexec.exe
PID 1404 wrote to memory of 1708	1404	msiexec.exe	cmd.exe
PID 1404 wrote to memory of 1708	1404	msiexec.exe	cmd.exe
PID 1404 wrote to memory of 1708	1404	msiexec.exe	cmd.exe
PID 1404 wrote to memory of 1708	1404	msiexec.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:1256

C:\Users\Admin\AppData\Local\Temp\SCAN_20210112_132640143,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\SCAN_20210112_132640143,pdf.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1184

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cLTxxXwSGp" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5DF8.tmp"
3⤵
- Creates scheduled task(s)
PID:1348

C:\Users\Admin\AppData\Local\Temp\SCAN_20210112_132640143,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\SCAN_20210112_132640143,pdf.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:956

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\SysWOW64\msiexec.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1404

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\SCAN_20210112_132640143,pdf.exe"
3⤵
- Deletes itself
PID:1708

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp5DF8.tmp

MD5
21b9f31e187aa5389e9ffdb98263d5c1

SHA1
9d212d8091f867ff037a7987b397966736cd5e04

SHA256
5dbc6974d8da54743a5f433d1bd0c8a210befef423bcb2e51d831913673df6bd

SHA512
c7f920858e122b5b0069299837e1dd92594bd933e64385c6d318fc98ec83a4a0cfb61860bbdb9022262407f8b9615792db6f4943938815debe21604f48086fc6

Download Submit
memory/956-10-0x000000000041ECE0-mapping.dmp

Download
memory/956-9-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1184-6-0x0000000005430000-0x000000000549C000-memory.dmp

Filesize
432KB

Download
memory/1184-2-0x00000000748C0000-0x0000000074FAE000-memory.dmp

Filesize
6.9MB

Download
memory/1184-5-0x00000000001C0000-0x00000000001D2000-memory.dmp

Filesize
72KB

Download
memory/1184-3-0x0000000000F30000-0x0000000000F31000-memory.dmp

Filesize
4KB

Download
memory/1256-11-0x0000000006D10000-0x0000000006E49000-memory.dmp

Filesize
1.2MB

Download
memory/1348-7-0x0000000000000000-mapping.dmp

Download
memory/1404-12-0x0000000000000000-mapping.dmp

Download
memory/1404-13-0x0000000000800000-0x0000000000814000-memory.dmp

Filesize
80KB

Download
memory/1404-15-0x00000000033C0000-0x00000000034B3000-memory.dmp

Filesize
972KB

Download
memory/1708-14-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads