formbook | 6d6ed63e357100a38b5bb4f4a256be07e34960bf25dbf0cc7d8f6b66e06d2df3

General

Target

6D6ED63E357100A38B5BB4F4A256BE07E34960BF25DBF0CC7D8F6B66E06D2DF3.exe
Size

830KB
MD5

8c0ee1047417c73e05ff20905963357e
SHA1

4870480c602168a6b0d5572810ca7289107df0d9
SHA256

6d6ed63e357100a38b5bb4f4a256be07e34960bf25dbf0cc7d8f6b66e06d2df3
SHA512

7005b8ffcb3837deb0f4e238ae60d8037c83e12d4b3e911efaba6d414e6c52deeef4cf2b8bf26bec2e720edd870ba2d4570a6ad92ce40db0037efac2b0c4c41e

Score

10^/10

formbook cb2k rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

cb2k

C2

http://www.freegovphoneservice.com/cb2k/

Decoy

prets-personnels-faciles-1.com

lavandica.com

855goldenpark.com

ebrandschool.com

annielaineinspirations.com

tuscumbiadivorceattorney.com

lovarebanwgt74.xyz

car-plus.info

fireloops.net

psychtechsolutions.com

didubreak.com

cursodesigndesobrancelhas.com

berrymyrick.com

visit-croatia-now.com

chamonix-cars.club

1679tnpnd01uzznpvfu8795.com

noisedelayrecovery.com

sergiotimoteo.com

lplc.cloud

ppezjo.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1232-128-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/1232-129-0x000000000041F190-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

6D6ED63E357100A38B5BB4F4A256BE07E34960BF25DBF0CC7D8F6B66E06D2DF3.exe

description	pid	process	target process
PID 1680 set thread context of 1232	1680	6D6ED63E357100A38B5BB4F4A256BE07E34960BF25DBF0CC7D8F6B66E06D2DF3.exe	6D6ED63E357100A38B5BB4F4A256BE07E34960BF25DBF0CC7D8F6B66E06D2DF3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2844 schtasks.exe

pid	process
2844	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

6D6ED63E357100A38B5BB4F4A256BE07E34960BF25DBF0CC7D8F6B66E06D2DF3.exe

pid	process
1232	6D6ED63E357100A38B5BB4F4A256BE07E34960BF25DBF0CC7D8F6B66E06D2DF3.exe
1232	6D6ED63E357100A38B5BB4F4A256BE07E34960BF25DBF0CC7D8F6B66E06D2DF3.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

6D6ED63E357100A38B5BB4F4A256BE07E34960BF25DBF0CC7D8F6B66E06D2DF3.exe

description	pid	process	target process
PID 1680 wrote to memory of 2844	1680	6D6ED63E357100A38B5BB4F4A256BE07E34960BF25DBF0CC7D8F6B66E06D2DF3.exe	schtasks.exe
PID 1680 wrote to memory of 2844	1680	6D6ED63E357100A38B5BB4F4A256BE07E34960BF25DBF0CC7D8F6B66E06D2DF3.exe	schtasks.exe
PID 1680 wrote to memory of 2844	1680	6D6ED63E357100A38B5BB4F4A256BE07E34960BF25DBF0CC7D8F6B66E06D2DF3.exe	schtasks.exe
PID 1680 wrote to memory of 1232	1680	6D6ED63E357100A38B5BB4F4A256BE07E34960BF25DBF0CC7D8F6B66E06D2DF3.exe	6D6ED63E357100A38B5BB4F4A256BE07E34960BF25DBF0CC7D8F6B66E06D2DF3.exe
PID 1680 wrote to memory of 1232	1680	6D6ED63E357100A38B5BB4F4A256BE07E34960BF25DBF0CC7D8F6B66E06D2DF3.exe	6D6ED63E357100A38B5BB4F4A256BE07E34960BF25DBF0CC7D8F6B66E06D2DF3.exe
PID 1680 wrote to memory of 1232	1680	6D6ED63E357100A38B5BB4F4A256BE07E34960BF25DBF0CC7D8F6B66E06D2DF3.exe	6D6ED63E357100A38B5BB4F4A256BE07E34960BF25DBF0CC7D8F6B66E06D2DF3.exe
PID 1680 wrote to memory of 1232	1680	6D6ED63E357100A38B5BB4F4A256BE07E34960BF25DBF0CC7D8F6B66E06D2DF3.exe	6D6ED63E357100A38B5BB4F4A256BE07E34960BF25DBF0CC7D8F6B66E06D2DF3.exe
PID 1680 wrote to memory of 1232	1680	6D6ED63E357100A38B5BB4F4A256BE07E34960BF25DBF0CC7D8F6B66E06D2DF3.exe	6D6ED63E357100A38B5BB4F4A256BE07E34960BF25DBF0CC7D8F6B66E06D2DF3.exe
PID 1680 wrote to memory of 1232	1680	6D6ED63E357100A38B5BB4F4A256BE07E34960BF25DBF0CC7D8F6B66E06D2DF3.exe	6D6ED63E357100A38B5BB4F4A256BE07E34960BF25DBF0CC7D8F6B66E06D2DF3.exe

C:\Users\Admin\AppData\Local\Temp\6D6ED63E357100A38B5BB4F4A256BE07E34960BF25DBF0CC7D8F6B66E06D2DF3.exe
"C:\Users\Admin\AppData\Local\Temp\6D6ED63E357100A38B5BB4F4A256BE07E34960BF25DBF0CC7D8F6B66E06D2DF3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1680

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LyTtZRlfdo" /XML "C:\Users\Admin\AppData\Local\Temp\tmp56D6.tmp"
2⤵
- Creates scheduled task(s)
PID:2844

C:\Users\Admin\AppData\Local\Temp\6D6ED63E357100A38B5BB4F4A256BE07E34960BF25DBF0CC7D8F6B66E06D2DF3.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1232

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp56D6.tmp
MD5
3e72d1595e52ef6d9d9d1a9e7ed1b790

SHA1
e857c50eea0820e14a14aa5e55e778d5f761e7ce

SHA256
d5652fc77998c94fb5974f4fa4ca64a201d4096b95b85e15311e11ea6aa8f1ec

SHA512
c01f4132934faaae1b8c0cb96857291e077bd7689745e02372be7820ad45e1265297759a8698d60f17b9ab9ebc9e239b8603a54ced4b66a6d1914a4b159fdec1

Download Submit
memory/1232-130-0x0000000001830000-0x0000000001B50000-memory.dmp

Filesize
3.1MB

Download
memory/1232-129-0x000000000041F190-mapping.dmp

Download
memory/1232-128-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1680-122-0x00000000058B0000-0x0000000005DAE000-memory.dmp

Filesize
5.0MB

Download
memory/1680-121-0x0000000005AC0000-0x0000000005AC1000-memory.dmp

Filesize
4KB

Download
memory/1680-115-0x0000000000D70000-0x0000000000D71000-memory.dmp

Filesize
4KB

Download
memory/1680-123-0x0000000005DA0000-0x0000000005DAE000-memory.dmp

Filesize
56KB

Download
memory/1680-124-0x00000000092C0000-0x0000000009343000-memory.dmp

Filesize
524KB

Download
memory/1680-125-0x000000000B960000-0x000000000B990000-memory.dmp

Filesize
192KB

Download
memory/1680-120-0x00000000057A0000-0x00000000057A1000-memory.dmp

Filesize
4KB

Download
memory/1680-119-0x00000000058B0000-0x00000000058B1000-memory.dmp

Filesize
4KB

Download
memory/1680-118-0x0000000005DB0000-0x0000000005DB1000-memory.dmp

Filesize
4KB

Download
memory/1680-117-0x0000000005810000-0x0000000005811000-memory.dmp

Filesize
4KB

Download
memory/2844-126-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads