formbook | 4fd44b1855341a3f6f31e08e4ad288747ecb8e5b8637b95fff99aa689de07446

General

Target

4fd44b1855341a3f6f31e08e4ad288747ecb8e5b8637b95fff99aa689de07446.bin.exe
Size

335KB
MD5

619d2ba58ece0c805f96956f511f5155
SHA1

30441c1e27728e326e16627e64fc63abc49b05c1
SHA256

4fd44b1855341a3f6f31e08e4ad288747ecb8e5b8637b95fff99aa689de07446
SHA512

af7da2064473c6b277dcf833ad1de09c3fdc89fc1de2a94b987e7f95186cc0e058fc1c22875f821829e180c89e252cafcda6bc463fd15c8d01663434921943e3

Score

10^/10

formbook h4d0 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

h4d0

Decoy

onlinefinejewelry.com

samstringermusic.com

beam-lettings.info

optimumcoin.xyz

fasa.xyz

creativedime.com

eihncuz.online

griffin2008.top

europcarlive.com

jxhcar.com

museumsshop.international

bonolaboral-lnterbank.com

kelebandis.xyz

hiddenlakeranch.net

carelessyouth.com

jfkilfoil.store

potok-it-ua.site

magdulemediation.com

shakadal.xyz

coastconstructionfl.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1664-55-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1664-56-0x000000000041F130-mapping.dmp	formbook

Loads dropped DLL 1 IoCs

Processes:

4fd44b1855341a3f6f31e08e4ad288747ecb8e5b8637b95fff99aa689de07446.bin.exe

pid process

944 4fd44b1855341a3f6f31e08e4ad288747ecb8e5b8637b95fff99aa689de07446.bin.exe

pid	process
944	4fd44b1855341a3f6f31e08e4ad288747ecb8e5b8637b95fff99aa689de07446.bin.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

4fd44b1855341a3f6f31e08e4ad288747ecb8e5b8637b95fff99aa689de07446.bin.exe

description	pid	process	target process
PID 944 set thread context of 1664	944	4fd44b1855341a3f6f31e08e4ad288747ecb8e5b8637b95fff99aa689de07446.bin.exe	4fd44b1855341a3f6f31e08e4ad288747ecb8e5b8637b95fff99aa689de07446.bin.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

4fd44b1855341a3f6f31e08e4ad288747ecb8e5b8637b95fff99aa689de07446.bin.exe

pid process

1664 4fd44b1855341a3f6f31e08e4ad288747ecb8e5b8637b95fff99aa689de07446.bin.exe

pid	process
1664	4fd44b1855341a3f6f31e08e4ad288747ecb8e5b8637b95fff99aa689de07446.bin.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

4fd44b1855341a3f6f31e08e4ad288747ecb8e5b8637b95fff99aa689de07446.bin.exe

description	pid	process	target process
PID 944 wrote to memory of 1664	944	4fd44b1855341a3f6f31e08e4ad288747ecb8e5b8637b95fff99aa689de07446.bin.exe	4fd44b1855341a3f6f31e08e4ad288747ecb8e5b8637b95fff99aa689de07446.bin.exe
PID 944 wrote to memory of 1664	944	4fd44b1855341a3f6f31e08e4ad288747ecb8e5b8637b95fff99aa689de07446.bin.exe	4fd44b1855341a3f6f31e08e4ad288747ecb8e5b8637b95fff99aa689de07446.bin.exe
PID 944 wrote to memory of 1664	944	4fd44b1855341a3f6f31e08e4ad288747ecb8e5b8637b95fff99aa689de07446.bin.exe	4fd44b1855341a3f6f31e08e4ad288747ecb8e5b8637b95fff99aa689de07446.bin.exe
PID 944 wrote to memory of 1664	944	4fd44b1855341a3f6f31e08e4ad288747ecb8e5b8637b95fff99aa689de07446.bin.exe	4fd44b1855341a3f6f31e08e4ad288747ecb8e5b8637b95fff99aa689de07446.bin.exe
PID 944 wrote to memory of 1664	944	4fd44b1855341a3f6f31e08e4ad288747ecb8e5b8637b95fff99aa689de07446.bin.exe	4fd44b1855341a3f6f31e08e4ad288747ecb8e5b8637b95fff99aa689de07446.bin.exe
PID 944 wrote to memory of 1664	944	4fd44b1855341a3f6f31e08e4ad288747ecb8e5b8637b95fff99aa689de07446.bin.exe	4fd44b1855341a3f6f31e08e4ad288747ecb8e5b8637b95fff99aa689de07446.bin.exe
PID 944 wrote to memory of 1664	944	4fd44b1855341a3f6f31e08e4ad288747ecb8e5b8637b95fff99aa689de07446.bin.exe	4fd44b1855341a3f6f31e08e4ad288747ecb8e5b8637b95fff99aa689de07446.bin.exe

C:\Users\Admin\AppData\Local\Temp\4fd44b1855341a3f6f31e08e4ad288747ecb8e5b8637b95fff99aa689de07446.bin.exe
"C:\Users\Admin\AppData\Local\Temp\4fd44b1855341a3f6f31e08e4ad288747ecb8e5b8637b95fff99aa689de07446.bin.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:944

C:\Users\Admin\AppData\Local\Temp\4fd44b1855341a3f6f31e08e4ad288747ecb8e5b8637b95fff99aa689de07446.bin.exe
"C:\Users\Admin\AppData\Local\Temp\4fd44b1855341a3f6f31e08e4ad288747ecb8e5b8637b95fff99aa689de07446.bin.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1664

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsdA9B8.tmp\wmadldla.dll
MD5
0d9cf42bc6878ed5ea82d3e8760c9a57

SHA1
e88d79333ff04e0b8e65d5c08770a21ea2204fc6

SHA256
8adb44f44cbca44c05db74d30862843289a19cf50d80a24db2d0187510675aca

SHA512
2dedd5bfe0b06403031ee8c744d9256f9a6c5d839c4611a00252b5935b86b62b5164e5eeade5b77f09fdfc29067ba5b89152cb1db9b24934e5099d6a37b40722

Download Submit
memory/944-53-0x0000000075D61000-0x0000000075D63000-memory.dmp

Filesize
8KB

Download
memory/1664-55-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1664-56-0x000000000041F130-mapping.dmp

Download
memory/1664-57-0x0000000000900000-0x0000000000C03000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads