formbook | 1358d88e078f1c59b546256968179bf213928f1e6f4e7afa255681b2cd8f92a2

General

Target

586f7a1895ea47a462b1d5f6a43fcd33.exe
Size

309KB
MD5

586f7a1895ea47a462b1d5f6a43fcd33
SHA1

c41cd420af421d31faede9294af1a2edc638d543
SHA256

1358d88e078f1c59b546256968179bf213928f1e6f4e7afa255681b2cd8f92a2
SHA512

2783c07faa3bba31c1a8bdc83ce338ea43ccb044f0af5adf2ede8b8f4534b86536f069b35fad8d6ed4413cc86fac0121632e9db39de919275403547ebff1a130

Score

10^/10

formbook vngb rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

vngb

C2

http://www.gvlc0.club/vngb/

Decoy

omertalasvegas.com

payyep.com

modasportss.com

gestionestrategicadl.com

teamolemiss.club

geektranslate.com

versatileventure.com

athletic-hub.com

vitanovaretreats.com

padison8t.com

tutoeasy.com

ediblewholesale.com

kangrungao.com

satode.com

prohibitionfeeds.com

getmorevacations.com

blinkworldbeauty.com

kdlabsallr.com

almanasef.com

transportationservicellc.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1056-57-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1056-58-0x000000000041F0E0-mapping.dmp	formbook

Loads dropped DLL 1 IoCs

Processes:

586f7a1895ea47a462b1d5f6a43fcd33.exe

pid process

1900 586f7a1895ea47a462b1d5f6a43fcd33.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

586f7a1895ea47a462b1d5f6a43fcd33.exe

description pid process target process

PID 1900 set thread context of 1056 1900 586f7a1895ea47a462b1d5f6a43fcd33.exe 586f7a1895ea47a462b1d5f6a43fcd33.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

586f7a1895ea47a462b1d5f6a43fcd33.exe

pid process

1056 586f7a1895ea47a462b1d5f6a43fcd33.exe

pid	process
1900	586f7a1895ea47a462b1d5f6a43fcd33.exe

description	pid	process	target process
PID 1900 set thread context of 1056	1900	586f7a1895ea47a462b1d5f6a43fcd33.exe	586f7a1895ea47a462b1d5f6a43fcd33.exe

pid	process
1056	586f7a1895ea47a462b1d5f6a43fcd33.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

586f7a1895ea47a462b1d5f6a43fcd33.exe

description	pid	process	target process
PID 1900 wrote to memory of 1056	1900	586f7a1895ea47a462b1d5f6a43fcd33.exe	586f7a1895ea47a462b1d5f6a43fcd33.exe
PID 1900 wrote to memory of 1056	1900	586f7a1895ea47a462b1d5f6a43fcd33.exe	586f7a1895ea47a462b1d5f6a43fcd33.exe
PID 1900 wrote to memory of 1056	1900	586f7a1895ea47a462b1d5f6a43fcd33.exe	586f7a1895ea47a462b1d5f6a43fcd33.exe
PID 1900 wrote to memory of 1056	1900	586f7a1895ea47a462b1d5f6a43fcd33.exe	586f7a1895ea47a462b1d5f6a43fcd33.exe
PID 1900 wrote to memory of 1056	1900	586f7a1895ea47a462b1d5f6a43fcd33.exe	586f7a1895ea47a462b1d5f6a43fcd33.exe
PID 1900 wrote to memory of 1056	1900	586f7a1895ea47a462b1d5f6a43fcd33.exe	586f7a1895ea47a462b1d5f6a43fcd33.exe
PID 1900 wrote to memory of 1056	1900	586f7a1895ea47a462b1d5f6a43fcd33.exe	586f7a1895ea47a462b1d5f6a43fcd33.exe

C:\Users\Admin\AppData\Local\Temp\586f7a1895ea47a462b1d5f6a43fcd33.exe
"C:\Users\Admin\AppData\Local\Temp\586f7a1895ea47a462b1d5f6a43fcd33.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1900

C:\Users\Admin\AppData\Local\Temp\586f7a1895ea47a462b1d5f6a43fcd33.exe
"C:\Users\Admin\AppData\Local\Temp\586f7a1895ea47a462b1d5f6a43fcd33.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1056

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsiB08B.tmp\advp.dll
MD5
47a7fbebea22292c405e44ec919c60fc

SHA1
23c5ee9e29719cd957b629da0901e706259adc46

SHA256
0feea087bbb6afebb6c50e8d20b2e00263b1db8744c54d11a39a77e0b0bd3473

SHA512
f142390694e739d498f8148c86e14e6b8f3436a091841574e7683233d0511e2c0896afededad91680423b626aa2cf9ce2bf106a56ead99bb0fce25c5c609068c

Download Submit
memory/1056-57-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1056-58-0x000000000041F0E0-mapping.dmp

Download
memory/1056-59-0x0000000000700000-0x0000000000A03000-memory.dmp

Filesize
3.0MB

Download
memory/1900-55-0x0000000075AB1000-0x0000000075AB3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing