formbook | d1eddd348ee11e3da00c9f45fa1fb94e3b174c8abe780a7d764bd22f62980e8e

General

Target

d1eddd348ee11e3da00c9f45fa1fb94e3b174c8abe780a7d764bd22f62980e8e.exe
Size

404KB
MD5

ac889675aa282449205f31cd4f46f3d6
SHA1

50115144e96337ed3bfe27480a82300002310400
SHA256

d1eddd348ee11e3da00c9f45fa1fb94e3b174c8abe780a7d764bd22f62980e8e
SHA512

3a32641a515063fa9d062fa78a778f5f05088707af2a431904c37a0d772145e02617a172be9a74fe65c64b4b3e3dcca82aedf351ccbc4bb5b22e29a0ad6742dd

Score

10^/10

formbook jy93 persistence rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

jy93

Decoy

alexito.space

shitsthebalm.com

margaritavillemelbourne.com

vonahk.xyz

1960lawn.com

augustacrim.com

bancopec.com

batrainingstudio.com

kokofleks.store

w4-form-irs.com

putnamob.com

mickeysmotors.com

8181yd.com

wedmecreation.com

mischianti.com

gskpop.com

douvip303.com

unlimitedlyfestylez.com

originophthalmics.com

oandazx86.xyz

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2304-136-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Sets service image path in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Suspicious use of SetThreadContext 1 IoCs

Processes:

d1eddd348ee11e3da00c9f45fa1fb94e3b174c8abe780a7d764bd22f62980e8e.exe

description	pid	process	target process
PID 1136 set thread context of 2304	1136	d1eddd348ee11e3da00c9f45fa1fb94e3b174c8abe780a7d764bd22f62980e8e.exe	d1eddd348ee11e3da00c9f45fa1fb94e3b174c8abe780a7d764bd22f62980e8e.exe

Modifies data under HKEY_USERS 41 IoCs

Processes:

WaaSMedicAgent.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

d1eddd348ee11e3da00c9f45fa1fb94e3b174c8abe780a7d764bd22f62980e8e.exe

description	pid	process	target process
PID 1136 wrote to memory of 2304	1136	d1eddd348ee11e3da00c9f45fa1fb94e3b174c8abe780a7d764bd22f62980e8e.exe	d1eddd348ee11e3da00c9f45fa1fb94e3b174c8abe780a7d764bd22f62980e8e.exe
PID 1136 wrote to memory of 2304	1136	d1eddd348ee11e3da00c9f45fa1fb94e3b174c8abe780a7d764bd22f62980e8e.exe	d1eddd348ee11e3da00c9f45fa1fb94e3b174c8abe780a7d764bd22f62980e8e.exe
PID 1136 wrote to memory of 2304	1136	d1eddd348ee11e3da00c9f45fa1fb94e3b174c8abe780a7d764bd22f62980e8e.exe	d1eddd348ee11e3da00c9f45fa1fb94e3b174c8abe780a7d764bd22f62980e8e.exe
PID 1136 wrote to memory of 2304	1136	d1eddd348ee11e3da00c9f45fa1fb94e3b174c8abe780a7d764bd22f62980e8e.exe	d1eddd348ee11e3da00c9f45fa1fb94e3b174c8abe780a7d764bd22f62980e8e.exe
PID 1136 wrote to memory of 2304	1136	d1eddd348ee11e3da00c9f45fa1fb94e3b174c8abe780a7d764bd22f62980e8e.exe	d1eddd348ee11e3da00c9f45fa1fb94e3b174c8abe780a7d764bd22f62980e8e.exe
PID 1136 wrote to memory of 2304	1136	d1eddd348ee11e3da00c9f45fa1fb94e3b174c8abe780a7d764bd22f62980e8e.exe	d1eddd348ee11e3da00c9f45fa1fb94e3b174c8abe780a7d764bd22f62980e8e.exe

C:\Users\Admin\AppData\Local\Temp\d1eddd348ee11e3da00c9f45fa1fb94e3b174c8abe780a7d764bd22f62980e8e.exe
"C:\Users\Admin\AppData\Local\Temp\d1eddd348ee11e3da00c9f45fa1fb94e3b174c8abe780a7d764bd22f62980e8e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1136

C:\Users\Admin\AppData\Local\Temp\d1eddd348ee11e3da00c9f45fa1fb94e3b174c8abe780a7d764bd22f62980e8e.exe
"C:\Users\Admin\AppData\Local\Temp\d1eddd348ee11e3da00c9f45fa1fb94e3b174c8abe780a7d764bd22f62980e8e.exe"
2⤵
PID:2304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p
1⤵
PID:1888

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 76c9fb350099514f97f4349453dfdf43 KECN5ir4ik6qFz0EwTIysw.0.1.0.0.0
1⤵
- Modifies data under HKEY_USERS
PID:3924

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1136-130-0x0000000000AF0000-0x0000000000B5C000-memory.dmp

Filesize
432KB

Download
memory/1136-131-0x0000000005A90000-0x0000000006034000-memory.dmp

Filesize
5.6MB

Download
memory/1136-132-0x0000000005580000-0x0000000005612000-memory.dmp

Filesize
584KB

Download
memory/1136-133-0x00000000054E0000-0x0000000005A84000-memory.dmp

Filesize
5.6MB

Download
memory/1136-134-0x0000000005510000-0x000000000551A000-memory.dmp

Filesize
40KB

Download
memory/1136-135-0x0000000007820000-0x00000000078BC000-memory.dmp

Filesize
624KB

Download
memory/2304-136-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads