formbook | 38acc90cd6d33b61b99cca8cf06781e1bd2ab8ffebc3a33e036eca36037d413b

General

Target

PO_210223.exe
Size

783KB
MD5

e40af9745e938b72d5d860bbc679aebf
SHA1

d9e750061417b0ca9f933db79c99c12934abbe84
SHA256

38acc90cd6d33b61b99cca8cf06781e1bd2ab8ffebc3a33e036eca36037d413b
SHA512

2124a0cb2135bfc5731554aaa534e6ba9063137450e5df18a56c8dd661d8d926278c1d658f1aef44d3522598e047f4735ca5a06cef41be3593101a089f3494ba

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.000666dy.com/ntg/

Decoy

successwithyolandafgreen.com

theordinaryph.com

atamyo-therapeutics.com

pophazard.com

anthonyfultz.com

pasanglham.com

kanekhushi.com

littlefishyswim.com

kaieteurny.com

fanavartima.com

digexpo.com

se-rto.com

chaos.finance

bakldx.com

after-school.pro

faithfromphilly.com

estudiomuradian.com

albertocerasini.com

andronna.com

wingspotusa.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/940-10-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/940-11-0x000000000041EB00-mapping.dmp	formbook
behavioral1/memory/808-20-0x0000000000090000-0x00000000000BE000-memory.dmp	formbook

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1044 cmd.exe

pid	process
1044	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

PO_210223.exePO_210223.exerundll32.exe

description	pid	process	target process
PID 776 set thread context of 940	776	PO_210223.exe	PO_210223.exe
PID 940 set thread context of 1248	940	PO_210223.exe	Explorer.EXE
PID 808 set thread context of 1248	808	rundll32.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

756 schtasks.exe

pid	process
756	schtasks.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

PO_210223.exePO_210223.exerundll32.exe

pid	process
776	PO_210223.exe
940	PO_210223.exe
940	PO_210223.exe
808	rundll32.exe
808	rundll32.exe
808	rundll32.exe
808	rundll32.exe
808	rundll32.exe
808	rundll32.exe
808	rundll32.exe
808	rundll32.exe

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

PO_210223.exerundll32.exe

pid process

940 PO_210223.exe
940 PO_210223.exe
940 PO_210223.exe
808 rundll32.exe
808 rundll32.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

PO_210223.exePO_210223.exerundll32.exe

description pid process

Token: SeDebugPrivilege 776 PO_210223.exe
Token: SeDebugPrivilege 940 PO_210223.exe
Token: SeDebugPrivilege 808 rundll32.exe

pid	process
940	PO_210223.exe
940	PO_210223.exe
940	PO_210223.exe
808	rundll32.exe
808	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	776	PO_210223.exe
Token: SeDebugPrivilege	940	PO_210223.exe
Token: SeDebugPrivilege	808	rundll32.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

PO_210223.exeExplorer.EXErundll32.exe

description	pid	process	target process
PID 776 wrote to memory of 756	776	PO_210223.exe	schtasks.exe
PID 776 wrote to memory of 756	776	PO_210223.exe	schtasks.exe
PID 776 wrote to memory of 756	776	PO_210223.exe	schtasks.exe
PID 776 wrote to memory of 756	776	PO_210223.exe	schtasks.exe
PID 776 wrote to memory of 940	776	PO_210223.exe	PO_210223.exe
PID 776 wrote to memory of 940	776	PO_210223.exe	PO_210223.exe
PID 776 wrote to memory of 940	776	PO_210223.exe	PO_210223.exe
PID 776 wrote to memory of 940	776	PO_210223.exe	PO_210223.exe
PID 776 wrote to memory of 940	776	PO_210223.exe	PO_210223.exe
PID 776 wrote to memory of 940	776	PO_210223.exe	PO_210223.exe
PID 776 wrote to memory of 940	776	PO_210223.exe	PO_210223.exe
PID 1248 wrote to memory of 808	1248	Explorer.EXE	rundll32.exe
PID 1248 wrote to memory of 808	1248	Explorer.EXE	rundll32.exe
PID 1248 wrote to memory of 808	1248	Explorer.EXE	rundll32.exe
PID 1248 wrote to memory of 808	1248	Explorer.EXE	rundll32.exe
PID 1248 wrote to memory of 808	1248	Explorer.EXE	rundll32.exe
PID 1248 wrote to memory of 808	1248	Explorer.EXE	rundll32.exe
PID 1248 wrote to memory of 808	1248	Explorer.EXE	rundll32.exe
PID 808 wrote to memory of 1044	808	rundll32.exe	cmd.exe
PID 808 wrote to memory of 1044	808	rundll32.exe	cmd.exe
PID 808 wrote to memory of 1044	808	rundll32.exe	cmd.exe
PID 808 wrote to memory of 1044	808	rundll32.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:1248

C:\Users\Admin\AppData\Local\Temp\PO_210223.exe
"C:\Users\Admin\AppData\Local\Temp\PO_210223.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:776

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kwqifureL" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9A3D.tmp"
3⤵
- Creates scheduled task(s)
PID:756

C:\Users\Admin\AppData\Local\Temp\PO_210223.exe
"C:\Users\Admin\AppData\Local\Temp\PO_210223.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:940

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\SysWOW64\rundll32.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:808

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\PO_210223.exe"
3⤵
- Deletes itself
PID:1044

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp9A3D.tmp
MD5
5ae1d660778061fd8b56a7d6ba2652c1

SHA1
33a384a12f903bb9a8cdbc5f87e943210ef6102e

SHA256
b0a9de0ad72a7b298afa4b7514d103fd9bfbe5ac348a9f79dcdc0040f6647b18

SHA512
48e5734c814429c3ab40715830455f41e3c291257f2aa76e72df3e7ba70ec78521f7daf83deed4608dd6604b076b4f01d500c08e9c691877dc944911f629e830

Download Submit
memory/756-8-0x0000000000000000-mapping.dmp

Download
memory/776-2-0x0000000073D40000-0x000000007442E000-memory.dmp

Filesize
6.9MB

Download
memory/776-3-0x0000000001010000-0x0000000001011000-memory.dmp

Filesize
4KB

Download
memory/776-5-0x00000000072D0000-0x00000000072D1000-memory.dmp

Filesize
4KB

Download
memory/776-6-0x00000000003D0000-0x00000000003D3000-memory.dmp

Filesize
12KB

Download
memory/776-7-0x00000000074E0000-0x0000000007535000-memory.dmp

Filesize
340KB

Download
memory/808-16-0x0000000000000000-mapping.dmp

Download
memory/808-17-0x0000000075C61000-0x0000000075C63000-memory.dmp

Filesize
8KB

Download
memory/808-19-0x0000000000960000-0x000000000096E000-memory.dmp

Filesize
56KB

Download
memory/808-20-0x0000000000090000-0x00000000000BE000-memory.dmp

Filesize
184KB

Download
memory/808-21-0x0000000002360000-0x0000000002663000-memory.dmp

Filesize
3.0MB

Download
memory/808-22-0x0000000002040000-0x00000000020D3000-memory.dmp

Filesize
588KB

Download
memory/940-11-0x000000000041EB00-mapping.dmp

Download
memory/940-13-0x00000000009E0000-0x0000000000CE3000-memory.dmp

Filesize
3.0MB

Download
memory/940-14-0x0000000000140000-0x0000000000154000-memory.dmp

Filesize
80KB

Download
memory/940-10-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1044-18-0x0000000000000000-mapping.dmp

Download
memory/1248-15-0x0000000004B50000-0x0000000004CBF000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads