formbook | 90c16547e527be04c7fbea515f8dcea9f00353bf4394ecd45f891ab07085b575

General

Target
6e2d67b23e4bc268bbf9c83e15dc4154.exe
Size 508KB
Sample220408-lssecsbgc7
SHA256 90c16547e527be04c7fbea515f8dcea9f00353bf4394ecd45f891ab07085b575
MD5 6e2d67b23e4bc268bbf9c83e15dc4154
SHA1 da9bf145c66812e148fb70f1b36badabd9aa4989
SHA512 d2b62e64f545cc502e6b69bf51ea6b1db61a649b2004e10c50af266a5031859e268bec6783430af208c3ac8d61e7775ec808146038e86b44761d8e84d2888621
MD5 SHA1 SHA512

Score

10^/10

formbook s4s9 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

s4s9

Decoy

qianyuandianshang.com
bernardklein.com
slhomeservices.com
findasaas.com
janellelancaster.xyz
umkpro.site
nr6949.online
mersquare.club
lanariproperties.com
3rdeyefocused.com
giftexpress8260.xyz
hilleleven.xyz
beajod.com
kosazs.online
ishare.team
mb314.com
xjjinxingda.com
ayekooprojectamazing.com
ballsybanter.com
todayshoppingbd.com
recomdietvl.store
zakladmalarstwa.com
bj-ours.com
hubwealth.com
watchmyreview.com
sallyliddicoat.com
eventiliveitalia.com
worldchannelconference.com
suciptahadi.online
ksht5566.com
topfastcashsystemwebshop.com
eyeiieyetv.com
thewarchannel.net
valorousgamers.com
vip01ytre.xyz
szec.tech
233365.xyz
specialroute.net
eugenachase.com
pikoulas.com
shorter-658423.site
win8856.com
burleyqpersianscom.com
sidetrackedmusic.com
chungketvinhomesspotlight.com
qiange.site
motconsultant.com
yottatic.com
usaprostatecenter.com
putovanjazasve.com
kozykornerpizza.com
hainpore.com
52appmj.com
albanyskylights.com
keropy.xyz
infosecrety.xyz
ethlogo.com
labohack.com
veridiumid.xyz
gaylebong.com
rsmegastore.com
janschlesinger.com
cshong-ya.com
shopevix.com
preciousssllc.net

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

resource	yara_rule
behavioral1/memory/472-66-0x000000000041F0E0-mapping.dmp	formbook
behavioral1/memory/472-65-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1084 set thread context of 472	1084	6e2d67b23e4bc268bbf9c83e15dc4154.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1536	472	WerFault.exe	32

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1288	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1084	6e2d67b23e4bc268bbf9c83e15dc4154.exe
1084	6e2d67b23e4bc268bbf9c83e15dc4154.exe
1084	6e2d67b23e4bc268bbf9c83e15dc4154.exe
1244	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1084	6e2d67b23e4bc268bbf9c83e15dc4154.exe
Token: SeDebugPrivilege	1244	powershell.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1084 wrote to memory of 1244	1084	6e2d67b23e4bc268bbf9c83e15dc4154.exe	28
PID 1084 wrote to memory of 1244	1084	6e2d67b23e4bc268bbf9c83e15dc4154.exe	28
PID 1084 wrote to memory of 1244	1084	6e2d67b23e4bc268bbf9c83e15dc4154.exe	28
PID 1084 wrote to memory of 1244	1084	6e2d67b23e4bc268bbf9c83e15dc4154.exe	28
PID 1084 wrote to memory of 1288	1084	6e2d67b23e4bc268bbf9c83e15dc4154.exe	30
PID 1084 wrote to memory of 1288	1084	6e2d67b23e4bc268bbf9c83e15dc4154.exe	30
PID 1084 wrote to memory of 1288	1084	6e2d67b23e4bc268bbf9c83e15dc4154.exe	30
PID 1084 wrote to memory of 1288	1084	6e2d67b23e4bc268bbf9c83e15dc4154.exe	30
PID 1084 wrote to memory of 472	1084	6e2d67b23e4bc268bbf9c83e15dc4154.exe	32
PID 1084 wrote to memory of 472	1084	6e2d67b23e4bc268bbf9c83e15dc4154.exe	32
PID 1084 wrote to memory of 472	1084	6e2d67b23e4bc268bbf9c83e15dc4154.exe	32
PID 1084 wrote to memory of 472	1084	6e2d67b23e4bc268bbf9c83e15dc4154.exe	32
PID 1084 wrote to memory of 472	1084	6e2d67b23e4bc268bbf9c83e15dc4154.exe	32
PID 1084 wrote to memory of 472	1084	6e2d67b23e4bc268bbf9c83e15dc4154.exe	32
PID 1084 wrote to memory of 472	1084	6e2d67b23e4bc268bbf9c83e15dc4154.exe	32
PID 1084 wrote to memory of 472	1084	6e2d67b23e4bc268bbf9c83e15dc4154.exe	32
PID 1084 wrote to memory of 472	1084	6e2d67b23e4bc268bbf9c83e15dc4154.exe	32
PID 1084 wrote to memory of 472	1084	6e2d67b23e4bc268bbf9c83e15dc4154.exe	32
PID 472 wrote to memory of 1536	472	RegSvcs.exe	33
PID 472 wrote to memory of 1536	472	RegSvcs.exe	33
PID 472 wrote to memory of 1536	472	RegSvcs.exe	33
PID 472 wrote to memory of 1536	472	RegSvcs.exe	33

C:\Users\Admin\AppData\Local\Temp\6e2d67b23e4bc268bbf9c83e15dc4154.exe
"C:\Users\Admin\AppData\Local\Temp\6e2d67b23e4bc268bbf9c83e15dc4154.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\CsopCqipvdNh.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1244
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CsopCqipvdNh" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7205.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1288
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:472
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 472 -s 36
    3⤵
    - Program crash
    PID:1536

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp7205.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp7205.tmp
Size 1KB
SHA256 e18bc307132d38f2f03b023e08a663bc4e841790da3f0cb2916d4caf0ce5c79b
MD5 365f1a720cda4c08c990c14d6243ba36
SHA1 0dc1d6721d76fc741c382860f38a2a68053ad1b1
SHA512 ad335fa704a44a5ef160e2123acb61686ca0f4adcadfa3574f10c651c7f17ab2d49a8e8517e57f5715f749fe5770ad5406ad7f8e95b9d20e87efdda1a567a5dd
MD5 SHA1 SHA512

Submit Download

memory/472-63-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/472-65-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/472-62-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1084-55-0x0000000000610000-0x000000000061A000-memory.dmp

Download

memory/1084-61-0x0000000005060000-0x0000000005094000-memory.dmp

Download

memory/1084-54-0x0000000001280000-0x0000000001306000-memory.dmp

Download

memory/1084-56-0x0000000005160000-0x00000000051D8000-memory.dmp

Download

memory/1244-59-0x00000000755B1000-0x00000000755B3000-memory.dmp

Download

memory/1244-69-0x0000000000342000-0x0000000000344000-memory.dmp

Download

memory/1244-68-0x000000006E4C0000-0x000000006EA6B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads