formbook | 75b7d30e6f26fbb3fbac284ed75356cc874e73365764130209d4937d80a6c80d

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220331-en
submitted
12/04/2022, 12:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fcaf1de8fea0ac779b0abc17a1029969.exe
Size 688KB
Sample220412-pnwsrseee2
SHA256 75b7d30e6f26fbb3fbac284ed75356cc874e73365764130209d4937d80a6c80d
MD5 fcaf1de8fea0ac779b0abc17a1029969
SHA1 f99793f1d32f992372abfbabb8c79e25a2753c3f
SHA512 72701fbd87a0ed25c7faaa6c61a3b394dc867c70f6f9013918859d4b13e183282306c5d80d68810a8e6af0b582a3cea05a1cfdd69d5b625f61c3760db5417db7
MD5 SHA1 SHA512

Score

10^/10

formbook b2a4 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

b2a4

Decoy

firstrootsfarmmi.com
haywardsh.xyz
duocnamson.com
theginhanh.net
camilisboutique.com
wilsonmarble.com
lakelandhs1980.com
wilmington.expert
askartoon.com
sedox-web.com
avantgardespiritof.com
menofspeed.com
veniceclothing.com
banaqi.com
churchmediaroom.com
hawaiivog.com
healthyplantet.com
weidenhaft.com
atmcml.com
shaokangjiu.com
musiccityindustrialstaffing.com
millerandsonsproductions.com
packaged.network
quieroleads.com
xn--subespao-j3a.com
geogoup.com
dorchesterdreampark.com
visionarytitan.com
wingsofeagleslifeservices.com
clinault.com
wortex-shop.com
bintangmaraga.com
barrnwellandlong.com
solarlightdongthap.com
montelibero.club
bankbnwc.com
belgiebouwt.com
wnoclen.site
marissa-test-mberg.com
medscie.online
agrigentoperduta.store
motorpuppet.com
docevidaconfeitaria.com
ybdgdv.biz
xk9bm875h488kc.xyz
nkwan.biz
iqzrlo.info
nortvew.online
alisblue.net
vlgfd.icu
nguyenwebcompany.net
dobbenetes.com
qvgye.icu
lovecamilleph.com
maslakmaster.com
confisshop.com
candycurvi.com
tarduhukuk.com
freightmonkey.net
mevlanatours.online
pavanneimportados.com
ablegarotel.site
primal-jerky.com
palanishopping.online
chenjiexu.club

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 4 IoCs

rat

resource	yara_rule
behavioral2/memory/4280-132-0x0000000000000000-mapping.dmp	formbook
behavioral2/memory/4280-133-0x0000000010410000-0x000000001043F000-memory.dmp	formbook
behavioral2/memory/4280-134-0x0000000010410000-0x000000001043F000-memory.dmp	formbook
behavioral2/memory/216-141-0x0000000000630000-0x000000000065F000-memory.dmp	formbook

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4280 set thread context of 2780	4280	DpiScaling.exe	27
PID 216 set thread context of 2780	216	mstsc.exe	27

Suspicious behavior: EnumeratesProcesses 56 IoCs

pid	Process
4280	DpiScaling.exe
4280	DpiScaling.exe
4280	DpiScaling.exe
4280	DpiScaling.exe
216	mstsc.exe
216	mstsc.exe
216	mstsc.exe
216	mstsc.exe
216	mstsc.exe
216	mstsc.exe
216	mstsc.exe
216	mstsc.exe
216	mstsc.exe
216	mstsc.exe
216	mstsc.exe
216	mstsc.exe
216	mstsc.exe
216	mstsc.exe
216	mstsc.exe
216	mstsc.exe
216	mstsc.exe
216	mstsc.exe
216	mstsc.exe
216	mstsc.exe
216	mstsc.exe
216	mstsc.exe
216	mstsc.exe
216	mstsc.exe
216	mstsc.exe
216	mstsc.exe
216	mstsc.exe
216	mstsc.exe
216	mstsc.exe
216	mstsc.exe
216	mstsc.exe
216	mstsc.exe
216	mstsc.exe
216	mstsc.exe
216	mstsc.exe
216	mstsc.exe
216	mstsc.exe
216	mstsc.exe
216	mstsc.exe
216	mstsc.exe
216	mstsc.exe
216	mstsc.exe
216	mstsc.exe
216	mstsc.exe
216	mstsc.exe
216	mstsc.exe
216	mstsc.exe
216	mstsc.exe
216	mstsc.exe
216	mstsc.exe
216	mstsc.exe
216	mstsc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2780	Explorer.EXE

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
4280	DpiScaling.exe
4280	DpiScaling.exe
4280	DpiScaling.exe
216	mstsc.exe
216	mstsc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4280	DpiScaling.exe
Token: SeDebugPrivilege	216	mstsc.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 844 wrote to memory of 4280	844	fcaf1de8fea0ac779b0abc17a1029969.exe	81
PID 844 wrote to memory of 4280	844	fcaf1de8fea0ac779b0abc17a1029969.exe	81
PID 844 wrote to memory of 4280	844	fcaf1de8fea0ac779b0abc17a1029969.exe	81
PID 844 wrote to memory of 4280	844	fcaf1de8fea0ac779b0abc17a1029969.exe	81
PID 844 wrote to memory of 4280	844	fcaf1de8fea0ac779b0abc17a1029969.exe	81
PID 844 wrote to memory of 4280	844	fcaf1de8fea0ac779b0abc17a1029969.exe	81
PID 2780 wrote to memory of 216	2780	Explorer.EXE	104
PID 2780 wrote to memory of 216	2780	Explorer.EXE	104
PID 2780 wrote to memory of 216	2780	Explorer.EXE	104
PID 216 wrote to memory of 936	216	mstsc.exe	105
PID 216 wrote to memory of 936	216	mstsc.exe	105
PID 216 wrote to memory of 936	216	mstsc.exe	105

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Users\Admin\AppData\Local\Temp\fcaf1de8fea0ac779b0abc17a1029969.exe
  "C:\Users\Admin\AppData\Local\Temp\fcaf1de8fea0ac779b0abc17a1029969.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:844
- - C:\Windows\SysWOW64\DpiScaling.exe
    C:\Windows\System32\DpiScaling.exe
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:4280
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:4684
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:4680
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:2144
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:4524
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:4536
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:4532
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:3148
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:1656
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:3372
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:4984
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:1152
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:1536
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:4416
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:3480
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:4888
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:3084
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:4836
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:2908
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:1436
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:540
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:1508
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:384
- C:\Windows\SysWOW64\mstsc.exe
  "C:\Windows\SysWOW64\mstsc.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:216
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Windows\SysWOW64\DpiScaling.exe"
    3⤵
    PID:936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/216-141-0x0000000000630000-0x000000000065F000-memory.dmp

Download

memory/216-140-0x0000000000DF0000-0x0000000000F2A000-memory.dmp

Download

memory/216-142-0x00000000026A0000-0x00000000029EA000-memory.dmp

Download

memory/216-143-0x0000000002540000-0x00000000025D3000-memory.dmp

Download

memory/2780-137-0x00000000082B0000-0x00000000083FD000-memory.dmp

Download

memory/2780-144-0x0000000002B10000-0x0000000002BD9000-memory.dmp

Download

memory/4280-133-0x0000000010410000-0x000000001043F000-memory.dmp

Download

memory/4280-134-0x0000000010410000-0x000000001043F000-memory.dmp

Download

memory/4280-135-0x0000000002F40000-0x000000000328A000-memory.dmp

Download

memory/4280-136-0x0000000002E30000-0x0000000002E44000-memory.dmp

Download