formbook | 726a3798f80c7e482b512dc777bc692965136190990a5fed138934a546944121

General

Target

f6e56a72afa365ae2b4018648e048940.exe
Size

226KB
MD5

f6e56a72afa365ae2b4018648e048940
SHA1

9e9a454762c2ecfc6326efadd83128bf3b49aca8
SHA256

726a3798f80c7e482b512dc777bc692965136190990a5fed138934a546944121
SHA512

4836dcac298fe32f4c856749bfc2dd2dfcb69ec63724cf014c55929b11b42128cac95e69a360ced1f7d0a22f403e3ab62180de76e22c718d543a0796eada727f

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

C2

http://www.shoprodeovegas.com/xcl/

Decoy

sewingtherose.com

thesmartshareholder.com

afasyah.com

marolamusic.com

lookupgeorgina.com

plataforyou.com

dijcan.com

pawtyparcels.com

interprediction.com

fairerfinancehackathon.net

thehmnshop.com

jocelynlopez.com

launcheffecthouston.com

joyeveryminute.com

spyforu.com

ronerasanjuan.com

gadgetsdesi.com

nmrconsultants.com

travellpod.com

ballparksportscards.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3216-117-0x0000000000400000-0x000000000042E000-memory.dmp	formbook

Loads dropped DLL 1 IoCs

Processes:

f6e56a72afa365ae2b4018648e048940.exe

pid process

860 f6e56a72afa365ae2b4018648e048940.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

f6e56a72afa365ae2b4018648e048940.exe

description pid process target process

PID 860 set thread context of 3216 860 f6e56a72afa365ae2b4018648e048940.exe f6e56a72afa365ae2b4018648e048940.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

f6e56a72afa365ae2b4018648e048940.exe

pid process

3216 f6e56a72afa365ae2b4018648e048940.exe
3216 f6e56a72afa365ae2b4018648e048940.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

f6e56a72afa365ae2b4018648e048940.exe

pid process

860 f6e56a72afa365ae2b4018648e048940.exe

pid	process
860	f6e56a72afa365ae2b4018648e048940.exe

description	pid	process	target process
PID 860 set thread context of 3216	860	f6e56a72afa365ae2b4018648e048940.exe	f6e56a72afa365ae2b4018648e048940.exe

pid	process
3216	f6e56a72afa365ae2b4018648e048940.exe
3216	f6e56a72afa365ae2b4018648e048940.exe

pid	process
860	f6e56a72afa365ae2b4018648e048940.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

f6e56a72afa365ae2b4018648e048940.exe

description	pid	process	target process
PID 860 wrote to memory of 3216	860	f6e56a72afa365ae2b4018648e048940.exe	f6e56a72afa365ae2b4018648e048940.exe
PID 860 wrote to memory of 3216	860	f6e56a72afa365ae2b4018648e048940.exe	f6e56a72afa365ae2b4018648e048940.exe
PID 860 wrote to memory of 3216	860	f6e56a72afa365ae2b4018648e048940.exe	f6e56a72afa365ae2b4018648e048940.exe
PID 860 wrote to memory of 3216	860	f6e56a72afa365ae2b4018648e048940.exe	f6e56a72afa365ae2b4018648e048940.exe

C:\Users\Admin\AppData\Local\Temp\f6e56a72afa365ae2b4018648e048940.exe
"C:\Users\Admin\AppData\Local\Temp\f6e56a72afa365ae2b4018648e048940.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:860

C:\Users\Admin\AppData\Local\Temp\f6e56a72afa365ae2b4018648e048940.exe
"C:\Users\Admin\AppData\Local\Temp\f6e56a72afa365ae2b4018648e048940.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3216

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsh9958.tmp\tvjy7oe88s7.dll
MD5
461366c30c8d7869834ae3c80c70c831

SHA1
f87c4af01a7130dcf0b6ed060b58dcf02af15b09

SHA256
fb7d1bac5c557b31f902a51dce8ad460b0bcb41a5bf5953b4b14a0c606abb544

SHA512
cb2d3e4e418a755604c63ec5558d9cb0e49f4cdf88289a6e22630a6c217d074732ec4c8c55e780892b86c5c10e9ac33b3da34537607549d09a8f3466d56c1069

Download Submit
memory/860-115-0x0000000002380000-0x00000000023A3000-memory.dmp

Filesize
140KB

Download
memory/3216-116-0x000000000041EB70-mapping.dmp

Download
memory/3216-118-0x00000000009F0000-0x0000000000D10000-memory.dmp

Filesize
3.1MB

Download
memory/3216-117-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download

Analysis

Sharing