formbook | c4771044788147e2c9acb052dfbf6d291400add558b59ad0e6d0c5f42f3ec3e1

General

Target

43357f80bc70e0db9fb0c304a962e3de.exe
Size

414KB
MD5

43357f80bc70e0db9fb0c304a962e3de
SHA1

50b6a0a1fb9d9af63523b9a186e88c279c591274
SHA256

c4771044788147e2c9acb052dfbf6d291400add558b59ad0e6d0c5f42f3ec3e1
SHA512

186ce7a33d8bbbc821f689e7f736f8648b827c981a72eccddbeed1861b05bbc014866c8c138993981f6cd7bb864466ef21912c92f13d8072247efb02f5a60ff0

Score

10^/10

formbook g2fg rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

g2fg

Decoy

snowcrash.website

pointman.us

newheartvalve.care

drandl.com

sandspringsramblers.com

programagubernamental.online

boja.us

mvrsnike.com

mentallyillmotherhood.com

facom.us

programagubernamental.store

izivente.com

roller-v.fr

amazonbioactives.com

metaverseapple.xyz

5gt-mobilevsverizon.com

gtwebsolutions.co

scottdunn.life

usdp.trade

pikmin.run

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3028-127-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

43357f80bc70e0db9fb0c304a962e3de.exe

description pid process target process

PID 2700 set thread context of 3028 2700 43357f80bc70e0db9fb0c304a962e3de.exe 43357f80bc70e0db9fb0c304a962e3de.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

664 schtasks.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

43357f80bc70e0db9fb0c304a962e3de.exepowershell.exe

pid process

3028 43357f80bc70e0db9fb0c304a962e3de.exe
3028 43357f80bc70e0db9fb0c304a962e3de.exe
2600 powershell.exe
2600 powershell.exe
2600 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2600 powershell.exe

description	pid	process	target process
PID 2700 set thread context of 3028	2700	43357f80bc70e0db9fb0c304a962e3de.exe	43357f80bc70e0db9fb0c304a962e3de.exe

pid	process
664	schtasks.exe

pid	process
3028	43357f80bc70e0db9fb0c304a962e3de.exe
3028	43357f80bc70e0db9fb0c304a962e3de.exe
2600	powershell.exe
2600	powershell.exe
2600	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2600	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

43357f80bc70e0db9fb0c304a962e3de.exe

description	pid	process	target process
PID 2700 wrote to memory of 2600	2700	43357f80bc70e0db9fb0c304a962e3de.exe	powershell.exe
PID 2700 wrote to memory of 2600	2700	43357f80bc70e0db9fb0c304a962e3de.exe	powershell.exe
PID 2700 wrote to memory of 2600	2700	43357f80bc70e0db9fb0c304a962e3de.exe	powershell.exe
PID 2700 wrote to memory of 664	2700	43357f80bc70e0db9fb0c304a962e3de.exe	schtasks.exe
PID 2700 wrote to memory of 664	2700	43357f80bc70e0db9fb0c304a962e3de.exe	schtasks.exe
PID 2700 wrote to memory of 664	2700	43357f80bc70e0db9fb0c304a962e3de.exe	schtasks.exe
PID 2700 wrote to memory of 3028	2700	43357f80bc70e0db9fb0c304a962e3de.exe	43357f80bc70e0db9fb0c304a962e3de.exe
PID 2700 wrote to memory of 3028	2700	43357f80bc70e0db9fb0c304a962e3de.exe	43357f80bc70e0db9fb0c304a962e3de.exe
PID 2700 wrote to memory of 3028	2700	43357f80bc70e0db9fb0c304a962e3de.exe	43357f80bc70e0db9fb0c304a962e3de.exe
PID 2700 wrote to memory of 3028	2700	43357f80bc70e0db9fb0c304a962e3de.exe	43357f80bc70e0db9fb0c304a962e3de.exe
PID 2700 wrote to memory of 3028	2700	43357f80bc70e0db9fb0c304a962e3de.exe	43357f80bc70e0db9fb0c304a962e3de.exe
PID 2700 wrote to memory of 3028	2700	43357f80bc70e0db9fb0c304a962e3de.exe	43357f80bc70e0db9fb0c304a962e3de.exe

C:\Users\Admin\AppData\Local\Temp\43357f80bc70e0db9fb0c304a962e3de.exe
"C:\Users\Admin\AppData\Local\Temp\43357f80bc70e0db9fb0c304a962e3de.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2700

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\kTtZEsPaZu.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2600

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kTtZEsPaZu" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5CD2.tmp"
2⤵
- Creates scheduled task(s)
PID:664

C:\Users\Admin\AppData\Local\Temp\43357f80bc70e0db9fb0c304a962e3de.exe
"C:\Users\Admin\AppData\Local\Temp\43357f80bc70e0db9fb0c304a962e3de.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3028

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp5CD2.tmp
MD5
1440f2bd89759b01ffab0ef74bc670cb

SHA1
608ba37a7de4dfafc56f70c0106c79855a00f202

SHA256
0f9bd810decef5085bead39e9083a00d3bb4cec433e7874cbd056aa032053790

SHA512
02d10ad8e1c3cf3becf19cd4a730f27e221ef9bd147e2671829fe53bb7dc33844d687914dfba84cab2b7afdcf489fd45fe048ca31c67adc6b5995f046b126e15

Download Submit
memory/2600-138-0x0000000007CC0000-0x0000000007D36000-memory.dmp

Filesize
472KB

Download
memory/2600-148-0x0000000008CE0000-0x0000000008CFE000-memory.dmp

Filesize
120KB

Download
memory/2600-132-0x0000000006BA0000-0x0000000006BC2000-memory.dmp

Filesize
136KB

Download
memory/2600-354-0x00000000067D0000-0x00000000067D8000-memory.dmp

Filesize
32KB

Download
memory/2600-133-0x00000000072C0000-0x0000000007326000-memory.dmp

Filesize
408KB

Download
memory/2600-349-0x00000000067E0000-0x00000000067FA000-memory.dmp

Filesize
104KB

Download
memory/2600-156-0x0000000009000000-0x0000000009094000-memory.dmp

Filesize
592KB

Download
memory/2600-154-0x000000007EDB0000-0x000000007EDB1000-memory.dmp

Filesize
4KB

Download
memory/2600-126-0x0000000000CC0000-0x0000000000CF6000-memory.dmp

Filesize
216KB

Download
memory/2600-155-0x0000000000D63000-0x0000000000D64000-memory.dmp

Filesize
4KB

Download
memory/2600-128-0x0000000006C90000-0x00000000072B8000-memory.dmp

Filesize
6.2MB

Download
memory/2600-134-0x0000000007510000-0x0000000007576000-memory.dmp

Filesize
408KB

Download
memory/2600-130-0x0000000000D60000-0x0000000000D61000-memory.dmp

Filesize
4KB

Download
memory/2600-131-0x0000000000D62000-0x0000000000D63000-memory.dmp

Filesize
4KB

Download
memory/2600-153-0x0000000008E40000-0x0000000008EE5000-memory.dmp

Filesize
660KB

Download
memory/2600-147-0x0000000008D00000-0x0000000008D33000-memory.dmp

Filesize
204KB

Download
memory/2600-137-0x0000000007E60000-0x0000000007EAB000-memory.dmp

Filesize
300KB

Download
memory/2600-135-0x0000000007660000-0x00000000079B0000-memory.dmp

Filesize
3.3MB

Download
memory/2600-136-0x00000000074F0000-0x000000000750C000-memory.dmp

Filesize
112KB

Download
memory/2700-115-0x0000000000B50000-0x0000000000BBE000-memory.dmp

Filesize
440KB

Download
memory/2700-120-0x0000000005630000-0x000000000563C000-memory.dmp

Filesize
48KB

Download
memory/2700-117-0x0000000005410000-0x00000000054A2000-memory.dmp

Filesize
584KB

Download
memory/2700-118-0x00000000053F0000-0x00000000053FA000-memory.dmp

Filesize
40KB

Download
memory/2700-116-0x0000000005870000-0x0000000005D6E000-memory.dmp

Filesize
5.0MB

Download
memory/2700-122-0x0000000007DA0000-0x0000000007E0A000-memory.dmp

Filesize
424KB

Download
memory/2700-121-0x0000000007B10000-0x0000000007BAC000-memory.dmp

Filesize
624KB

Download
memory/2700-119-0x0000000005370000-0x000000000586E000-memory.dmp

Filesize
5.0MB

Download
memory/3028-129-0x0000000001350000-0x0000000001670000-memory.dmp

Filesize
3.1MB

Download
memory/3028-127-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads