formbook | 3df48002a1199ab680bea952851cdc0a93f905f21d09245889d6332af639fe68

General

Target

NEW ORDER_pdf.exe
Size

602KB
MD5

dc743359268cefe59904fa804112f012
SHA1

fcc10908413f0122fec5b19e15135957678c70d3
SHA256

3df48002a1199ab680bea952851cdc0a93f905f21d09245889d6332af639fe68
SHA512

8608789bd57073f65675ff160522fb29f771c6242d508ab0ca391ba22310ff030a1f40bcce5c79c1985c8ca05c3bb3528f488f6246d6d160dd4d152dad2b9752

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.freshpixels.agency/wls/

Decoy

brandcamapp.com

hotels-online.net

godsbaconjitters.com

renpaulhotpot.com

bikescarznguitarz.com

amelclothing.com

zhuqiuhui.space

theolivetreeonline.com

yizddmall.com

junkshoptheatre.com

smithylabs.com

cocokaraget.com

rayscollectibles.com

encinolandscapedesign.com

trzeks1.com

jstracker.net

cloudadventure.zone

emilyshines.com

exiledfg.com

seasisterscoastal.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1688-7-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/1688-8-0x000000000041EBD0-mapping.dmp	formbook
behavioral1/memory/1096-9-0x0000000000000000-mapping.dmp	formbook

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

592 cmd.exe

pid	process
592	cmd.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

NEW ORDER_pdf.exeNEW ORDER_pdf.exechkdsk.exe

description	pid	process	target process
PID 1744 set thread context of 1688	1744	NEW ORDER_pdf.exe	NEW ORDER_pdf.exe
PID 1688 set thread context of 1268	1688	NEW ORDER_pdf.exe	Explorer.EXE
PID 1688 set thread context of 1268	1688	NEW ORDER_pdf.exe	Explorer.EXE
PID 1096 set thread context of 1268	1096	chkdsk.exe	Explorer.EXE

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

chkdsk.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	chkdsk.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

Processes:

NEW ORDER_pdf.exechkdsk.exe

pid	process
1688	NEW ORDER_pdf.exe
1688	NEW ORDER_pdf.exe
1688	NEW ORDER_pdf.exe
1096	chkdsk.exe
1096	chkdsk.exe
1096	chkdsk.exe
1096	chkdsk.exe
1096	chkdsk.exe
1096	chkdsk.exe
1096	chkdsk.exe
1096	chkdsk.exe
1096	chkdsk.exe
1096	chkdsk.exe
1096	chkdsk.exe
1096	chkdsk.exe
1096	chkdsk.exe
1096	chkdsk.exe
1096	chkdsk.exe
1096	chkdsk.exe
1096	chkdsk.exe
1096	chkdsk.exe
1096	chkdsk.exe
1096	chkdsk.exe
1096	chkdsk.exe

Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

NEW ORDER_pdf.exechkdsk.exe

pid process

1688 NEW ORDER_pdf.exe
1688 NEW ORDER_pdf.exe
1688 NEW ORDER_pdf.exe
1688 NEW ORDER_pdf.exe
1096 chkdsk.exe
1096 chkdsk.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

NEW ORDER_pdf.exechkdsk.exe

description pid process

Token: SeDebugPrivilege 1688 NEW ORDER_pdf.exe
Token: SeDebugPrivilege 1096 chkdsk.exe
Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

Explorer.EXE

pid process

1268 Explorer.EXE
1268 Explorer.EXE
1268 Explorer.EXE
1268 Explorer.EXE
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

Explorer.EXE

pid process

1268 Explorer.EXE
1268 Explorer.EXE
1268 Explorer.EXE
1268 Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	1688	NEW ORDER_pdf.exe
Token: SeDebugPrivilege	1096	chkdsk.exe

pid	process
1268	Explorer.EXE
1268	Explorer.EXE
1268	Explorer.EXE
1268	Explorer.EXE

pid	process
1268	Explorer.EXE
1268	Explorer.EXE
1268	Explorer.EXE
1268	Explorer.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

NEW ORDER_pdf.exeExplorer.EXEchkdsk.exe

description	pid	process	target process
PID 1744 wrote to memory of 1688	1744	NEW ORDER_pdf.exe	NEW ORDER_pdf.exe
PID 1744 wrote to memory of 1688	1744	NEW ORDER_pdf.exe	NEW ORDER_pdf.exe
PID 1744 wrote to memory of 1688	1744	NEW ORDER_pdf.exe	NEW ORDER_pdf.exe
PID 1744 wrote to memory of 1688	1744	NEW ORDER_pdf.exe	NEW ORDER_pdf.exe
PID 1744 wrote to memory of 1688	1744	NEW ORDER_pdf.exe	NEW ORDER_pdf.exe
PID 1744 wrote to memory of 1688	1744	NEW ORDER_pdf.exe	NEW ORDER_pdf.exe
PID 1744 wrote to memory of 1688	1744	NEW ORDER_pdf.exe	NEW ORDER_pdf.exe
PID 1268 wrote to memory of 1096	1268	Explorer.EXE	chkdsk.exe
PID 1268 wrote to memory of 1096	1268	Explorer.EXE	chkdsk.exe
PID 1268 wrote to memory of 1096	1268	Explorer.EXE	chkdsk.exe
PID 1268 wrote to memory of 1096	1268	Explorer.EXE	chkdsk.exe
PID 1096 wrote to memory of 592	1096	chkdsk.exe	cmd.exe
PID 1096 wrote to memory of 592	1096	chkdsk.exe	cmd.exe
PID 1096 wrote to memory of 592	1096	chkdsk.exe	cmd.exe
PID 1096 wrote to memory of 592	1096	chkdsk.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1268

C:\Users\Admin\AppData\Local\Temp\NEW ORDER_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\NEW ORDER_pdf.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1744

C:\Users\Admin\AppData\Local\Temp\NEW ORDER_pdf.exe
"{path}"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1688

C:\Windows\SysWOW64\chkdsk.exe
"C:\Windows\SysWOW64\chkdsk.exe"
2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1096

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\NEW ORDER_pdf.exe"
3⤵
- Deletes itself
PID:592

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/592-11-0x0000000000000000-mapping.dmp

Download
memory/1096-9-0x0000000000000000-mapping.dmp

Download
memory/1096-10-0x0000000000D40000-0x0000000000D47000-memory.dmp

Filesize
28KB

Download
memory/1096-12-0x0000000000B50000-0x0000000000C28000-memory.dmp

Filesize
864KB

Download
memory/1688-7-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1688-8-0x000000000041EBD0-mapping.dmp

Download
memory/1744-2-0x00000000741A0000-0x000000007488E000-memory.dmp

Filesize
6.9MB

Download
memory/1744-3-0x0000000000FA0000-0x0000000000FA1000-memory.dmp

Filesize
4KB

Download
memory/1744-5-0x0000000000670000-0x000000000067E000-memory.dmp

Filesize
56KB

Download
memory/1744-6-0x0000000005040000-0x00000000050C0000-memory.dmp

Filesize
512KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads