formbook | c4771044788147e2c9acb052dfbf6d291400add558b59ad0e6d0c5f42f3ec3e1

General

Target

c4771044788147e2c9acb052dfbf6d291400add558b59ad0e6d0c5f42f3ec3e1.exe
Size

414KB
MD5

43357f80bc70e0db9fb0c304a962e3de
SHA1

50b6a0a1fb9d9af63523b9a186e88c279c591274
SHA256

c4771044788147e2c9acb052dfbf6d291400add558b59ad0e6d0c5f42f3ec3e1
SHA512

186ce7a33d8bbbc821f689e7f736f8648b827c981a72eccddbeed1861b05bbc014866c8c138993981f6cd7bb864466ef21912c92f13d8072247efb02f5a60ff0

Score

10^/10

formbook g2fg rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

g2fg

Decoy

snowcrash.website

pointman.us

newheartvalve.care

drandl.com

sandspringsramblers.com

programagubernamental.online

boja.us

mvrsnike.com

mentallyillmotherhood.com

facom.us

programagubernamental.store

izivente.com

roller-v.fr

amazonbioactives.com

metaverseapple.xyz

5gt-mobilevsverizon.com

gtwebsolutions.co

scottdunn.life

usdp.trade

pikmin.run

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/648-127-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

c4771044788147e2c9acb052dfbf6d291400add558b59ad0e6d0c5f42f3ec3e1.exe

description	pid	process	target process
PID 3604 set thread context of 648	3604	c4771044788147e2c9acb052dfbf6d291400add558b59ad0e6d0c5f42f3ec3e1.exe	c4771044788147e2c9acb052dfbf6d291400add558b59ad0e6d0c5f42f3ec3e1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3080 schtasks.exe

pid	process
3080	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exec4771044788147e2c9acb052dfbf6d291400add558b59ad0e6d0c5f42f3ec3e1.exe

pid	process
3784	powershell.exe
648	c4771044788147e2c9acb052dfbf6d291400add558b59ad0e6d0c5f42f3ec3e1.exe
648	c4771044788147e2c9acb052dfbf6d291400add558b59ad0e6d0c5f42f3ec3e1.exe
3784	powershell.exe
3784	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 3784 powershell.exe

description	pid	process
Token: SeDebugPrivilege	3784	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

c4771044788147e2c9acb052dfbf6d291400add558b59ad0e6d0c5f42f3ec3e1.exe

description	pid	process	target process
PID 3604 wrote to memory of 3784	3604	c4771044788147e2c9acb052dfbf6d291400add558b59ad0e6d0c5f42f3ec3e1.exe	powershell.exe
PID 3604 wrote to memory of 3784	3604	c4771044788147e2c9acb052dfbf6d291400add558b59ad0e6d0c5f42f3ec3e1.exe	powershell.exe
PID 3604 wrote to memory of 3784	3604	c4771044788147e2c9acb052dfbf6d291400add558b59ad0e6d0c5f42f3ec3e1.exe	powershell.exe
PID 3604 wrote to memory of 3080	3604	c4771044788147e2c9acb052dfbf6d291400add558b59ad0e6d0c5f42f3ec3e1.exe	schtasks.exe
PID 3604 wrote to memory of 3080	3604	c4771044788147e2c9acb052dfbf6d291400add558b59ad0e6d0c5f42f3ec3e1.exe	schtasks.exe
PID 3604 wrote to memory of 3080	3604	c4771044788147e2c9acb052dfbf6d291400add558b59ad0e6d0c5f42f3ec3e1.exe	schtasks.exe
PID 3604 wrote to memory of 648	3604	c4771044788147e2c9acb052dfbf6d291400add558b59ad0e6d0c5f42f3ec3e1.exe	c4771044788147e2c9acb052dfbf6d291400add558b59ad0e6d0c5f42f3ec3e1.exe
PID 3604 wrote to memory of 648	3604	c4771044788147e2c9acb052dfbf6d291400add558b59ad0e6d0c5f42f3ec3e1.exe	c4771044788147e2c9acb052dfbf6d291400add558b59ad0e6d0c5f42f3ec3e1.exe
PID 3604 wrote to memory of 648	3604	c4771044788147e2c9acb052dfbf6d291400add558b59ad0e6d0c5f42f3ec3e1.exe	c4771044788147e2c9acb052dfbf6d291400add558b59ad0e6d0c5f42f3ec3e1.exe
PID 3604 wrote to memory of 648	3604	c4771044788147e2c9acb052dfbf6d291400add558b59ad0e6d0c5f42f3ec3e1.exe	c4771044788147e2c9acb052dfbf6d291400add558b59ad0e6d0c5f42f3ec3e1.exe
PID 3604 wrote to memory of 648	3604	c4771044788147e2c9acb052dfbf6d291400add558b59ad0e6d0c5f42f3ec3e1.exe	c4771044788147e2c9acb052dfbf6d291400add558b59ad0e6d0c5f42f3ec3e1.exe
PID 3604 wrote to memory of 648	3604	c4771044788147e2c9acb052dfbf6d291400add558b59ad0e6d0c5f42f3ec3e1.exe	c4771044788147e2c9acb052dfbf6d291400add558b59ad0e6d0c5f42f3ec3e1.exe

C:\Users\Admin\AppData\Local\Temp\c4771044788147e2c9acb052dfbf6d291400add558b59ad0e6d0c5f42f3ec3e1.exe
"C:\Users\Admin\AppData\Local\Temp\c4771044788147e2c9acb052dfbf6d291400add558b59ad0e6d0c5f42f3ec3e1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3604

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\kTtZEsPaZu.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3784

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kTtZEsPaZu" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6D5C.tmp"
2⤵
- Creates scheduled task(s)
PID:3080

C:\Users\Admin\AppData\Local\Temp\c4771044788147e2c9acb052dfbf6d291400add558b59ad0e6d0c5f42f3ec3e1.exe
"C:\Users\Admin\AppData\Local\Temp\c4771044788147e2c9acb052dfbf6d291400add558b59ad0e6d0c5f42f3ec3e1.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:648

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp6D5C.tmp
MD5
1440f2bd89759b01ffab0ef74bc670cb

SHA1
608ba37a7de4dfafc56f70c0106c79855a00f202

SHA256
0f9bd810decef5085bead39e9083a00d3bb4cec433e7874cbd056aa032053790

SHA512
02d10ad8e1c3cf3becf19cd4a730f27e221ef9bd147e2671829fe53bb7dc33844d687914dfba84cab2b7afdcf489fd45fe048ca31c67adc6b5995f046b126e15

Download Submit
memory/648-134-0x00000000018B0000-0x0000000001BD0000-memory.dmp

Filesize
3.1MB

Download
memory/648-127-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3604-115-0x0000000000910000-0x000000000097E000-memory.dmp

Filesize
440KB

Download
memory/3604-116-0x0000000005770000-0x0000000005C6E000-memory.dmp

Filesize
5.0MB

Download
memory/3604-117-0x00000000051C0000-0x0000000005252000-memory.dmp

Filesize
584KB

Download
memory/3604-118-0x00000000051B0000-0x00000000051BA000-memory.dmp

Filesize
40KB

Download
memory/3604-119-0x0000000005270000-0x000000000576E000-memory.dmp

Filesize
5.0MB

Download
memory/3604-120-0x0000000005400000-0x000000000540C000-memory.dmp

Filesize
48KB

Download
memory/3604-121-0x00000000078D0000-0x000000000796C000-memory.dmp

Filesize
624KB

Download
memory/3604-122-0x0000000007B60000-0x0000000007BCA000-memory.dmp

Filesize
424KB

Download
memory/3784-131-0x0000000006B90000-0x0000000006BB2000-memory.dmp

Filesize
136KB

Download
memory/3784-137-0x0000000007530000-0x000000000757B000-memory.dmp

Filesize
300KB

Download
memory/3784-129-0x0000000000F10000-0x0000000000F11000-memory.dmp

Filesize
4KB

Download
memory/3784-128-0x0000000006DE0000-0x0000000007408000-memory.dmp

Filesize
6.2MB

Download
memory/3784-132-0x0000000007580000-0x00000000075E6000-memory.dmp

Filesize
408KB

Download
memory/3784-133-0x0000000006D70000-0x0000000006DD6000-memory.dmp

Filesize
408KB

Download
memory/3784-126-0x0000000000DB0000-0x0000000000DE6000-memory.dmp

Filesize
216KB

Download
memory/3784-135-0x00000000075F0000-0x0000000007940000-memory.dmp

Filesize
3.3MB

Download
memory/3784-136-0x00000000068D0000-0x00000000068EC000-memory.dmp

Filesize
112KB

Download
memory/3784-130-0x0000000000F12000-0x0000000000F13000-memory.dmp

Filesize
4KB

Download
memory/3784-138-0x0000000007DA0000-0x0000000007E16000-memory.dmp

Filesize
472KB

Download
memory/3784-147-0x0000000008BE0000-0x0000000008C13000-memory.dmp

Filesize
204KB

Download
memory/3784-148-0x0000000007E80000-0x0000000007E9E000-memory.dmp

Filesize
120KB

Download
memory/3784-153-0x0000000008D20000-0x0000000008DC5000-memory.dmp

Filesize
660KB

Download
memory/3784-154-0x0000000009100000-0x0000000009194000-memory.dmp

Filesize
592KB

Download
memory/3784-155-0x000000007E5F0000-0x000000007E5F1000-memory.dmp

Filesize
4KB

Download
memory/3784-156-0x0000000000F13000-0x0000000000F14000-memory.dmp

Filesize
4KB

Download
memory/3784-349-0x0000000008B20000-0x0000000008B3A000-memory.dmp

Filesize
104KB

Download
memory/3784-354-0x0000000008B10000-0x0000000008B18000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads