formbook | ae2b607c9b6ba263d98e7bf7e0ed87287c33304752cf492dfff6f253f3e43289

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220331-en
submitted
13/04/2022, 14:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Purchase Order (#11022020]pdf.exe
Size 324KB
Sample220413-rgn6fscdf6
SHA256 ae2b607c9b6ba263d98e7bf7e0ed87287c33304752cf492dfff6f253f3e43289
MD5 830c172be768d43b77dfd43ac984dd29
SHA1 079093543ad905434cc8cf6726b95ce5682ad1e7
SHA512 ed8c3e273678a9ccf375bcbe0a0d7e6431591d4fe2a430aa24ed0c7331f8347bef580bc10df8ac768cfc307ea966d6b6d1430ae7083c43e276fcec1ee7d2772c
MD5 SHA1 SHA512

Score

10^/10

formbook o27j rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

o27j

Decoy

catchakiller.net
nansatsu-meguri.com
torshowroom.com
loglog.company
diabetvn.online
pernie.digital
shopblodie.com
suzettedavidrealtor.com
892uc.com
behlfamily.com
crazeekandee.com
internationalestimatings.com
afifurnishing.com
bjsalt2fen.com
tamdietitian.com
lo-nen.com
nanjinghu.com
dcato.xyz
right-on-target-store.com
xn--399a9jk03ai6p.com
kassa-3d.xyz
lenteramasadepan.com
thejesusmindset.com
xn--vhqv2wnkfj3a.com
alfbj.com
kalyuggames.online
eliteprowiters.com
moneyhustleboys.com
doghouseboyz.com
frozenlech.com
ejcinsurancefinancial.com
finprops.com
topfashionkids.com
newhealthscienceformula.com
niwisee.com
tokenwad.com
lesvacancesauxpoils.com
livingthered.com
dkovy.com
ineedhelpmovingthis.com
piaomiaozhilv.com
gelecekrobotikkodlama.xyz
381741.com
ils-kevin.com
lasouq.com
worldofexam.com
saigonkicking.biz
lelegianstudies.com
kastore.club
movingikea.com
olaole.xyz
opticaalemana.info
studiokunst.art
kokglobal.net
theyoungjudean.com
gersykend.space
imagoent.com
everycolor.one
realbeachart.com
inthekitchenshakinandbakin.com
presimx.online
zetta-ag.com
cockblocker.asia
sm55.online
limponomefacil.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 4 IoCs

rat

resource	yara_rule
behavioral1/memory/2008-63-0x0000000000400000-0x000000000044A000-memory.dmp	formbook
behavioral1/memory/2008-64-0x000000000040188B-mapping.dmp	formbook
behavioral1/memory/2008-68-0x0000000000400000-0x000000000044A000-memory.dmp	formbook
behavioral1/memory/2008-69-0x0000000000210000-0x000000000023F000-memory.dmp	formbook

Executes dropped EXE 2 IoCs

pid	Process
960	aevidem.exe
2008	aevidem.exe

Loads dropped DLL 5 IoCs

pid	Process
1100	Purchase Order (#11022020]pdf.exe
960	aevidem.exe
2016	WerFault.exe
2016	WerFault.exe
2016	WerFault.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 960 set thread context of 2008	960	aevidem.exe	30

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2016	2008	WerFault.exe	30

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 960	1100	Purchase Order (#11022020]pdf.exe	28
PID 1100 wrote to memory of 960	1100	Purchase Order (#11022020]pdf.exe	28
PID 1100 wrote to memory of 960	1100	Purchase Order (#11022020]pdf.exe	28
PID 1100 wrote to memory of 960	1100	Purchase Order (#11022020]pdf.exe	28
PID 960 wrote to memory of 2008	960	aevidem.exe	30
PID 960 wrote to memory of 2008	960	aevidem.exe	30
PID 960 wrote to memory of 2008	960	aevidem.exe	30
PID 960 wrote to memory of 2008	960	aevidem.exe	30
PID 960 wrote to memory of 2008	960	aevidem.exe	30
PID 960 wrote to memory of 2008	960	aevidem.exe	30
PID 960 wrote to memory of 2008	960	aevidem.exe	30
PID 960 wrote to memory of 2008	960	aevidem.exe	30
PID 960 wrote to memory of 2008	960	aevidem.exe	30
PID 960 wrote to memory of 2008	960	aevidem.exe	30
PID 960 wrote to memory of 2008	960	aevidem.exe	30
PID 2008 wrote to memory of 2016	2008	aevidem.exe	31
PID 2008 wrote to memory of 2016	2008	aevidem.exe	31
PID 2008 wrote to memory of 2016	2008	aevidem.exe	31
PID 2008 wrote to memory of 2016	2008	aevidem.exe	31

C:\Users\Admin\AppData\Local\Temp\Purchase Order (#11022020]pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Purchase Order (#11022020]pdf.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Users\Admin\AppData\Local\Temp\aevidem.exe
  C:\Users\Admin\AppData\Local\Temp\aevidem.exe C:\Users\Admin\AppData\Local\Temp\clqdmedhew
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:960
- - C:\Users\Admin\AppData\Local\Temp\aevidem.exe
    C:\Users\Admin\AppData\Local\Temp\aevidem.exe C:\Users\Admin\AppData\Local\Temp\clqdmedhew
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2008
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 524
      4⤵
      Loads dropped DLL
      Program crash
      PID:2016

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aevidem.exe

Path C:\Users\Admin\AppData\Local\Temp\aevidem.exe
Size 70KB
SHA256 84793a0abafb1359181904ef25ecc2aa98520bd224113dae140d9e631bd6b77e
MD5 bebb9285d257bb118b71975476b5576f
SHA1 383b6632dab87021fb8f4746c2a4aedd0ecf3e17
SHA512 cbbe8fbacdb4db676df8abd44b03e27bfd0ac12318ff768b0a73aa51310cb0868927af0fbbb249fff1517e695837e51ba1ed228975d03eaa769f1db74193704b
SSDEEP 768:Gl5X6f3bDhmj6ysW/b/EG8a7T3u/NN0V7pi3nQNKtc8WjWsWjcdZeoUBpARGWKau:GLHj6nIbqavANtnRc8DsWjcdZE+
MD5 SHA1 SHA512 SSDEEP

Submit Download

aevidem.exe

Path C:\Users\Admin\AppData\Local\Temp\aevidem.exe
Size 70KB
SHA256 84793a0abafb1359181904ef25ecc2aa98520bd224113dae140d9e631bd6b77e
MD5 bebb9285d257bb118b71975476b5576f
SHA1 383b6632dab87021fb8f4746c2a4aedd0ecf3e17
SHA512 cbbe8fbacdb4db676df8abd44b03e27bfd0ac12318ff768b0a73aa51310cb0868927af0fbbb249fff1517e695837e51ba1ed228975d03eaa769f1db74193704b
SSDEEP 768:Gl5X6f3bDhmj6ysW/b/EG8a7T3u/NN0V7pi3nQNKtc8WjWsWjcdZeoUBpARGWKau:GLHj6nIbqavANtnRc8DsWjcdZE+
MD5 SHA1 SHA512 SSDEEP

Submit Download

aevidem.exe

Path C:\Users\Admin\AppData\Local\Temp\aevidem.exe
Size 70KB
SHA256 84793a0abafb1359181904ef25ecc2aa98520bd224113dae140d9e631bd6b77e
MD5 bebb9285d257bb118b71975476b5576f
SHA1 383b6632dab87021fb8f4746c2a4aedd0ecf3e17
SHA512 cbbe8fbacdb4db676df8abd44b03e27bfd0ac12318ff768b0a73aa51310cb0868927af0fbbb249fff1517e695837e51ba1ed228975d03eaa769f1db74193704b
SSDEEP 768:Gl5X6f3bDhmj6ysW/b/EG8a7T3u/NN0V7pi3nQNKtc8WjWsWjcdZeoUBpARGWKau:GLHj6nIbqavANtnRc8DsWjcdZE+
MD5 SHA1 SHA512 SSDEEP

Submit Download

clqdmedhew

Path C:\Users\Admin\AppData\Local\Temp\clqdmedhew
Size 4KB
SHA256 f3f42d007a2f94752d69b5ea65a9531c1d73fb51c8ba85a8357fac44aae6f70e
MD5 485d588d87f15aaf5aa56709d2a32132
SHA1 3d8078c8d4e7aed679e0f0d230ea24a4513ae0b7
SHA512 edca251bfff7da06d5b14f04fa7c1260dd8d2047f11ba264b9fcff6927923a5845f48ca63675ef5ebab5642291f5d1cc75f2c6b975456c12d54e1f115f15e967
SSDEEP 96:5uC+GqU+V1CHcH7E6ktnMvfj7q0U07XLQAPW6alhg7hDPtLUH9V9uXwmU9nyyn:6xU+V8HCI6kMvTrti9VEXwmAyC
MD5 SHA1 SHA512 SSDEEP

Submit Download

q9ksefwxi4

Path C:\Users\Admin\AppData\Local\Temp\q9ksefwxi4
Size 280KB
SHA256 69ae16fc71a0b571f53ddeabacd929652ffec655cb19c9a70a1c12f9c9b836fa
MD5 edeb0c5e02462f69e3494d7b39a494dd
SHA1 a7215967d51d7edc5ed6f95abdbba9adfc0bb17f
SHA512 08418440912e0a88965284c2bc553c40715b0dc68d575d75d2d94dcad37ad812b03061f32062c180f2555ceac41b3d952e6c5bfeb54c28f21c57fbecf19f8090
SSDEEP 6144:34wx5XRWauhZ/5ycLqyFahuCQJCxGJl4KO+STbb:rXRWZZ/5ysqubvJMl
MD5 SHA1 SHA512 SSDEEP

Submit Download

aevidem.exe

Path \Users\Admin\AppData\Local\Temp\aevidem.exe
Size 70KB
SHA256 84793a0abafb1359181904ef25ecc2aa98520bd224113dae140d9e631bd6b77e
MD5 bebb9285d257bb118b71975476b5576f
SHA1 383b6632dab87021fb8f4746c2a4aedd0ecf3e17
SHA512 cbbe8fbacdb4db676df8abd44b03e27bfd0ac12318ff768b0a73aa51310cb0868927af0fbbb249fff1517e695837e51ba1ed228975d03eaa769f1db74193704b
SSDEEP 768:Gl5X6f3bDhmj6ysW/b/EG8a7T3u/NN0V7pi3nQNKtc8WjWsWjcdZeoUBpARGWKau:GLHj6nIbqavANtnRc8DsWjcdZE+
MD5 SHA1 SHA512 SSDEEP

Submit Download

aevidem.exe

Path \Users\Admin\AppData\Local\Temp\aevidem.exe
Size 70KB
SHA256 84793a0abafb1359181904ef25ecc2aa98520bd224113dae140d9e631bd6b77e
MD5 bebb9285d257bb118b71975476b5576f
SHA1 383b6632dab87021fb8f4746c2a4aedd0ecf3e17
SHA512 cbbe8fbacdb4db676df8abd44b03e27bfd0ac12318ff768b0a73aa51310cb0868927af0fbbb249fff1517e695837e51ba1ed228975d03eaa769f1db74193704b
SSDEEP 768:Gl5X6f3bDhmj6ysW/b/EG8a7T3u/NN0V7pi3nQNKtc8WjWsWjcdZeoUBpARGWKau:GLHj6nIbqavANtnRc8DsWjcdZE+
MD5 SHA1 SHA512 SSDEEP

Submit Download

aevidem.exe

Path \Users\Admin\AppData\Local\Temp\aevidem.exe
Size 70KB
SHA256 84793a0abafb1359181904ef25ecc2aa98520bd224113dae140d9e631bd6b77e
MD5 bebb9285d257bb118b71975476b5576f
SHA1 383b6632dab87021fb8f4746c2a4aedd0ecf3e17
SHA512 cbbe8fbacdb4db676df8abd44b03e27bfd0ac12318ff768b0a73aa51310cb0868927af0fbbb249fff1517e695837e51ba1ed228975d03eaa769f1db74193704b
SSDEEP 768:Gl5X6f3bDhmj6ysW/b/EG8a7T3u/NN0V7pi3nQNKtc8WjWsWjcdZeoUBpARGWKau:GLHj6nIbqavANtnRc8DsWjcdZE+
MD5 SHA1 SHA512 SSDEEP

Submit Download

aevidem.exe

Path \Users\Admin\AppData\Local\Temp\aevidem.exe
Size 70KB
SHA256 84793a0abafb1359181904ef25ecc2aa98520bd224113dae140d9e631bd6b77e
MD5 bebb9285d257bb118b71975476b5576f
SHA1 383b6632dab87021fb8f4746c2a4aedd0ecf3e17
SHA512 cbbe8fbacdb4db676df8abd44b03e27bfd0ac12318ff768b0a73aa51310cb0868927af0fbbb249fff1517e695837e51ba1ed228975d03eaa769f1db74193704b
SSDEEP 768:Gl5X6f3bDhmj6ysW/b/EG8a7T3u/NN0V7pi3nQNKtc8WjWsWjcdZeoUBpARGWKau:GLHj6nIbqavANtnRc8DsWjcdZE+
MD5 SHA1 SHA512 SSDEEP

Submit Download

aevidem.exe

Path \Users\Admin\AppData\Local\Temp\aevidem.exe
Size 70KB
SHA256 84793a0abafb1359181904ef25ecc2aa98520bd224113dae140d9e631bd6b77e
MD5 bebb9285d257bb118b71975476b5576f
SHA1 383b6632dab87021fb8f4746c2a4aedd0ecf3e17
SHA512 cbbe8fbacdb4db676df8abd44b03e27bfd0ac12318ff768b0a73aa51310cb0868927af0fbbb249fff1517e695837e51ba1ed228975d03eaa769f1db74193704b
SSDEEP 768:Gl5X6f3bDhmj6ysW/b/EG8a7T3u/NN0V7pi3nQNKtc8WjWsWjcdZeoUBpARGWKau:GLHj6nIbqavANtnRc8DsWjcdZE+
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1100-54-0x00000000759E1000-0x00000000759E3000-memory.dmp

Download

memory/2008-63-0x0000000000400000-0x000000000044A000-memory.dmp

Download

memory/2008-69-0x0000000000210000-0x000000000023F000-memory.dmp

Download

memory/2008-68-0x0000000000400000-0x000000000044A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads