formbook | 6d6ed63e357100a38b5bb4f4a256be07e34960bf25dbf0cc7d8f6b66e06d2df3

General

Target

6D6ED63E357100A38B5BB4F4A256BE07E34960BF25DBF0CC7D8F6B66E06D2DF3.exe
Size

830KB
MD5

8c0ee1047417c73e05ff20905963357e
SHA1

4870480c602168a6b0d5572810ca7289107df0d9
SHA256

6d6ed63e357100a38b5bb4f4a256be07e34960bf25dbf0cc7d8f6b66e06d2df3
SHA512

7005b8ffcb3837deb0f4e238ae60d8037c83e12d4b3e911efaba6d414e6c52deeef4cf2b8bf26bec2e720edd870ba2d4570a6ad92ce40db0037efac2b0c4c41e

Score

10^/10

formbook cb2k rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

cb2k

C2

http://www.freegovphoneservice.com/cb2k/

Decoy

prets-personnels-faciles-1.com

lavandica.com

855goldenpark.com

ebrandschool.com

annielaineinspirations.com

tuscumbiadivorceattorney.com

lovarebanwgt74.xyz

car-plus.info

fireloops.net

psychtechsolutions.com

didubreak.com

cursodesigndesobrancelhas.com

berrymyrick.com

visit-croatia-now.com

chamonix-cars.club

1679tnpnd01uzznpvfu8795.com

noisedelayrecovery.com

sergiotimoteo.com

lplc.cloud

ppezjo.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1224-65-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1224-66-0x000000000041F190-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

6D6ED63E357100A38B5BB4F4A256BE07E34960BF25DBF0CC7D8F6B66E06D2DF3.exe

description	pid	process	target process
PID 1632 set thread context of 1224	1632	6D6ED63E357100A38B5BB4F4A256BE07E34960BF25DBF0CC7D8F6B66E06D2DF3.exe	6D6ED63E357100A38B5BB4F4A256BE07E34960BF25DBF0CC7D8F6B66E06D2DF3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

788 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

6D6ED63E357100A38B5BB4F4A256BE07E34960BF25DBF0CC7D8F6B66E06D2DF3.exe

pid process

1224 6D6ED63E357100A38B5BB4F4A256BE07E34960BF25DBF0CC7D8F6B66E06D2DF3.exe

pid	process
788	schtasks.exe

pid	process
1224	6D6ED63E357100A38B5BB4F4A256BE07E34960BF25DBF0CC7D8F6B66E06D2DF3.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

6D6ED63E357100A38B5BB4F4A256BE07E34960BF25DBF0CC7D8F6B66E06D2DF3.exe

description	pid	process	target process
PID 1632 wrote to memory of 788	1632	6D6ED63E357100A38B5BB4F4A256BE07E34960BF25DBF0CC7D8F6B66E06D2DF3.exe	schtasks.exe
PID 1632 wrote to memory of 788	1632	6D6ED63E357100A38B5BB4F4A256BE07E34960BF25DBF0CC7D8F6B66E06D2DF3.exe	schtasks.exe
PID 1632 wrote to memory of 788	1632	6D6ED63E357100A38B5BB4F4A256BE07E34960BF25DBF0CC7D8F6B66E06D2DF3.exe	schtasks.exe
PID 1632 wrote to memory of 788	1632	6D6ED63E357100A38B5BB4F4A256BE07E34960BF25DBF0CC7D8F6B66E06D2DF3.exe	schtasks.exe
PID 1632 wrote to memory of 1224	1632	6D6ED63E357100A38B5BB4F4A256BE07E34960BF25DBF0CC7D8F6B66E06D2DF3.exe	6D6ED63E357100A38B5BB4F4A256BE07E34960BF25DBF0CC7D8F6B66E06D2DF3.exe
PID 1632 wrote to memory of 1224	1632	6D6ED63E357100A38B5BB4F4A256BE07E34960BF25DBF0CC7D8F6B66E06D2DF3.exe	6D6ED63E357100A38B5BB4F4A256BE07E34960BF25DBF0CC7D8F6B66E06D2DF3.exe
PID 1632 wrote to memory of 1224	1632	6D6ED63E357100A38B5BB4F4A256BE07E34960BF25DBF0CC7D8F6B66E06D2DF3.exe	6D6ED63E357100A38B5BB4F4A256BE07E34960BF25DBF0CC7D8F6B66E06D2DF3.exe
PID 1632 wrote to memory of 1224	1632	6D6ED63E357100A38B5BB4F4A256BE07E34960BF25DBF0CC7D8F6B66E06D2DF3.exe	6D6ED63E357100A38B5BB4F4A256BE07E34960BF25DBF0CC7D8F6B66E06D2DF3.exe
PID 1632 wrote to memory of 1224	1632	6D6ED63E357100A38B5BB4F4A256BE07E34960BF25DBF0CC7D8F6B66E06D2DF3.exe	6D6ED63E357100A38B5BB4F4A256BE07E34960BF25DBF0CC7D8F6B66E06D2DF3.exe
PID 1632 wrote to memory of 1224	1632	6D6ED63E357100A38B5BB4F4A256BE07E34960BF25DBF0CC7D8F6B66E06D2DF3.exe	6D6ED63E357100A38B5BB4F4A256BE07E34960BF25DBF0CC7D8F6B66E06D2DF3.exe
PID 1632 wrote to memory of 1224	1632	6D6ED63E357100A38B5BB4F4A256BE07E34960BF25DBF0CC7D8F6B66E06D2DF3.exe	6D6ED63E357100A38B5BB4F4A256BE07E34960BF25DBF0CC7D8F6B66E06D2DF3.exe

C:\Users\Admin\AppData\Local\Temp\6D6ED63E357100A38B5BB4F4A256BE07E34960BF25DBF0CC7D8F6B66E06D2DF3.exe
"C:\Users\Admin\AppData\Local\Temp\6D6ED63E357100A38B5BB4F4A256BE07E34960BF25DBF0CC7D8F6B66E06D2DF3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1632

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LyTtZRlfdo" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAE49.tmp"
2⤵
- Creates scheduled task(s)
PID:788

C:\Users\Admin\AppData\Local\Temp\6D6ED63E357100A38B5BB4F4A256BE07E34960BF25DBF0CC7D8F6B66E06D2DF3.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1224

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpAE49.tmp
MD5
1740256acc37478acdd06fe69dfaec97

SHA1
eac3b28111455a52fda6c9b6983a69036bc74e7d

SHA256
fa41fd883c936c5048b4ec48d92ce1be44889bd4fe0518229265c0527f0afd65

SHA512
f2af3259312da2277e85f0e83e5b792e56d676dfb5a5d4ec22c5de68217e453abc40043bcae19b99aa9b01bc49fbb7c47b27836138c97d29cb6781aba6455809

Download Submit
memory/788-61-0x0000000000000000-mapping.dmp

Download
memory/1224-64-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1224-63-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1224-65-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1224-66-0x000000000041F190-mapping.dmp

Download
memory/1224-67-0x0000000000CC0000-0x0000000000FC3000-memory.dmp

Filesize
3.0MB

Download
memory/1632-58-0x0000000000490000-0x000000000049E000-memory.dmp

Filesize
56KB

Download
memory/1632-59-0x0000000007EC0000-0x0000000007F43000-memory.dmp

Filesize
524KB

Download
memory/1632-60-0x0000000000A10000-0x0000000000A40000-memory.dmp

Filesize
192KB

Download
memory/1632-57-0x0000000000950000-0x0000000000951000-memory.dmp

Filesize
4KB

Download
memory/1632-56-0x0000000076B61000-0x0000000076B63000-memory.dmp

Filesize
8KB

Download
memory/1632-54-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads