formbook | 35147128936c2e79548e5c0a2bbd70cd5a29c1b01dfa1ac2515fa5becb7efa6d

Analysis

max time kernel
151s
max time network
143s
platform
windows7_x64
resource
win7-en-20211208
submitted
31/01/2022, 09:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
QUOTATION PDF_SCAN_COPY.exe
Size 523KB
Sample220131-llgdhsghfr
SHA256 35147128936c2e79548e5c0a2bbd70cd5a29c1b01dfa1ac2515fa5becb7efa6d
MD5 5e9af5b2056e4da639a9459e3b36193c
SHA1 b779402e9a6ecbbef6b68817814991bbcade12df
SHA512 4f293bab428aeead9c4b0a411a9d0674bebd87cf89d92f2aa0b1ffc4d287d96b859365453f21040abc7b5dd4f452f52ed98661b8c16624d9915d4c40ecfe15ea
MD5 SHA1 SHA512

Score

10^/10

formbook n2t4 rat spyware stealer suricata trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

n2t4

Decoy

livingthroughthechaos.net
videobuzzmedia.com
felineformulas.com
theorganicbees.com
bizoeflow.com
gtbcked.com
immortalapenft.com
pacherasrl.com
defunddrip.black
fromefarm.com
newmedicalnetwork.com
nikosblue.com
kaecfu.online
arcane-stylish.com
7ox.info
osamaabuzawayed.com
noemielatour.com
baccaratjava.com
latinfoodandwinefestival.com
magiclandstudios.com
shazpe.com
businessmanbazar.com
lifewithkatiewright.com
themarketingideascatalog.com
nickbrizhoops.com
esportsgamertv.com
delinointeriores.com
connotatetechnologies.net
cybomatic.cloud
correctmakling.site
thammydora.com
ageingwellhomecare.com
fleetwoodjobshop.site
jakulo.com
drbaren.com
newpointstudio.com
yxuqamnj.com
spiritsyncing.net
hy963app.com
rnp-trading-lukoil.com
bowlesuniverse.com
fumigacionesecouniversal.com
vulvip.com
heppi.pro
preetiplease.com
gemini-hk.icu
allyazek24.xyz
blackbratapparelcompany.com
immersivenm.com
mystoragewarehouse.com
dvjdob.icu
mecanicadesuelosrancagua.one
cayugacommunitysolar.com
parizes.site
vpsincnas.com
tattoo-marketplace.online
garadapatngklgamazon.com
signa.info
simplegourmetpa.com
quintanaroopt.com
studio-goettingen.com
brimhi.com
fabula-glass.com
1049hubertrd.com
faireez.club

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Formbook Payload 2 IoCs

rat

resource	yara_rule
behavioral1/memory/1768-63-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1928-73-0x0000000000090000-0x00000000000BF000-memory.dmp	formbook

Deletes itself 1 IoCs

pid	Process
1052	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1592 set thread context of 1768	1592	QUOTATION PDF_SCAN_COPY.exe	31
PID 1768 set thread context of 1396	1768	QUOTATION PDF_SCAN_COPY.exe	3
PID 1928 set thread context of 1396	1928	msiexec.exe	3

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1424	schtasks.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
1768	QUOTATION PDF_SCAN_COPY.exe
680	powershell.exe
1768	QUOTATION PDF_SCAN_COPY.exe
1928	msiexec.exe
1928	msiexec.exe
1928	msiexec.exe
1928	msiexec.exe
1928	msiexec.exe
1928	msiexec.exe
1928	msiexec.exe
1928	msiexec.exe
1928	msiexec.exe
1928	msiexec.exe
1928	msiexec.exe
1928	msiexec.exe
1928	msiexec.exe
1928	msiexec.exe
1928	msiexec.exe
1928	msiexec.exe
1928	msiexec.exe
1928	msiexec.exe
1928	msiexec.exe
1928	msiexec.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
1768	QUOTATION PDF_SCAN_COPY.exe
1768	QUOTATION PDF_SCAN_COPY.exe
1768	QUOTATION PDF_SCAN_COPY.exe
1928	msiexec.exe
1928	msiexec.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	680	powershell.exe
Token: SeDebugPrivilege	1768	QUOTATION PDF_SCAN_COPY.exe
Token: SeDebugPrivilege	1928	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1396	Explorer.EXE
1396	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1396	Explorer.EXE
1396	Explorer.EXE

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1592 wrote to memory of 680	1592	QUOTATION PDF_SCAN_COPY.exe	27
PID 1592 wrote to memory of 680	1592	QUOTATION PDF_SCAN_COPY.exe	27
PID 1592 wrote to memory of 680	1592	QUOTATION PDF_SCAN_COPY.exe	27
PID 1592 wrote to memory of 680	1592	QUOTATION PDF_SCAN_COPY.exe	27
PID 1592 wrote to memory of 1424	1592	QUOTATION PDF_SCAN_COPY.exe	29
PID 1592 wrote to memory of 1424	1592	QUOTATION PDF_SCAN_COPY.exe	29
PID 1592 wrote to memory of 1424	1592	QUOTATION PDF_SCAN_COPY.exe	29
PID 1592 wrote to memory of 1424	1592	QUOTATION PDF_SCAN_COPY.exe	29
PID 1592 wrote to memory of 1768	1592	QUOTATION PDF_SCAN_COPY.exe	31
PID 1592 wrote to memory of 1768	1592	QUOTATION PDF_SCAN_COPY.exe	31
PID 1592 wrote to memory of 1768	1592	QUOTATION PDF_SCAN_COPY.exe	31
PID 1592 wrote to memory of 1768	1592	QUOTATION PDF_SCAN_COPY.exe	31
PID 1592 wrote to memory of 1768	1592	QUOTATION PDF_SCAN_COPY.exe	31
PID 1592 wrote to memory of 1768	1592	QUOTATION PDF_SCAN_COPY.exe	31
PID 1592 wrote to memory of 1768	1592	QUOTATION PDF_SCAN_COPY.exe	31
PID 1396 wrote to memory of 1928	1396	Explorer.EXE	32
PID 1396 wrote to memory of 1928	1396	Explorer.EXE	32
PID 1396 wrote to memory of 1928	1396	Explorer.EXE	32
PID 1396 wrote to memory of 1928	1396	Explorer.EXE	32
PID 1396 wrote to memory of 1928	1396	Explorer.EXE	32
PID 1396 wrote to memory of 1928	1396	Explorer.EXE	32
PID 1396 wrote to memory of 1928	1396	Explorer.EXE	32
PID 1928 wrote to memory of 1052	1928	msiexec.exe	33
PID 1928 wrote to memory of 1052	1928	msiexec.exe	33
PID 1928 wrote to memory of 1052	1928	msiexec.exe	33
PID 1928 wrote to memory of 1052	1928	msiexec.exe	33

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Users\Admin\AppData\Local\Temp\QUOTATION PDF_SCAN_COPY.exe
  "C:\Users\Admin\AppData\Local\Temp\QUOTATION PDF_SCAN_COPY.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1592
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\KHDScDG.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:680
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\KHDScDG" /XML "C:\Users\Admin\AppData\Local\Temp\tmp76E5.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:1424
- - C:\Users\Admin\AppData\Local\Temp\QUOTATION PDF_SCAN_COPY.exe
    "C:\Users\Admin\AppData\Local\Temp\QUOTATION PDF_SCAN_COPY.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:1768
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1928
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\QUOTATION PDF_SCAN_COPY.exe"
    3⤵
    - Deletes itself
    PID:1052

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/680-65-0x0000000002720000-0x000000000336A000-memory.dmp

Download

memory/680-69-0x0000000002720000-0x000000000336A000-memory.dmp

Download

memory/680-68-0x0000000002720000-0x000000000336A000-memory.dmp

Download

memory/1396-76-0x0000000007E60000-0x0000000007FC9000-memory.dmp

Download

memory/1396-67-0x0000000006CC0000-0x0000000006E6B000-memory.dmp

Download

memory/1592-58-0x0000000005590000-0x00000000055F6000-memory.dmp

Download

memory/1592-57-0x0000000000410000-0x0000000000424000-memory.dmp

Download

memory/1592-54-0x0000000000B40000-0x0000000000BCA000-memory.dmp

Download

memory/1592-55-0x0000000075D51000-0x0000000075D53000-memory.dmp

Download

memory/1592-56-0x00000000005A0000-0x0000000000700000-memory.dmp

Download

memory/1768-61-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1768-63-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1768-62-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1768-70-0x0000000000BD0000-0x0000000000ED3000-memory.dmp

Download

memory/1768-66-0x0000000000210000-0x0000000000225000-memory.dmp

Download

memory/1928-72-0x0000000000770000-0x0000000000784000-memory.dmp

Download

memory/1928-73-0x0000000000090000-0x00000000000BF000-memory.dmp

Download

memory/1928-74-0x00000000021C0000-0x00000000024C3000-memory.dmp

Download

memory/1928-75-0x0000000002030000-0x00000000020C4000-memory.dmp

Download