formbook | 85197438716c6f11a14fcd2ef5250d978c6beb4d846666b98ca8f1e680526424

General

Target

85197438716c6f11a14fcd2ef5250d978c6beb4d846666b98ca8f1e680526424.exe
Size

521KB
MD5

f7e48a96209c65bbdcae872e1e7ee559
SHA1

4702d99d8c7331ab5a9ad73c6538030afebfb261
SHA256

85197438716c6f11a14fcd2ef5250d978c6beb4d846666b98ca8f1e680526424
SHA512

e6a02f335b60532a0a074403848bdbc425ac845db3681dd1779672227a5e2d70b323ad877c34db8ad376a2d63dd19e554771712a1dc3d4197e66bf341fc33ac1

Score

10^/10

formbook og2w rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

og2w

C2

http://www.celikkaya.xyz/og2w/

Decoy

drivenexpress.info

pdfproxy.com

zyz999.top

oceanserver1.com

948289.com

nubilewoman.com

ibizadiamonds.com

bosniantv-australia.com

juliehutzell.com

poshesocial.events

icsrwk.xyz

nap-con.com

womansslippers.com

invictusfarm.com

search-panel-avg-rock.rest

desencriptar.com

imperialexoticreptiles.com

agastify.com

strinvstr.com

julianapeloi.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/4252-116-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/4252-117-0x000000000041F130-mapping.dmp	formbook

Loads dropped DLL 1 IoCs

Processes:

85197438716c6f11a14fcd2ef5250d978c6beb4d846666b98ca8f1e680526424.exe

pid process

4180 85197438716c6f11a14fcd2ef5250d978c6beb4d846666b98ca8f1e680526424.exe

pid	process
4180	85197438716c6f11a14fcd2ef5250d978c6beb4d846666b98ca8f1e680526424.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

85197438716c6f11a14fcd2ef5250d978c6beb4d846666b98ca8f1e680526424.exe

description	pid	process	target process
PID 4180 set thread context of 4252	4180	85197438716c6f11a14fcd2ef5250d978c6beb4d846666b98ca8f1e680526424.exe	85197438716c6f11a14fcd2ef5250d978c6beb4d846666b98ca8f1e680526424.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

85197438716c6f11a14fcd2ef5250d978c6beb4d846666b98ca8f1e680526424.exe

pid	process
4252	85197438716c6f11a14fcd2ef5250d978c6beb4d846666b98ca8f1e680526424.exe
4252	85197438716c6f11a14fcd2ef5250d978c6beb4d846666b98ca8f1e680526424.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

85197438716c6f11a14fcd2ef5250d978c6beb4d846666b98ca8f1e680526424.exe

description	pid	process	target process
PID 4180 wrote to memory of 4252	4180	85197438716c6f11a14fcd2ef5250d978c6beb4d846666b98ca8f1e680526424.exe	85197438716c6f11a14fcd2ef5250d978c6beb4d846666b98ca8f1e680526424.exe
PID 4180 wrote to memory of 4252	4180	85197438716c6f11a14fcd2ef5250d978c6beb4d846666b98ca8f1e680526424.exe	85197438716c6f11a14fcd2ef5250d978c6beb4d846666b98ca8f1e680526424.exe
PID 4180 wrote to memory of 4252	4180	85197438716c6f11a14fcd2ef5250d978c6beb4d846666b98ca8f1e680526424.exe	85197438716c6f11a14fcd2ef5250d978c6beb4d846666b98ca8f1e680526424.exe
PID 4180 wrote to memory of 4252	4180	85197438716c6f11a14fcd2ef5250d978c6beb4d846666b98ca8f1e680526424.exe	85197438716c6f11a14fcd2ef5250d978c6beb4d846666b98ca8f1e680526424.exe
PID 4180 wrote to memory of 4252	4180	85197438716c6f11a14fcd2ef5250d978c6beb4d846666b98ca8f1e680526424.exe	85197438716c6f11a14fcd2ef5250d978c6beb4d846666b98ca8f1e680526424.exe
PID 4180 wrote to memory of 4252	4180	85197438716c6f11a14fcd2ef5250d978c6beb4d846666b98ca8f1e680526424.exe	85197438716c6f11a14fcd2ef5250d978c6beb4d846666b98ca8f1e680526424.exe

C:\Users\Admin\AppData\Local\Temp\85197438716c6f11a14fcd2ef5250d978c6beb4d846666b98ca8f1e680526424.exe
"C:\Users\Admin\AppData\Local\Temp\85197438716c6f11a14fcd2ef5250d978c6beb4d846666b98ca8f1e680526424.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4180

C:\Users\Admin\AppData\Local\Temp\85197438716c6f11a14fcd2ef5250d978c6beb4d846666b98ca8f1e680526424.exe
"C:\Users\Admin\AppData\Local\Temp\85197438716c6f11a14fcd2ef5250d978c6beb4d846666b98ca8f1e680526424.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4252

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsoF30C.tmp\vphbzhrj.dll
MD5
b28b3eb8b7fec5968eeded3a91bf6512

SHA1
d876aac9e914c668c168dd7c9483373a2a621473

SHA256
7e8205272a558bfee0483f7f84842240e397618c776e29dcdbadd78b664397a8

SHA512
47915777c20d002fddab2476a89ef9b9600fe248bb8d738e23f39bd3a3d6a94db18655292da044e42ef86d939cc1c614d0f40621e715814eccc64fb637760fb4

Download Submit
memory/4252-116-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4252-117-0x000000000041F130-mapping.dmp

Download
memory/4252-118-0x00000000009A0000-0x0000000000CC0000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads