formbook | 3cc97e74a5fe7f0cea8e82512a8923a4dc1bb1afe702bb53876136b5362fbfe3

Analysis

max time kernel
151s
max time network
145s
platform
windows10_x64
resource
win10-en-20210920
submitted
06/10/2021, 12:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
llkir43123.exe
Size 306KB
Sample211006-pvl7xabdbm
SHA256 3cc97e74a5fe7f0cea8e82512a8923a4dc1bb1afe702bb53876136b5362fbfe3
MD5 75f07a08beea06b2f54754860db47a11
SHA1 a2e1b6d45881ba19e977e3f096a9a08a50f1aaf2
SHA512 9ff7b681212da848b9900f714d88ae02a457bb943637438469c457818aa1da45de91b404d32da0170b77eb5211effb8afdb36815bd500597f5347aace529f641
MD5 SHA1 SHA512

Score

10^/10

formbook rv9n rat spyware stealer suricata trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

rv9n

http://www.cjspizza.net/rv9n/

Decoy

olivia-grace.show
zhuwww.com
keiretsu.xyz
olidnh.space
searuleansec.com
2fastrepair.com
brooklynmetalroof.com
scodol.com
novaprint.pro
the-loaner.com
nextroundscap.com
zbwlggs.com
internetautodealer.com
xn--tornrealestate-ekb.com
yunjiuhuo.com
skandinaviskakryptobanken.com
coxivarag.rest
ophthalmologylab.com
zzzzgjcdbqnn98.net
doeful.com
beatthebank.fund
deposit-pulsa2021.xyz
uptownsecuritysystems.com
thegroveonglendale.com
destinationth.com
healthcareuninsured.com
longhang.xyz
ypxwwxjqcqhutyp.com
ip-15-235-90.net
rancholachiquita.com
macblog.xyz
skillsbazar.com
beatyup.com
academiapinto.com
myguagua.com
fto8y.com
ohioleads.net
paravocebrasil.com
thecanyonmanor.com
acu-bps.com
comunicaretresessanta.net
schwa-bingcorp.com
discountcouponcodes-jp.space
kufazo.online
metaverge.club
800car.online
brendanbaehr.com
garfieldtoken.net
secretfoldr.com
13itcasino.com
marketingatelier.net
computersslide.com
marcastudios.com
thestreetsoflondon.life
maintaintest.com
cronicasdebia.com
apm-app.com
sepulchral.xyz
lodha-project.com
theartofsoulwork.com
swimminglessonsshop.com
klarnabet.com
control-of-space.net
heliumathletic.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Formbook Payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/2028-116-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/2028-117-0x000000000041F120-mapping.dmp	formbook
behavioral2/memory/2064-124-0x00000000007D0000-0x00000000007FF000-memory.dmp	formbook

Loads dropped DLL 1 IoCs

pid	Process
1844	llkir43123.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1844 set thread context of 2028	1844	llkir43123.exe	69
PID 2028 set thread context of 2848	2028	llkir43123.exe	19
PID 2064 set thread context of 2848	2064	cmd.exe	19

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 60 IoCs

pid	Process
2028	llkir43123.exe
2028	llkir43123.exe
2028	llkir43123.exe
2028	llkir43123.exe
2064	cmd.exe
2064	cmd.exe
2064	cmd.exe
2064	cmd.exe
2064	cmd.exe
2064	cmd.exe
2064	cmd.exe
2064	cmd.exe
2064	cmd.exe
2064	cmd.exe
2064	cmd.exe
2064	cmd.exe
2064	cmd.exe
2064	cmd.exe
2064	cmd.exe
2064	cmd.exe
2064	cmd.exe
2064	cmd.exe
2064	cmd.exe
2064	cmd.exe
2064	cmd.exe
2064	cmd.exe
2064	cmd.exe
2064	cmd.exe
2064	cmd.exe
2064	cmd.exe
2064	cmd.exe
2064	cmd.exe
2064	cmd.exe
2064	cmd.exe
2064	cmd.exe
2064	cmd.exe
2064	cmd.exe
2064	cmd.exe
2064	cmd.exe
2064	cmd.exe
2064	cmd.exe
2064	cmd.exe
2064	cmd.exe
2064	cmd.exe
2064	cmd.exe
2064	cmd.exe
2064	cmd.exe
2064	cmd.exe
2064	cmd.exe
2064	cmd.exe
2064	cmd.exe
2064	cmd.exe
2064	cmd.exe
2064	cmd.exe
2064	cmd.exe
2064	cmd.exe
2064	cmd.exe
2064	cmd.exe
2064	cmd.exe
2064	cmd.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2848	Explorer.EXE

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
2028	llkir43123.exe
2028	llkir43123.exe
2028	llkir43123.exe
2064	cmd.exe
2064	cmd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2028	llkir43123.exe
Token: SeDebugPrivilege	2064	cmd.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 2028	1844	llkir43123.exe	69
PID 1844 wrote to memory of 2028	1844	llkir43123.exe	69
PID 1844 wrote to memory of 2028	1844	llkir43123.exe	69
PID 1844 wrote to memory of 2028	1844	llkir43123.exe	69
PID 1844 wrote to memory of 2028	1844	llkir43123.exe	69
PID 1844 wrote to memory of 2028	1844	llkir43123.exe	69
PID 2848 wrote to memory of 2064	2848	Explorer.EXE	70
PID 2848 wrote to memory of 2064	2848	Explorer.EXE	70
PID 2848 wrote to memory of 2064	2848	Explorer.EXE	70
PID 2064 wrote to memory of 2372	2064	cmd.exe	71
PID 2064 wrote to memory of 2372	2064	cmd.exe	71
PID 2064 wrote to memory of 2372	2064	cmd.exe	71

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Users\Admin\AppData\Local\Temp\llkir43123.exe
  "C:\Users\Admin\AppData\Local\Temp\llkir43123.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1844
- - C:\Users\Admin\AppData\Local\Temp\llkir43123.exe
    "C:\Users\Admin\AppData\Local\Temp\llkir43123.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:2028
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\SysWOW64\cmd.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2064
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\llkir43123.exe"
    3⤵
    PID:2372

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2028-116-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2028-119-0x00000000009E0000-0x00000000009F4000-memory.dmp

Download

memory/2028-118-0x0000000000A00000-0x0000000000D20000-memory.dmp

Download

memory/2064-123-0x0000000000920000-0x0000000000979000-memory.dmp

Download

memory/2064-124-0x00000000007D0000-0x00000000007FF000-memory.dmp

Download

memory/2064-125-0x0000000003340000-0x0000000003660000-memory.dmp

Download

memory/2064-126-0x0000000003100000-0x0000000003193000-memory.dmp

Download

memory/2848-120-0x0000000004A50000-0x0000000004B6D000-memory.dmp

Download

memory/2848-127-0x00000000027D0000-0x00000000028BD000-memory.dmp

Download