formbook | 1631edd29c03c5b7b26a93590e8f5959bd033cf8c80758b1ecc40a69f678e264

General

Target

a4c34ec89966a552a5cacb6956f78ac5.exe
Size

306KB
MD5

a4c34ec89966a552a5cacb6956f78ac5
SHA1

ba3f3bc17eefc641664df68cc01b91669d295c6c
SHA256

1631edd29c03c5b7b26a93590e8f5959bd033cf8c80758b1ecc40a69f678e264
SHA512

3c3e62ea25199a6c4e9bb4070b6daf6e220d480d2ae21f1ad47b7859a59659dbf42a8397d461d5f2dd1780fc6e114e9c60bccd1c76bb0a3cd975d1cbb0680f0b

Score

10^/10

formbook h4d0 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

h4d0

C2

http://www.voxelsoxx.xyz/h4d0/

Decoy

onlinefinejewelry.com

samstringermusic.com

beam-lettings.info

optimumcoin.xyz

fasa.xyz

creativedime.com

eihncuz.online

griffin2008.top

europcarlive.com

jxhcar.com

museumsshop.international

bonolaboral-lnterbank.com

kelebandis.xyz

hiddenlakeranch.net

carelessyouth.com

jfkilfoil.store

potok-it-ua.site

magdulemediation.com

shakadal.xyz

coastconstructionfl.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2392-116-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/2392-117-0x000000000041F130-mapping.dmp	formbook

Loads dropped DLL 1 IoCs

Processes:

a4c34ec89966a552a5cacb6956f78ac5.exe

pid process

736 a4c34ec89966a552a5cacb6956f78ac5.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

a4c34ec89966a552a5cacb6956f78ac5.exe

description pid process target process

PID 736 set thread context of 2392 736 a4c34ec89966a552a5cacb6956f78ac5.exe a4c34ec89966a552a5cacb6956f78ac5.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

a4c34ec89966a552a5cacb6956f78ac5.exe

pid process

2392 a4c34ec89966a552a5cacb6956f78ac5.exe
2392 a4c34ec89966a552a5cacb6956f78ac5.exe

pid	process
736	a4c34ec89966a552a5cacb6956f78ac5.exe

description	pid	process	target process
PID 736 set thread context of 2392	736	a4c34ec89966a552a5cacb6956f78ac5.exe	a4c34ec89966a552a5cacb6956f78ac5.exe

pid	process
2392	a4c34ec89966a552a5cacb6956f78ac5.exe
2392	a4c34ec89966a552a5cacb6956f78ac5.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

a4c34ec89966a552a5cacb6956f78ac5.exe

description	pid	process	target process
PID 736 wrote to memory of 2392	736	a4c34ec89966a552a5cacb6956f78ac5.exe	a4c34ec89966a552a5cacb6956f78ac5.exe
PID 736 wrote to memory of 2392	736	a4c34ec89966a552a5cacb6956f78ac5.exe	a4c34ec89966a552a5cacb6956f78ac5.exe
PID 736 wrote to memory of 2392	736	a4c34ec89966a552a5cacb6956f78ac5.exe	a4c34ec89966a552a5cacb6956f78ac5.exe
PID 736 wrote to memory of 2392	736	a4c34ec89966a552a5cacb6956f78ac5.exe	a4c34ec89966a552a5cacb6956f78ac5.exe
PID 736 wrote to memory of 2392	736	a4c34ec89966a552a5cacb6956f78ac5.exe	a4c34ec89966a552a5cacb6956f78ac5.exe
PID 736 wrote to memory of 2392	736	a4c34ec89966a552a5cacb6956f78ac5.exe	a4c34ec89966a552a5cacb6956f78ac5.exe

C:\Users\Admin\AppData\Local\Temp\a4c34ec89966a552a5cacb6956f78ac5.exe
"C:\Users\Admin\AppData\Local\Temp\a4c34ec89966a552a5cacb6956f78ac5.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:736

C:\Users\Admin\AppData\Local\Temp\a4c34ec89966a552a5cacb6956f78ac5.exe
"C:\Users\Admin\AppData\Local\Temp\a4c34ec89966a552a5cacb6956f78ac5.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2392

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsu272C.tmp\ycneafeoufn.dll
MD5
da1f13c7ef92a3b65db650106558460d

SHA1
7c3ac55e62592f03e6d19a10dd9de53eba5dd002

SHA256
c41e86d055708e893041665b9058d305ef00ca3abad0dd0b191c9c07fc9a88d2

SHA512
dd5191c4c278c6aec84330b59670a808cbcc8d3bc3b0a1827b66c04e032923b60f62a0b594a08865952a07f67b73de2a5d94f4271d2e3b0e0552e1d1fa902d0e

Download Submit
memory/2392-116-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2392-117-0x000000000041F130-mapping.dmp

Download
memory/2392-118-0x0000000000AB0000-0x0000000000DD0000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing