formbook | f7d92bdb9870269bf1d06047d8dc41b287727612f0de238efbd59ef4767c7b03

General

Target

fe00496b835373cc1e2bedaa5cd44dba.exe
Size

247KB
MD5

fe00496b835373cc1e2bedaa5cd44dba
SHA1

226e116819b8f70e7972aff8bb69126af3b88020
SHA256

f7d92bdb9870269bf1d06047d8dc41b287727612f0de238efbd59ef4767c7b03
SHA512

3acc02b0b6c73516d8964cf5023838ebc8502e10b89a655c30867bee8fed270a2845c459e2f89898ddefda51df9b92d2bd8b8522fc2dfea059f1e6180cf84b1e

Score

10^/10

formbook s11y rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

s11y

Decoy

thae.xyz

jeffreyoboite.com

waitforittshirts.com

rattledance.xyz

jq-pt.com

aolcomsignin.com

thekingschronicle.com

nftbrasil.tech

liruixiao.com

monkeyrollsltd.com

yhyh3456.com

ultrakid.tech

projectsbespoke.com

ticketsdao.com

himalayanspirit.com

hfurniture.xyz

dxalxbkl.com

pick-finder.com

pnmslinhyxsdf7.xyz

rensolv.xyz

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/760-56-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Loads dropped DLL 1 IoCs

Processes:

fe00496b835373cc1e2bedaa5cd44dba.exe

pid process

1576 fe00496b835373cc1e2bedaa5cd44dba.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

fe00496b835373cc1e2bedaa5cd44dba.exe

description pid process target process

PID 1576 set thread context of 760 1576 fe00496b835373cc1e2bedaa5cd44dba.exe fe00496b835373cc1e2bedaa5cd44dba.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

fe00496b835373cc1e2bedaa5cd44dba.exe

pid process

760 fe00496b835373cc1e2bedaa5cd44dba.exe

pid	process
1576	fe00496b835373cc1e2bedaa5cd44dba.exe

description	pid	process	target process
PID 1576 set thread context of 760	1576	fe00496b835373cc1e2bedaa5cd44dba.exe	fe00496b835373cc1e2bedaa5cd44dba.exe

pid	process
760	fe00496b835373cc1e2bedaa5cd44dba.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

fe00496b835373cc1e2bedaa5cd44dba.exe

description	pid	process	target process
PID 1576 wrote to memory of 760	1576	fe00496b835373cc1e2bedaa5cd44dba.exe	fe00496b835373cc1e2bedaa5cd44dba.exe
PID 1576 wrote to memory of 760	1576	fe00496b835373cc1e2bedaa5cd44dba.exe	fe00496b835373cc1e2bedaa5cd44dba.exe
PID 1576 wrote to memory of 760	1576	fe00496b835373cc1e2bedaa5cd44dba.exe	fe00496b835373cc1e2bedaa5cd44dba.exe
PID 1576 wrote to memory of 760	1576	fe00496b835373cc1e2bedaa5cd44dba.exe	fe00496b835373cc1e2bedaa5cd44dba.exe
PID 1576 wrote to memory of 760	1576	fe00496b835373cc1e2bedaa5cd44dba.exe	fe00496b835373cc1e2bedaa5cd44dba.exe
PID 1576 wrote to memory of 760	1576	fe00496b835373cc1e2bedaa5cd44dba.exe	fe00496b835373cc1e2bedaa5cd44dba.exe
PID 1576 wrote to memory of 760	1576	fe00496b835373cc1e2bedaa5cd44dba.exe	fe00496b835373cc1e2bedaa5cd44dba.exe

C:\Users\Admin\AppData\Local\Temp\fe00496b835373cc1e2bedaa5cd44dba.exe
"C:\Users\Admin\AppData\Local\Temp\fe00496b835373cc1e2bedaa5cd44dba.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1576

C:\Users\Admin\AppData\Local\Temp\fe00496b835373cc1e2bedaa5cd44dba.exe
"C:\Users\Admin\AppData\Local\Temp\fe00496b835373cc1e2bedaa5cd44dba.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:760

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsoEA42.tmp\yiooct.dll
MD5
33a5d35f99a25b7730e762df322bcbaf

SHA1
5161bf70917b483c128fdb0b7bf15a34de31ea0f

SHA256
a114e2333254d7650ad4b797d3b4238c36af33fea05065ecb3f561173c18f73c

SHA512
0d666e66988446794e860240110cb66c10758306f624f4e1b1fe914e6cbb717f853380b72ce3955eee88b00f99abfbc419bd75761e2a53fbb496b4f3d4664915

Download Submit
memory/760-56-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/760-57-0x0000000000830000-0x0000000000B33000-memory.dmp

Filesize
3.0MB

Download
memory/1576-54-0x0000000075601000-0x0000000075603000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing