formbook | f7d92bdb9870269bf1d06047d8dc41b287727612f0de238efbd59ef4767c7b03

General

Target

f7d92bdb9870269bf1d06047d8dc41b287727612f0de238efbd59ef4767c7b03.exe
Size

247KB
MD5

fe00496b835373cc1e2bedaa5cd44dba
SHA1

226e116819b8f70e7972aff8bb69126af3b88020
SHA256

f7d92bdb9870269bf1d06047d8dc41b287727612f0de238efbd59ef4767c7b03
SHA512

3acc02b0b6c73516d8964cf5023838ebc8502e10b89a655c30867bee8fed270a2845c459e2f89898ddefda51df9b92d2bd8b8522fc2dfea059f1e6180cf84b1e

Score

10^/10

formbook s11y rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

s11y

Decoy

thae.xyz

jeffreyoboite.com

waitforittshirts.com

rattledance.xyz

jq-pt.com

aolcomsignin.com

thekingschronicle.com

nftbrasil.tech

liruixiao.com

monkeyrollsltd.com

yhyh3456.com

ultrakid.tech

projectsbespoke.com

ticketsdao.com

himalayanspirit.com

hfurniture.xyz

dxalxbkl.com

pick-finder.com

pnmslinhyxsdf7.xyz

rensolv.xyz

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/3496-116-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Loads dropped DLL 1 IoCs

Processes:

f7d92bdb9870269bf1d06047d8dc41b287727612f0de238efbd59ef4767c7b03.exe

pid process

2644 f7d92bdb9870269bf1d06047d8dc41b287727612f0de238efbd59ef4767c7b03.exe

pid	process
2644	f7d92bdb9870269bf1d06047d8dc41b287727612f0de238efbd59ef4767c7b03.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

f7d92bdb9870269bf1d06047d8dc41b287727612f0de238efbd59ef4767c7b03.exe

description	pid	process	target process
PID 2644 set thread context of 3496	2644	f7d92bdb9870269bf1d06047d8dc41b287727612f0de238efbd59ef4767c7b03.exe	f7d92bdb9870269bf1d06047d8dc41b287727612f0de238efbd59ef4767c7b03.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

f7d92bdb9870269bf1d06047d8dc41b287727612f0de238efbd59ef4767c7b03.exe

pid	process
3496	f7d92bdb9870269bf1d06047d8dc41b287727612f0de238efbd59ef4767c7b03.exe
3496	f7d92bdb9870269bf1d06047d8dc41b287727612f0de238efbd59ef4767c7b03.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

f7d92bdb9870269bf1d06047d8dc41b287727612f0de238efbd59ef4767c7b03.exe

description	pid	process	target process
PID 2644 wrote to memory of 3496	2644	f7d92bdb9870269bf1d06047d8dc41b287727612f0de238efbd59ef4767c7b03.exe	f7d92bdb9870269bf1d06047d8dc41b287727612f0de238efbd59ef4767c7b03.exe
PID 2644 wrote to memory of 3496	2644	f7d92bdb9870269bf1d06047d8dc41b287727612f0de238efbd59ef4767c7b03.exe	f7d92bdb9870269bf1d06047d8dc41b287727612f0de238efbd59ef4767c7b03.exe
PID 2644 wrote to memory of 3496	2644	f7d92bdb9870269bf1d06047d8dc41b287727612f0de238efbd59ef4767c7b03.exe	f7d92bdb9870269bf1d06047d8dc41b287727612f0de238efbd59ef4767c7b03.exe
PID 2644 wrote to memory of 3496	2644	f7d92bdb9870269bf1d06047d8dc41b287727612f0de238efbd59ef4767c7b03.exe	f7d92bdb9870269bf1d06047d8dc41b287727612f0de238efbd59ef4767c7b03.exe
PID 2644 wrote to memory of 3496	2644	f7d92bdb9870269bf1d06047d8dc41b287727612f0de238efbd59ef4767c7b03.exe	f7d92bdb9870269bf1d06047d8dc41b287727612f0de238efbd59ef4767c7b03.exe
PID 2644 wrote to memory of 3496	2644	f7d92bdb9870269bf1d06047d8dc41b287727612f0de238efbd59ef4767c7b03.exe	f7d92bdb9870269bf1d06047d8dc41b287727612f0de238efbd59ef4767c7b03.exe

C:\Users\Admin\AppData\Local\Temp\f7d92bdb9870269bf1d06047d8dc41b287727612f0de238efbd59ef4767c7b03.exe
"C:\Users\Admin\AppData\Local\Temp\f7d92bdb9870269bf1d06047d8dc41b287727612f0de238efbd59ef4767c7b03.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2644

C:\Users\Admin\AppData\Local\Temp\f7d92bdb9870269bf1d06047d8dc41b287727612f0de238efbd59ef4767c7b03.exe
"C:\Users\Admin\AppData\Local\Temp\f7d92bdb9870269bf1d06047d8dc41b287727612f0de238efbd59ef4767c7b03.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3496

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsu9BC6.tmp\yiooct.dll
MD5
33a5d35f99a25b7730e762df322bcbaf

SHA1
5161bf70917b483c128fdb0b7bf15a34de31ea0f

SHA256
a114e2333254d7650ad4b797d3b4238c36af33fea05065ecb3f561173c18f73c

SHA512
0d666e66988446794e860240110cb66c10758306f624f4e1b1fe914e6cbb717f853380b72ce3955eee88b00f99abfbc419bd75761e2a53fbb496b4f3d4664915

Download Submit
memory/3496-116-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3496-117-0x0000000000A40000-0x0000000000D60000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads