formbook | f6a1cf040ecee307e3e5289f73b27664e33db21aaac5142e89b2a956934ae0c9

General

Target

PO210119.exe
Size

1.5MB
MD5

b074bc8cc313c6fcafe448ae189de963
SHA1

427ad90e6f9e40c447a66dedb344c788764cbf92
SHA256

f6a1cf040ecee307e3e5289f73b27664e33db21aaac5142e89b2a956934ae0c9
SHA512

86067908dc9e432cb6362e1925d0aa5e57cde258d5c4dfb724a8e1dde9a273b1062e2a37d1ee82ea10ed08f7f20619ed96f5df6cad81c90d0757fd7d055b371a

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.midnightblueinc.com/2kf/

Decoy

edmondscakes.com

doublewldr.online

tickets2usa.com

heyhxry.com

weightloss-gulfport.com

prosselius.com

newviewroofers.com

jacksonarearealestate.com

catparkas.xyz

pagos2020.com

sonwsefjrahi.online

franchisethings.com

nuocvietngaynay.com

sohelvai.com

mikeyroush.com

lamesaroofing.com

betbigo138.com

amazon-service-recovery.com

clockin.net

riostrader.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/352-15-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral2/memory/352-16-0x000000000041EB30-mapping.dmp	formbook
behavioral2/memory/1112-23-0x0000000000500000-0x000000000052E000-memory.dmp	formbook

Suspicious use of SetThreadContext 3 IoCs

Processes:

PO210119.exePO210119.execscript.exe

description	pid	process	target process
PID 4776 set thread context of 352	4776	PO210119.exe	PO210119.exe
PID 352 set thread context of 2576	352	PO210119.exe	Explorer.EXE
PID 1112 set thread context of 2576	1112	cscript.exe	Explorer.EXE

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

648 schtasks.exe

pid	process
648	schtasks.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

Processes:

PO210119.exePO210119.execscript.exe

pid	process
4776	PO210119.exe
352	PO210119.exe
352	PO210119.exe
352	PO210119.exe
352	PO210119.exe
1112	cscript.exe
1112	cscript.exe
1112	cscript.exe
1112	cscript.exe
1112	cscript.exe
1112	cscript.exe
1112	cscript.exe
1112	cscript.exe
1112	cscript.exe
1112	cscript.exe
1112	cscript.exe
1112	cscript.exe
1112	cscript.exe
1112	cscript.exe
1112	cscript.exe
1112	cscript.exe
1112	cscript.exe
1112	cscript.exe
1112	cscript.exe
1112	cscript.exe
1112	cscript.exe
1112	cscript.exe
1112	cscript.exe
1112	cscript.exe
1112	cscript.exe
1112	cscript.exe
1112	cscript.exe
1112	cscript.exe
1112	cscript.exe
1112	cscript.exe
1112	cscript.exe
1112	cscript.exe
1112	cscript.exe
1112	cscript.exe
1112	cscript.exe
1112	cscript.exe

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

PO210119.execscript.exe

pid process

352 PO210119.exe
352 PO210119.exe
352 PO210119.exe
1112 cscript.exe
1112 cscript.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

PO210119.exePO210119.execscript.exe

description pid process

Token: SeDebugPrivilege 4776 PO210119.exe
Token: SeDebugPrivilege 352 PO210119.exe
Token: SeDebugPrivilege 1112 cscript.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

2576 Explorer.EXE

pid	process
352	PO210119.exe
352	PO210119.exe
352	PO210119.exe
1112	cscript.exe
1112	cscript.exe

description	pid	process
Token: SeDebugPrivilege	4776	PO210119.exe
Token: SeDebugPrivilege	352	PO210119.exe
Token: SeDebugPrivilege	1112	cscript.exe

pid	process
2576	Explorer.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

PO210119.exeExplorer.EXEcscript.exe

description	pid	process	target process
PID 4776 wrote to memory of 648	4776	PO210119.exe	schtasks.exe
PID 4776 wrote to memory of 648	4776	PO210119.exe	schtasks.exe
PID 4776 wrote to memory of 648	4776	PO210119.exe	schtasks.exe
PID 4776 wrote to memory of 352	4776	PO210119.exe	PO210119.exe
PID 4776 wrote to memory of 352	4776	PO210119.exe	PO210119.exe
PID 4776 wrote to memory of 352	4776	PO210119.exe	PO210119.exe
PID 4776 wrote to memory of 352	4776	PO210119.exe	PO210119.exe
PID 4776 wrote to memory of 352	4776	PO210119.exe	PO210119.exe
PID 4776 wrote to memory of 352	4776	PO210119.exe	PO210119.exe
PID 2576 wrote to memory of 1112	2576	Explorer.EXE	cscript.exe
PID 2576 wrote to memory of 1112	2576	Explorer.EXE	cscript.exe
PID 2576 wrote to memory of 1112	2576	Explorer.EXE	cscript.exe
PID 1112 wrote to memory of 1316	1112	cscript.exe	cmd.exe
PID 1112 wrote to memory of 1316	1112	cscript.exe	cmd.exe
PID 1112 wrote to memory of 1316	1112	cscript.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2576

C:\Users\Admin\AppData\Local\Temp\PO210119.exe
"C:\Users\Admin\AppData\Local\Temp\PO210119.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4776

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uczynErOwa" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2D2B.tmp"
3⤵
- Creates scheduled task(s)
PID:648

C:\Users\Admin\AppData\Local\Temp\PO210119.exe
"C:\Users\Admin\AppData\Local\Temp\PO210119.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:352

C:\Windows\SysWOW64\cscript.exe
"C:\Windows\SysWOW64\cscript.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1112

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\PO210119.exe"
3⤵
PID:1316

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp2D2B.tmp

MD5
d65ab615b084b155075053fe6dbc88ed

SHA1
236d39c3520a6331f467ee887efe91d3b068e60f

SHA256
2d583dfdc3be84b2ba93d502cadffb678464c9733fada51273cfcd23afe968d6

SHA512
e89f8346459d0b59d234d195ca139394bd10d4131df9e7ba47a09957249551b4beb2cf550c86c5ef534ee80d085777248d24f59f074042c630fe094301d14b20

Download Submit
memory/352-18-0x00000000018F0000-0x0000000001C10000-memory.dmp

Filesize
3.1MB

Download
memory/352-19-0x00000000018B0000-0x00000000018C4000-memory.dmp

Filesize
80KB

Download
memory/352-16-0x000000000041EB30-mapping.dmp

Download
memory/352-15-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/648-13-0x0000000000000000-mapping.dmp

Download
memory/1112-22-0x0000000000A60000-0x0000000000A87000-memory.dmp

Filesize
156KB

Download
memory/1112-21-0x0000000000000000-mapping.dmp

Download
memory/1112-26-0x0000000002B90000-0x0000000002C23000-memory.dmp

Filesize
588KB

Download
memory/1112-25-0x0000000004760000-0x0000000004A80000-memory.dmp

Filesize
3.1MB

Download
memory/1112-23-0x0000000000500000-0x000000000052E000-memory.dmp

Filesize
184KB

Download
memory/1316-24-0x0000000000000000-mapping.dmp

Download
memory/2576-20-0x0000000004E00000-0x0000000004F12000-memory.dmp

Filesize
1.1MB

Download
memory/2576-27-0x0000000006520000-0x000000000664B000-memory.dmp

Filesize
1.2MB

Download
memory/4776-6-0x0000000007C40000-0x0000000007C41000-memory.dmp

Filesize
4KB

Download
memory/4776-5-0x00000000076A0000-0x00000000076A1000-memory.dmp

Filesize
4KB

Download
memory/4776-10-0x0000000007780000-0x00000000077A3000-memory.dmp

Filesize
140KB

Download
memory/4776-3-0x0000000000820000-0x0000000000821000-memory.dmp

Filesize
4KB

Download
memory/4776-7-0x00000000077E0000-0x00000000077E1000-memory.dmp

Filesize
4KB

Download
memory/4776-2-0x0000000073360000-0x0000000073A4E000-memory.dmp

Filesize
6.9MB

Download
memory/4776-8-0x0000000007740000-0x0000000007741000-memory.dmp

Filesize
4KB

Download
memory/4776-9-0x0000000007940000-0x0000000007941000-memory.dmp

Filesize
4KB

Download
memory/4776-12-0x00000000084A0000-0x0000000008506000-memory.dmp

Filesize
408KB

Download
memory/4776-11-0x0000000007A60000-0x0000000007A61000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads