formbook | 619a462b761e8188e285d4122fe80ff0c3b2fca9cf491dcb5830a38f03d6610f

General

Target

6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe
Size

674KB
MD5

9fe12cde3aa06a540dd00ef6b182c5d0
SHA1

5b71e9d19292cbd95d455ce778db5d5c86270ab0
SHA256

6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65
SHA512

b223de4772986e3c95c233d49711e538d566527ab7f8b2f0bdbcd75643587ddd6140815c29ff168ea4ab1bd8914053ea697913be81f4d7f37e5e3450a31be465

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

C2

http://www.glittergalsboutique.com/8buc/

Decoy

affiliatetraining101.com

sun5new.com

localstuffunlimited.store

getmrn.com

nipandtucknurse.com

companycreater.com

painfullyperfect.com

3dmobilemammo.com

theredbeegroup.net

loochaan.com

alanoliveiramkt.com

lxwzsh.com

twobookramblers.com

cscardinalmalula.net

hanarzr.com

sabaicp.com

foodprocessmedia.com

tirongroup.com

dcentralizedcloud.com

xn--80abnkzb2a.xn--p1acf

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3148-138-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral2/memory/3148-139-0x000000000041ED80-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe

description	pid	process	target process
PID 800 set thread context of 3148	800	6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe	6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3736 schtasks.exe

pid	process
3736	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exepowershell.exepowershell.exepowershell.exe

pid	process
800	6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe
3148	6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe
2132	powershell.exe
3460	powershell.exe
3148	6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe
3604	powershell.exe
3604	powershell.exe
3460	powershell.exe
2132	powershell.exe
3460	powershell.exe
2132	powershell.exe
3604	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	800	6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe
Token: SeDebugPrivilege	2132	powershell.exe
Token: SeDebugPrivilege	3460	powershell.exe
Token: SeDebugPrivilege	3604	powershell.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe

description	pid	process	target process
PID 800 wrote to memory of 3460	800	6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe	powershell.exe
PID 800 wrote to memory of 3460	800	6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe	powershell.exe
PID 800 wrote to memory of 3460	800	6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe	powershell.exe
PID 800 wrote to memory of 2132	800	6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe	powershell.exe
PID 800 wrote to memory of 2132	800	6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe	powershell.exe
PID 800 wrote to memory of 2132	800	6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe	powershell.exe
PID 800 wrote to memory of 3736	800	6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe	schtasks.exe
PID 800 wrote to memory of 3736	800	6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe	schtasks.exe
PID 800 wrote to memory of 3736	800	6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe	schtasks.exe
PID 800 wrote to memory of 3604	800	6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe	powershell.exe
PID 800 wrote to memory of 3604	800	6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe	powershell.exe
PID 800 wrote to memory of 3604	800	6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe	powershell.exe
PID 800 wrote to memory of 3148	800	6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe	6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe
PID 800 wrote to memory of 3148	800	6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe	6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe
PID 800 wrote to memory of 3148	800	6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe	6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe
PID 800 wrote to memory of 3148	800	6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe	6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe
PID 800 wrote to memory of 3148	800	6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe	6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe
PID 800 wrote to memory of 3148	800	6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe	6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe

C:\Users\Admin\AppData\Local\Temp\6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe
"C:\Users\Admin\AppData\Local\Temp\6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:800

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3460

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\aNSuLti.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2132

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aNSuLti" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6741.tmp"
2⤵
- Creates scheduled task(s)
PID:3736

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\aNSuLti.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3604

C:\Users\Admin\AppData\Local\Temp\6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe
"C:\Users\Admin\AppData\Local\Temp\6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65.bin.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3148

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
MD5
1c19c16e21c97ed42d5beabc93391fc5

SHA1
8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

SHA256
1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

SHA512
7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
694ba3600fa66795969498a572de814b

SHA1
73f2015f2630280f8d3577ffa9d5b93857f1caab

SHA256
990abae10186d847c75c73d77198c72fce08bb396c268e8b1ab0a5172535bb56

SHA512
83b25a45e5cc51063077d53b4feb39da111ca8ab22ce7c2313cadb2d494e3bc50c28ab53ed1235e31077d4d66db7189ebe577c2d7cfa08aa234ab8727dd49a46

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp6741.tmp
MD5
c138621fc93d93f6c39824c18c5a49e3

SHA1
7d93e89642b1cdf1738ebf90f19006f943e5319a

SHA256
c001c8ebd52ec6560f3a2bc44003e8137b9be0e11ac009db9bbf28e156c60dd6

SHA512
d8200756a2350e0c79c98931e05a1213ef927a76fd862d73d9a5d914c36a709de380dd4792e33ac3dc77dcbfe7a730bc87c61b0372d33242993b8ec25984b8a2

Download Submit
memory/800-120-0x0000000004D70000-0x0000000004D71000-memory.dmp

Filesize
4KB

Download
memory/800-117-0x0000000005350000-0x0000000005351000-memory.dmp

Filesize
4KB

Download
memory/800-116-0x0000000004DB0000-0x0000000004DB1000-memory.dmp

Filesize
4KB

Download
memory/800-121-0x0000000005060000-0x0000000005061000-memory.dmp

Filesize
4KB

Download
memory/800-122-0x0000000005200000-0x000000000520E000-memory.dmp

Filesize
56KB

Download
memory/800-123-0x0000000000BA0000-0x0000000000C19000-memory.dmp

Filesize
484KB

Download
memory/800-124-0x0000000000C60000-0x0000000000C95000-memory.dmp

Filesize
212KB

Download
memory/800-114-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/800-118-0x0000000004E50000-0x0000000004E51000-memory.dmp

Filesize
4KB

Download
memory/800-119-0x0000000004E50000-0x000000000534E000-memory.dmp

Filesize
5.0MB

Download
memory/2132-130-0x0000000000000000-mapping.dmp

Download
memory/2132-197-0x0000000007303000-0x0000000007304000-memory.dmp

Filesize
4KB

Download
memory/2132-149-0x0000000007890000-0x0000000007891000-memory.dmp

Filesize
4KB

Download
memory/2132-195-0x000000007E4E0000-0x000000007E4E1000-memory.dmp

Filesize
4KB

Download
memory/2132-144-0x0000000007302000-0x0000000007303000-memory.dmp

Filesize
4KB

Download
memory/2132-142-0x0000000007300000-0x0000000007301000-memory.dmp

Filesize
4KB

Download
memory/3148-138-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3148-139-0x000000000041ED80-mapping.dmp

Download
memory/3148-163-0x0000000001450000-0x0000000001770000-memory.dmp

Filesize
3.1MB

Download
memory/3460-125-0x0000000000000000-mapping.dmp

Download
memory/3460-194-0x000000007ECC0000-0x000000007ECC1000-memory.dmp

Filesize
4KB

Download
memory/3460-152-0x00000000082F0000-0x00000000082F1000-memory.dmp

Filesize
4KB

Download
memory/3460-155-0x0000000008360000-0x0000000008361000-memory.dmp

Filesize
4KB

Download
memory/3460-158-0x0000000008470000-0x0000000008471000-memory.dmp

Filesize
4KB

Download
memory/3460-128-0x0000000005030000-0x0000000005031000-memory.dmp

Filesize
4KB

Download
memory/3460-129-0x0000000007B60000-0x0000000007B61000-memory.dmp

Filesize
4KB

Download
memory/3460-140-0x0000000005080000-0x0000000005081000-memory.dmp

Filesize
4KB

Download
memory/3460-196-0x0000000005083000-0x0000000005084000-memory.dmp

Filesize
4KB

Download
memory/3460-141-0x0000000005082000-0x0000000005083000-memory.dmp

Filesize
4KB

Download
memory/3604-167-0x0000000008400000-0x0000000008401000-memory.dmp

Filesize
4KB

Download
memory/3604-170-0x0000000008350000-0x0000000008351000-memory.dmp

Filesize
4KB

Download
memory/3604-193-0x000000007E880000-0x000000007E881000-memory.dmp

Filesize
4KB

Download
memory/3604-137-0x0000000000000000-mapping.dmp

Download
memory/3604-164-0x0000000007B80000-0x0000000007B81000-memory.dmp

Filesize
4KB

Download
memory/3604-198-0x0000000004883000-0x0000000004884000-memory.dmp

Filesize
4KB

Download
memory/3604-162-0x0000000004882000-0x0000000004883000-memory.dmp

Filesize
4KB

Download
memory/3604-161-0x0000000004880000-0x0000000004881000-memory.dmp

Filesize
4KB

Download
memory/3736-131-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads