formbook | 968217dc7ec661ccf8ed591f1e45815502ef082b4c16eb6da0daa4f24698a0e3

General

Target

RBIDFTCRADVICE_21012814480386259994,pdf.exe
Size

1.0MB
MD5

192241c16894f7c1a1f74ae037807bbb
SHA1

f4089d984924a4bd5dfd4c72190043d23de24706
SHA256

a9989788c3001149521eb7c42b65c8bffedb52efb1f6e4e08e001b3fe3af90e4
SHA512

bc20dbf398c02dc33fb097db57b51ec202bc0753700df3109518ff4ece2205ea6677f11153cbb562e4b42db45ba373ef1afc6123e2c540a016d9897c0a3182b3

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

C2

http://www.radissonhotelsusa.com/cp5/

Decoy

glcpunix.com

marabierta-coaching.com

osrs-remastered.com

lineagehealthxwellness.com

dunyadagezilecekyerler.com

negociosyfinanzasfaciles.com

bifa510.com

houseofutamasa.com

dopeneeds.com

sailacc.com

thewindgallery.com

elvinrisky.com

flowersassistedliving.com

lzbnwy.com

mrpentester.com

joinmytradingteam.com

jasabuatvisa.com

meherunnessa-foundation.com

notyourtypicaljocks.com

lobo-sports.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

Processes:

resource	yara_rule
behavioral2/memory/2752-121-0x00000000058B0000-0x00000000058B3000-memory.dmp	CustAttr

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3404-126-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral2/memory/3404-127-0x000000000041EBF0-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

RBIDFTCRADVICE_21012814480386259994,pdf.exe

description	pid	process	target process
PID 2752 set thread context of 3404	2752	RBIDFTCRADVICE_21012814480386259994,pdf.exe	RBIDFTCRADVICE_21012814480386259994,pdf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3956 schtasks.exe

pid	process
3956	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

RBIDFTCRADVICE_21012814480386259994,pdf.exeRBIDFTCRADVICE_21012814480386259994,pdf.exe

pid	process
2752	RBIDFTCRADVICE_21012814480386259994,pdf.exe
3404	RBIDFTCRADVICE_21012814480386259994,pdf.exe
3404	RBIDFTCRADVICE_21012814480386259994,pdf.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RBIDFTCRADVICE_21012814480386259994,pdf.exe

description pid process

Token: SeDebugPrivilege 2752 RBIDFTCRADVICE_21012814480386259994,pdf.exe

description	pid	process
Token: SeDebugPrivilege	2752	RBIDFTCRADVICE_21012814480386259994,pdf.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

RBIDFTCRADVICE_21012814480386259994,pdf.exe

description	pid	process	target process
PID 2752 wrote to memory of 3956	2752	RBIDFTCRADVICE_21012814480386259994,pdf.exe	schtasks.exe
PID 2752 wrote to memory of 3956	2752	RBIDFTCRADVICE_21012814480386259994,pdf.exe	schtasks.exe
PID 2752 wrote to memory of 3956	2752	RBIDFTCRADVICE_21012814480386259994,pdf.exe	schtasks.exe
PID 2752 wrote to memory of 3404	2752	RBIDFTCRADVICE_21012814480386259994,pdf.exe	RBIDFTCRADVICE_21012814480386259994,pdf.exe
PID 2752 wrote to memory of 3404	2752	RBIDFTCRADVICE_21012814480386259994,pdf.exe	RBIDFTCRADVICE_21012814480386259994,pdf.exe
PID 2752 wrote to memory of 3404	2752	RBIDFTCRADVICE_21012814480386259994,pdf.exe	RBIDFTCRADVICE_21012814480386259994,pdf.exe
PID 2752 wrote to memory of 3404	2752	RBIDFTCRADVICE_21012814480386259994,pdf.exe	RBIDFTCRADVICE_21012814480386259994,pdf.exe
PID 2752 wrote to memory of 3404	2752	RBIDFTCRADVICE_21012814480386259994,pdf.exe	RBIDFTCRADVICE_21012814480386259994,pdf.exe
PID 2752 wrote to memory of 3404	2752	RBIDFTCRADVICE_21012814480386259994,pdf.exe	RBIDFTCRADVICE_21012814480386259994,pdf.exe

C:\Users\Admin\AppData\Local\Temp\RBIDFTCRADVICE_21012814480386259994,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\RBIDFTCRADVICE_21012814480386259994,pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2752

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sCPgTFqFtL" /XML "C:\Users\Admin\AppData\Local\Temp\tmp28A7.tmp"
2⤵
- Creates scheduled task(s)
PID:3956

C:\Users\Admin\AppData\Local\Temp\RBIDFTCRADVICE_21012814480386259994,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\RBIDFTCRADVICE_21012814480386259994,pdf.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3404

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp28A7.tmp
MD5
faf845815c022544087811a55cc9df55

SHA1
e21bd464e8313e3921d321606acb38f58ad0fd52

SHA256
d36f77bc7213d6923dcbaef594bcb3337b31450ce11ddb8f9b31ce3e276ebe7b

SHA512
2b9a2c3908c3f73c2ea5dc9216ef763134090e2d5a26fb8f2e295d77592d6977848d0d7fdb912f23c8b1f357192ba3ce68ca70af0bc1f8987d60401207a61935

Download Submit
memory/2752-121-0x00000000058B0000-0x00000000058B3000-memory.dmp

Filesize
12KB

Download
memory/2752-117-0x0000000005BE0000-0x0000000005BE1000-memory.dmp

Filesize
4KB

Download
memory/2752-118-0x00000000056E0000-0x00000000056E1000-memory.dmp

Filesize
4KB

Download
memory/2752-119-0x0000000005610000-0x0000000005611000-memory.dmp

Filesize
4KB

Download
memory/2752-120-0x00000000058D0000-0x00000000058D1000-memory.dmp

Filesize
4KB

Download
memory/2752-114-0x0000000000CE0000-0x0000000000CE1000-memory.dmp

Filesize
4KB

Download
memory/2752-122-0x00000000055A0000-0x000000000563C000-memory.dmp

Filesize
624KB

Download
memory/2752-123-0x0000000006460000-0x00000000064F3000-memory.dmp

Filesize
588KB

Download
memory/2752-116-0x0000000005640000-0x0000000005641000-memory.dmp

Filesize
4KB

Download
memory/3404-126-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3404-127-0x000000000041EBF0-mapping.dmp

Download
memory/3404-128-0x00000000012C0000-0x00000000015E0000-memory.dmp

Filesize
3.1MB

Download
memory/3956-124-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads