formbook | c3a69db8642855e1dfcbcb213f7f050c5fb2d86744183b13483411f97009c2a0

General

Target

PO-000202112.exe
Size

1.0MB
MD5

673900f8da4aa24a77f61417d0273d85
SHA1

0d04e357ccb332b63b1a8d9d4e9f6b889c2f0b77
SHA256

c3a69db8642855e1dfcbcb213f7f050c5fb2d86744183b13483411f97009c2a0
SHA512

63c30b550f314620cdc961eb1dcb0c91e8f9b702aa722f34b0c81c308ac5f44ab9818bd12fb8e13aabc6ed3bab16b6df90b1727aed976fcf86ee4a0422adfde6

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.culturespk.com/kbl/

Decoy

flamesapp.com

ravenridgehoa.com

epraggma.com

stupidbooks.com

jointhesadls.com

estavisaapplication.com

12minhomebusiness.com

wwddww.com

stratusdetroitmail.com

storevanguard.com

cadeaux-et-gadgets.com

vbnfnleoba.club

ilikecircles.com

inspirednycharm.com

baizhongcai.com

medinius.info

call0815.com

vastu618.com

beautyshopin.com

looksplanet.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2124-14-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral2/memory/2124-15-0x000000000041EAC0-mapping.dmp	formbook
behavioral2/memory/1176-16-0x0000000000000000-mapping.dmp	formbook

Suspicious use of SetThreadContext 3 IoCs

Processes:

PO-000202112.exePO-000202112.exeNETSTAT.EXE

description	pid	process	target process
PID 1628 set thread context of 2124	1628	PO-000202112.exe	PO-000202112.exe
PID 2124 set thread context of 2144	2124	PO-000202112.exe	Explorer.EXE
PID 1176 set thread context of 2144	1176	NETSTAT.EXE	Explorer.EXE

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2792 schtasks.exe
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command-Line Interface
T1059

Processes:

NETSTAT.EXE

pid process

1176 NETSTAT.EXE

pid	process
2792	schtasks.exe

pid	process
1176	NETSTAT.EXE

Suspicious behavior: EnumeratesProcesses 39 IoCs

Processes:

PO-000202112.exePO-000202112.exeNETSTAT.EXE

pid	process
1628	PO-000202112.exe
2124	PO-000202112.exe
2124	PO-000202112.exe
2124	PO-000202112.exe
2124	PO-000202112.exe
1176	NETSTAT.EXE
1176	NETSTAT.EXE
1176	NETSTAT.EXE
1176	NETSTAT.EXE
1176	NETSTAT.EXE
1176	NETSTAT.EXE
1176	NETSTAT.EXE
1176	NETSTAT.EXE
1176	NETSTAT.EXE
1176	NETSTAT.EXE
1176	NETSTAT.EXE
1176	NETSTAT.EXE
1176	NETSTAT.EXE
1176	NETSTAT.EXE
1176	NETSTAT.EXE
1176	NETSTAT.EXE
1176	NETSTAT.EXE
1176	NETSTAT.EXE
1176	NETSTAT.EXE
1176	NETSTAT.EXE
1176	NETSTAT.EXE
1176	NETSTAT.EXE
1176	NETSTAT.EXE
1176	NETSTAT.EXE
1176	NETSTAT.EXE
1176	NETSTAT.EXE
1176	NETSTAT.EXE
1176	NETSTAT.EXE
1176	NETSTAT.EXE
1176	NETSTAT.EXE
1176	NETSTAT.EXE
1176	NETSTAT.EXE
1176	NETSTAT.EXE
1176	NETSTAT.EXE

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

PO-000202112.exeNETSTAT.EXE

pid process

2124 PO-000202112.exe
2124 PO-000202112.exe
2124 PO-000202112.exe
1176 NETSTAT.EXE
1176 NETSTAT.EXE

pid	process
2124	PO-000202112.exe
2124	PO-000202112.exe
2124	PO-000202112.exe
1176	NETSTAT.EXE
1176	NETSTAT.EXE

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

PO-000202112.exePO-000202112.exeExplorer.EXENETSTAT.EXE

description	pid	process
Token: SeDebugPrivilege	1628	PO-000202112.exe
Token: SeDebugPrivilege	2124	PO-000202112.exe
Token: SeShutdownPrivilege	2144	Explorer.EXE
Token: SeCreatePagefilePrivilege	2144	Explorer.EXE
Token: SeDebugPrivilege	1176	NETSTAT.EXE

Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

2144 Explorer.EXE

pid	process
2144	Explorer.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

PO-000202112.exeExplorer.EXENETSTAT.EXE

description	pid	process	target process
PID 1628 wrote to memory of 2792	1628	PO-000202112.exe	schtasks.exe
PID 1628 wrote to memory of 2792	1628	PO-000202112.exe	schtasks.exe
PID 1628 wrote to memory of 2792	1628	PO-000202112.exe	schtasks.exe
PID 1628 wrote to memory of 2124	1628	PO-000202112.exe	PO-000202112.exe
PID 1628 wrote to memory of 2124	1628	PO-000202112.exe	PO-000202112.exe
PID 1628 wrote to memory of 2124	1628	PO-000202112.exe	PO-000202112.exe
PID 1628 wrote to memory of 2124	1628	PO-000202112.exe	PO-000202112.exe
PID 1628 wrote to memory of 2124	1628	PO-000202112.exe	PO-000202112.exe
PID 1628 wrote to memory of 2124	1628	PO-000202112.exe	PO-000202112.exe
PID 2144 wrote to memory of 1176	2144	Explorer.EXE	NETSTAT.EXE
PID 2144 wrote to memory of 1176	2144	Explorer.EXE	NETSTAT.EXE
PID 2144 wrote to memory of 1176	2144	Explorer.EXE	NETSTAT.EXE
PID 1176 wrote to memory of 3688	1176	NETSTAT.EXE	cmd.exe
PID 1176 wrote to memory of 3688	1176	NETSTAT.EXE	cmd.exe
PID 1176 wrote to memory of 3688	1176	NETSTAT.EXE	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Users\Admin\AppData\Local\Temp\PO-000202112.exe
  "C:\Users\Admin\AppData\Local\Temp\PO-000202112.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1628
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\KUrQojFHu" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5F67.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:2792
- - C:\Users\Admin\AppData\Local\Temp\PO-000202112.exe
    "C:\Users\Admin\AppData\Local\Temp\PO-000202112.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:2124
- C:\Windows\SysWOW64\NETSTAT.EXE
  "C:\Windows\SysWOW64\NETSTAT.EXE"
  2⤵
  - Suspicious use of SetThreadContext
  - Gathers network information
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1176
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\PO-000202112.exe"
    3⤵
    PID:3688

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

Scheduled Task

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp5F67.tmp

MD5
2aed3060ba6720e145a1bb29bc1d6efc

SHA1
c75af4149fc0d17eb6b7cf98fbf8324bf8d78b31

SHA256
2796a5f9b3bd9a30cdf97bab5e9eb63661b54fd69faaf7a2eea74277c4198df0

SHA512
06eedd5d9df481e3480855490013f5fff6487899fc72ad203cb1ea324e92e0328f9842d067da81bafb60bea6798cd31bc00e904a5ace3d8027e74220047c8bb2

Download Submit
memory/1176-18-0x0000000000E10000-0x0000000000E1B000-memory.dmp

Filesize
44KB

Download
memory/1176-17-0x0000000000E10000-0x0000000000E1B000-memory.dmp

Filesize
44KB

Download
memory/1176-16-0x0000000000000000-mapping.dmp

Download
memory/1628-11-0x00000000064B0000-0x000000000651A000-memory.dmp

Filesize
424KB

Download
memory/1628-8-0x0000000005720000-0x0000000005721000-memory.dmp

Filesize
4KB

Download
memory/1628-9-0x0000000005A30000-0x0000000005A31000-memory.dmp

Filesize
4KB

Download
memory/1628-10-0x0000000005760000-0x0000000005772000-memory.dmp

Filesize
72KB

Download
memory/1628-2-0x0000000073840000-0x0000000073F2E000-memory.dmp

Filesize
6.9MB

Download
memory/1628-7-0x0000000005820000-0x0000000005821000-memory.dmp

Filesize
4KB

Download
memory/1628-6-0x0000000005D20000-0x0000000005D21000-memory.dmp

Filesize
4KB

Download
memory/1628-5-0x0000000005780000-0x0000000005781000-memory.dmp

Filesize
4KB

Download
memory/1628-3-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

Filesize
4KB

Download
memory/2124-14-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2124-15-0x000000000041EAC0-mapping.dmp

Download
memory/2792-12-0x0000000000000000-mapping.dmp

Download
memory/3688-19-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads