formbook | c4771044788147e2c9acb052dfbf6d291400add558b59ad0e6d0c5f42f3ec3e1

General

Target

43357f80bc70e0db9fb0c304a962e3de.exe
Size

414KB
MD5

43357f80bc70e0db9fb0c304a962e3de
SHA1

50b6a0a1fb9d9af63523b9a186e88c279c591274
SHA256

c4771044788147e2c9acb052dfbf6d291400add558b59ad0e6d0c5f42f3ec3e1
SHA512

186ce7a33d8bbbc821f689e7f736f8648b827c981a72eccddbeed1861b05bbc014866c8c138993981f6cd7bb864466ef21912c92f13d8072247efb02f5a60ff0

Score

10^/10

formbook g2fg rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

g2fg

Decoy

snowcrash.website

pointman.us

newheartvalve.care

drandl.com

sandspringsramblers.com

programagubernamental.online

boja.us

mvrsnike.com

mentallyillmotherhood.com

facom.us

programagubernamental.store

izivente.com

roller-v.fr

amazonbioactives.com

metaverseapple.xyz

5gt-mobilevsverizon.com

gtwebsolutions.co

scottdunn.life

usdp.trade

pikmin.run

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/992-63-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1732-66-0x00000000024B0000-0x00000000030FA000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

43357f80bc70e0db9fb0c304a962e3de.exe

description pid process target process

PID 1276 set thread context of 992 1276 43357f80bc70e0db9fb0c304a962e3de.exe 43357f80bc70e0db9fb0c304a962e3de.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1904 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe43357f80bc70e0db9fb0c304a962e3de.exe

pid process

1732 powershell.exe
992 43357f80bc70e0db9fb0c304a962e3de.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1732 powershell.exe

description	pid	process	target process
PID 1276 set thread context of 992	1276	43357f80bc70e0db9fb0c304a962e3de.exe	43357f80bc70e0db9fb0c304a962e3de.exe

pid	process
1904	schtasks.exe

pid	process
1732	powershell.exe
992	43357f80bc70e0db9fb0c304a962e3de.exe

description	pid	process
Token: SeDebugPrivilege	1732	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

43357f80bc70e0db9fb0c304a962e3de.exe

description	pid	process	target process
PID 1276 wrote to memory of 1732	1276	43357f80bc70e0db9fb0c304a962e3de.exe	powershell.exe
PID 1276 wrote to memory of 1732	1276	43357f80bc70e0db9fb0c304a962e3de.exe	powershell.exe
PID 1276 wrote to memory of 1732	1276	43357f80bc70e0db9fb0c304a962e3de.exe	powershell.exe
PID 1276 wrote to memory of 1732	1276	43357f80bc70e0db9fb0c304a962e3de.exe	powershell.exe
PID 1276 wrote to memory of 1904	1276	43357f80bc70e0db9fb0c304a962e3de.exe	schtasks.exe
PID 1276 wrote to memory of 1904	1276	43357f80bc70e0db9fb0c304a962e3de.exe	schtasks.exe
PID 1276 wrote to memory of 1904	1276	43357f80bc70e0db9fb0c304a962e3de.exe	schtasks.exe
PID 1276 wrote to memory of 1904	1276	43357f80bc70e0db9fb0c304a962e3de.exe	schtasks.exe
PID 1276 wrote to memory of 992	1276	43357f80bc70e0db9fb0c304a962e3de.exe	43357f80bc70e0db9fb0c304a962e3de.exe
PID 1276 wrote to memory of 992	1276	43357f80bc70e0db9fb0c304a962e3de.exe	43357f80bc70e0db9fb0c304a962e3de.exe
PID 1276 wrote to memory of 992	1276	43357f80bc70e0db9fb0c304a962e3de.exe	43357f80bc70e0db9fb0c304a962e3de.exe
PID 1276 wrote to memory of 992	1276	43357f80bc70e0db9fb0c304a962e3de.exe	43357f80bc70e0db9fb0c304a962e3de.exe
PID 1276 wrote to memory of 992	1276	43357f80bc70e0db9fb0c304a962e3de.exe	43357f80bc70e0db9fb0c304a962e3de.exe
PID 1276 wrote to memory of 992	1276	43357f80bc70e0db9fb0c304a962e3de.exe	43357f80bc70e0db9fb0c304a962e3de.exe
PID 1276 wrote to memory of 992	1276	43357f80bc70e0db9fb0c304a962e3de.exe	43357f80bc70e0db9fb0c304a962e3de.exe

C:\Users\Admin\AppData\Local\Temp\43357f80bc70e0db9fb0c304a962e3de.exe
"C:\Users\Admin\AppData\Local\Temp\43357f80bc70e0db9fb0c304a962e3de.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1276

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\kTtZEsPaZu.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1732

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kTtZEsPaZu" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7B38.tmp"
2⤵
- Creates scheduled task(s)
PID:1904

C:\Users\Admin\AppData\Local\Temp\43357f80bc70e0db9fb0c304a962e3de.exe
"C:\Users\Admin\AppData\Local\Temp\43357f80bc70e0db9fb0c304a962e3de.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:992

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp7B38.tmp
MD5
2d100d15c7feea086cdfa7f74a191689

SHA1
a93dda4d5eac9ad86135f6726c34a23c2e4c1081

SHA256
75a8c49798d0abef09f4b2a93ca8a426f5caf93cce46e467951913fbd6f3fd09

SHA512
d5b6d46b6855936d104424fe762af9b2a90a1c7f6e50717d0a2d2caad9c99d37ace03b4d9e4c4727ab8a4ed51700560da0c530be32cf12f1d262cb0ab916c19c

Download Submit
memory/992-61-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/992-62-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/992-63-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1276-54-0x0000000000F20000-0x0000000000F8E000-memory.dmp

Filesize
440KB

Download
memory/1276-55-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download
memory/1276-56-0x0000000000A10000-0x0000000000A11000-memory.dmp

Filesize
4KB

Download
memory/1276-57-0x00000000004F0000-0x00000000004FC000-memory.dmp

Filesize
48KB

Download
memory/1276-58-0x0000000004EC0000-0x0000000004F2A000-memory.dmp

Filesize
424KB

Download
memory/1732-66-0x00000000024B0000-0x00000000030FA000-memory.dmp

Filesize
12.3MB

Download
memory/1732-67-0x00000000024B0000-0x00000000030FA000-memory.dmp

Filesize
12.3MB

Download
memory/1732-68-0x00000000024B0000-0x00000000030FA000-memory.dmp

Filesize
12.3MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads