formbook | ea8f1768c5f29a532d0c2a0d94991a4bf6d49fba87806efc4f333354fe1627f0

General

Target

RFQ_Cicor_012.exe
Size

968KB
MD5

27b5fcbd6865ea65fe7840f2557ae1de
SHA1

42ded4a3e5e2e21b1f596aae2174389ea29d255c
SHA256

36533f5c6cd7b6cf7e1c4cdfce1b185a9059a7fb0cc98ad1fdcbf11b54bb9fda
SHA512

a573affcbfbd1e82f106f0f6b36fa4dd7d27f29a513f5476ef1c9d44fb27b577203e29142dde17d4843a5fc4417d4c47b855f0a60f73d37b0ec5f44c920c3ebf

Score

10^/10

formbook rat spyware stealer suricata trojan

Malware Config

Extracted

Family

formbook

Version

4.1

C2

http://www.radissonhotelsusa.com/cp5/

Decoy

glcpunix.com

marabierta-coaching.com

osrs-remastered.com

lineagehealthxwellness.com

dunyadagezilecekyerler.com

negociosyfinanzasfaciles.com

bifa510.com

houseofutamasa.com

dopeneeds.com

sailacc.com

thewindgallery.com

elvinrisky.com

flowersassistedliving.com

lzbnwy.com

mrpentester.com

joinmytradingteam.com

jasabuatvisa.com

meherunnessa-foundation.com

notyourtypicaljocks.com

lobo-sports.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3688-126-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral2/memory/3688-127-0x000000000041EBF0-mapping.dmp	formbook
behavioral2/memory/3984-133-0x00000000001B0000-0x00000000001DE000-memory.dmp	formbook

Suspicious use of SetThreadContext 3 IoCs

Processes:

RFQ_Cicor_012.exeRFQ_Cicor_012.execscript.exe

description	pid	process	target process
PID 656 set thread context of 3688	656	RFQ_Cicor_012.exe	RFQ_Cicor_012.exe
PID 3688 set thread context of 3020	3688	RFQ_Cicor_012.exe	Explorer.EXE
PID 3984 set thread context of 3020	3984	cscript.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3940 schtasks.exe

pid	process
3940	schtasks.exe

Suspicious behavior: EnumeratesProcesses 39 IoCs

Processes:

RFQ_Cicor_012.exeRFQ_Cicor_012.execscript.exe

pid	process
656	RFQ_Cicor_012.exe
3688	RFQ_Cicor_012.exe
3688	RFQ_Cicor_012.exe
3688	RFQ_Cicor_012.exe
3688	RFQ_Cicor_012.exe
3984	cscript.exe
3984	cscript.exe
3984	cscript.exe
3984	cscript.exe
3984	cscript.exe
3984	cscript.exe
3984	cscript.exe
3984	cscript.exe
3984	cscript.exe
3984	cscript.exe
3984	cscript.exe
3984	cscript.exe
3984	cscript.exe
3984	cscript.exe
3984	cscript.exe
3984	cscript.exe
3984	cscript.exe
3984	cscript.exe
3984	cscript.exe
3984	cscript.exe
3984	cscript.exe
3984	cscript.exe
3984	cscript.exe
3984	cscript.exe
3984	cscript.exe
3984	cscript.exe
3984	cscript.exe
3984	cscript.exe
3984	cscript.exe
3984	cscript.exe
3984	cscript.exe
3984	cscript.exe
3984	cscript.exe
3984	cscript.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

3020 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

RFQ_Cicor_012.execscript.exe

pid process

3688 RFQ_Cicor_012.exe
3688 RFQ_Cicor_012.exe
3688 RFQ_Cicor_012.exe
3984 cscript.exe
3984 cscript.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

RFQ_Cicor_012.exeRFQ_Cicor_012.execscript.exe

description pid process

Token: SeDebugPrivilege 656 RFQ_Cicor_012.exe
Token: SeDebugPrivilege 3688 RFQ_Cicor_012.exe
Token: SeDebugPrivilege 3984 cscript.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

3020 Explorer.EXE

pid	process
3020	Explorer.EXE

pid	process
3688	RFQ_Cicor_012.exe
3688	RFQ_Cicor_012.exe
3688	RFQ_Cicor_012.exe
3984	cscript.exe
3984	cscript.exe

description	pid	process
Token: SeDebugPrivilege	656	RFQ_Cicor_012.exe
Token: SeDebugPrivilege	3688	RFQ_Cicor_012.exe
Token: SeDebugPrivilege	3984	cscript.exe

pid	process
3020	Explorer.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

RFQ_Cicor_012.exeExplorer.EXEcscript.exe

description	pid	process	target process
PID 656 wrote to memory of 3940	656	RFQ_Cicor_012.exe	schtasks.exe
PID 656 wrote to memory of 3940	656	RFQ_Cicor_012.exe	schtasks.exe
PID 656 wrote to memory of 3940	656	RFQ_Cicor_012.exe	schtasks.exe
PID 656 wrote to memory of 3688	656	RFQ_Cicor_012.exe	RFQ_Cicor_012.exe
PID 656 wrote to memory of 3688	656	RFQ_Cicor_012.exe	RFQ_Cicor_012.exe
PID 656 wrote to memory of 3688	656	RFQ_Cicor_012.exe	RFQ_Cicor_012.exe
PID 656 wrote to memory of 3688	656	RFQ_Cicor_012.exe	RFQ_Cicor_012.exe
PID 656 wrote to memory of 3688	656	RFQ_Cicor_012.exe	RFQ_Cicor_012.exe
PID 656 wrote to memory of 3688	656	RFQ_Cicor_012.exe	RFQ_Cicor_012.exe
PID 3020 wrote to memory of 3984	3020	Explorer.EXE	cscript.exe
PID 3020 wrote to memory of 3984	3020	Explorer.EXE	cscript.exe
PID 3020 wrote to memory of 3984	3020	Explorer.EXE	cscript.exe
PID 3984 wrote to memory of 3876	3984	cscript.exe	cmd.exe
PID 3984 wrote to memory of 3876	3984	cscript.exe	cmd.exe
PID 3984 wrote to memory of 3876	3984	cscript.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3020

C:\Users\Admin\AppData\Local\Temp\RFQ_Cicor_012.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ_Cicor_012.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:656

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\okSIfG" /XML "C:\Users\Admin\AppData\Local\Temp\tmp44CA.tmp"
3⤵
- Creates scheduled task(s)
PID:3940

C:\Users\Admin\AppData\Local\Temp\RFQ_Cicor_012.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ_Cicor_012.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3688

C:\Windows\SysWOW64\cscript.exe
"C:\Windows\SysWOW64\cscript.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3984

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\RFQ_Cicor_012.exe"
3⤵
PID:3876

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp44CA.tmp
MD5
3042dd1a1bedb553cf426b517bb81fd0

SHA1
f7570c43a96bffbce452cf8bf1a72fd73db8af94

SHA256
5793f49a45a839dcc890addaa36f07c93d5ddb95cb6d3c850d329a62fae6a0c9

SHA512
9f5fb03900353c9ca25623f53538d79b9cbcf8915a88957d373262901518c02a9334fef6bc0ab8129550ef1dda7183c370397c2392fcefdbd1293aedbc163d34

Download Submit
memory/656-120-0x0000000003300000-0x0000000003301000-memory.dmp

Filesize
4KB

Download
memory/656-118-0x0000000005960000-0x0000000005961000-memory.dmp

Filesize
4KB

Download
memory/656-117-0x0000000005E60000-0x0000000005E61000-memory.dmp

Filesize
4KB

Download
memory/656-119-0x0000000005960000-0x0000000005E5E000-memory.dmp

Filesize
5.0MB

Download
memory/656-114-0x0000000000EF0000-0x0000000000EF1000-memory.dmp

Filesize
4KB

Download
memory/656-121-0x0000000005AC0000-0x0000000005AC1000-memory.dmp

Filesize
4KB

Download
memory/656-122-0x0000000005B20000-0x0000000005B43000-memory.dmp

Filesize
140KB

Download
memory/656-123-0x00000000066E0000-0x000000000674D000-memory.dmp

Filesize
436KB

Download
memory/656-116-0x00000000058C0000-0x00000000058C1000-memory.dmp

Filesize
4KB

Download
memory/3020-137-0x0000000006530000-0x0000000006636000-memory.dmp

Filesize
1.0MB

Download
memory/3020-130-0x0000000005EC0000-0x000000000602A000-memory.dmp

Filesize
1.4MB

Download
memory/3688-127-0x000000000041EBF0-mapping.dmp

Download
memory/3688-126-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3688-128-0x00000000013A0000-0x00000000016C0000-memory.dmp

Filesize
3.1MB

Download
memory/3688-129-0x00000000016E0000-0x00000000016F4000-memory.dmp

Filesize
80KB

Download
memory/3876-134-0x0000000000000000-mapping.dmp

Download
memory/3940-124-0x0000000000000000-mapping.dmp

Download
memory/3984-133-0x00000000001B0000-0x00000000001DE000-memory.dmp

Filesize
184KB

Download
memory/3984-132-0x0000000000BC0000-0x0000000000BE7000-memory.dmp

Filesize
156KB

Download
memory/3984-135-0x0000000004720000-0x0000000004A40000-memory.dmp

Filesize
3.1MB

Download
memory/3984-136-0x00000000045A0000-0x0000000004633000-memory.dmp

Filesize
588KB

Download
memory/3984-131-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads