formbook | 968217dc7ec661ccf8ed591f1e45815502ef082b4c16eb6da0daa4f24698a0e3

General

Target

RBIDFTCRADVICE_21012814480386259994,pdf.exe
Size

1.0MB
MD5

192241c16894f7c1a1f74ae037807bbb
SHA1

f4089d984924a4bd5dfd4c72190043d23de24706
SHA256

a9989788c3001149521eb7c42b65c8bffedb52efb1f6e4e08e001b3fe3af90e4
SHA512

bc20dbf398c02dc33fb097db57b51ec202bc0753700df3109518ff4ece2205ea6677f11153cbb562e4b42db45ba373ef1afc6123e2c540a016d9897c0a3182b3

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

C2

http://www.radissonhotelsusa.com/cp5/

Decoy

glcpunix.com

marabierta-coaching.com

osrs-remastered.com

lineagehealthxwellness.com

dunyadagezilecekyerler.com

negociosyfinanzasfaciles.com

bifa510.com

houseofutamasa.com

dopeneeds.com

sailacc.com

thewindgallery.com

elvinrisky.com

flowersassistedliving.com

lzbnwy.com

mrpentester.com

joinmytradingteam.com

jasabuatvisa.com

meherunnessa-foundation.com

notyourtypicaljocks.com

lobo-sports.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

Processes:

resource	yara_rule
behavioral1/memory/1564-61-0x0000000000360000-0x0000000000363000-memory.dmp	CustAttr

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/696-66-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/696-67-0x000000000041EBF0-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

RBIDFTCRADVICE_21012814480386259994,pdf.exe

description	pid	process	target process
PID 1564 set thread context of 696	1564	RBIDFTCRADVICE_21012814480386259994,pdf.exe	RBIDFTCRADVICE_21012814480386259994,pdf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1056 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RBIDFTCRADVICE_21012814480386259994,pdf.exeRBIDFTCRADVICE_21012814480386259994,pdf.exe

pid process

1564 RBIDFTCRADVICE_21012814480386259994,pdf.exe
696 RBIDFTCRADVICE_21012814480386259994,pdf.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RBIDFTCRADVICE_21012814480386259994,pdf.exe

description pid process

Token: SeDebugPrivilege 1564 RBIDFTCRADVICE_21012814480386259994,pdf.exe

pid	process
1056	schtasks.exe

pid	process
1564	RBIDFTCRADVICE_21012814480386259994,pdf.exe
696	RBIDFTCRADVICE_21012814480386259994,pdf.exe

description	pid	process
Token: SeDebugPrivilege	1564	RBIDFTCRADVICE_21012814480386259994,pdf.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

RBIDFTCRADVICE_21012814480386259994,pdf.exe

description	pid	process	target process
PID 1564 wrote to memory of 1056	1564	RBIDFTCRADVICE_21012814480386259994,pdf.exe	schtasks.exe
PID 1564 wrote to memory of 1056	1564	RBIDFTCRADVICE_21012814480386259994,pdf.exe	schtasks.exe
PID 1564 wrote to memory of 1056	1564	RBIDFTCRADVICE_21012814480386259994,pdf.exe	schtasks.exe
PID 1564 wrote to memory of 1056	1564	RBIDFTCRADVICE_21012814480386259994,pdf.exe	schtasks.exe
PID 1564 wrote to memory of 696	1564	RBIDFTCRADVICE_21012814480386259994,pdf.exe	RBIDFTCRADVICE_21012814480386259994,pdf.exe
PID 1564 wrote to memory of 696	1564	RBIDFTCRADVICE_21012814480386259994,pdf.exe	RBIDFTCRADVICE_21012814480386259994,pdf.exe
PID 1564 wrote to memory of 696	1564	RBIDFTCRADVICE_21012814480386259994,pdf.exe	RBIDFTCRADVICE_21012814480386259994,pdf.exe
PID 1564 wrote to memory of 696	1564	RBIDFTCRADVICE_21012814480386259994,pdf.exe	RBIDFTCRADVICE_21012814480386259994,pdf.exe
PID 1564 wrote to memory of 696	1564	RBIDFTCRADVICE_21012814480386259994,pdf.exe	RBIDFTCRADVICE_21012814480386259994,pdf.exe
PID 1564 wrote to memory of 696	1564	RBIDFTCRADVICE_21012814480386259994,pdf.exe	RBIDFTCRADVICE_21012814480386259994,pdf.exe
PID 1564 wrote to memory of 696	1564	RBIDFTCRADVICE_21012814480386259994,pdf.exe	RBIDFTCRADVICE_21012814480386259994,pdf.exe

C:\Users\Admin\AppData\Local\Temp\RBIDFTCRADVICE_21012814480386259994,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\RBIDFTCRADVICE_21012814480386259994,pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1564

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sCPgTFqFtL" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEB39.tmp"
2⤵
- Creates scheduled task(s)
PID:1056

C:\Users\Admin\AppData\Local\Temp\RBIDFTCRADVICE_21012814480386259994,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\RBIDFTCRADVICE_21012814480386259994,pdf.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:696

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpEB39.tmp
MD5
b0abb7e0b317d159a6402fd832858ee2

SHA1
64fd2ecda33fd216d22fdeb492ca70f7d5b1a963

SHA256
7eab20d31ed0e1abff4268a677f37d0b226be05adac330621eda047bd7f10048

SHA512
3a3f67146d766228616e41650f096a98df1bb13e96ce6b25627d21f797f890e8f9c4c2270390bc448776c1b3762babd13c53cec1fb2f2f47fc406a4c940a30bb

Download Submit
memory/696-66-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/696-67-0x000000000041EBF0-mapping.dmp

Download
memory/696-68-0x0000000000930000-0x0000000000C33000-memory.dmp

Filesize
3.0MB

Download
memory/1056-64-0x0000000000000000-mapping.dmp

Download
memory/1564-59-0x0000000000D70000-0x0000000000D71000-memory.dmp

Filesize
4KB

Download
memory/1564-61-0x0000000000360000-0x0000000000363000-memory.dmp

Filesize
12KB

Download
memory/1564-62-0x0000000004D80000-0x0000000004D81000-memory.dmp

Filesize
4KB

Download
memory/1564-63-0x0000000005440000-0x00000000054D3000-memory.dmp

Filesize
588KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads