formbook | 97504b3dbc2dfe20922f3323f905aa9d4f5f440720cab63dd26c82f26f7d76a2

Analysis

max time kernel
4294209s
max time network
148s
platform
windows7_x64
resource
win7-20220311-en
submitted
13/04/2022, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
art¡culos de orden de compra.pdf.exe
Size 830KB
Sample220413-thbmvsdbgn
SHA256 97504b3dbc2dfe20922f3323f905aa9d4f5f440720cab63dd26c82f26f7d76a2
MD5 3999be53259c3a2ecc613beccb944a8b
SHA1 6c806ab505713d011f02c008d9c69dcbfdde55ab
SHA512 ec05795b12b0d78304df5050f9a57b271b5018485ba016f500cd33b50fcbf8e5224a18781096cd95749fe6078dc46a0dcd4172fc5d1e06f4af6fecea176a5ff2
MD5 SHA1 SHA512

Score

10^/10

formbook d2g7 rat spyware stealer suricata trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

d2g7

Decoy

inviteonlyme.com
noashopping.com
raysyoutube.com
chicagp.com
brnguatemala.com
speechboutique.com
philippinepodcastdirectory.com
konnecio.com
9q1ng6.icu
treez.info
appleiclou.com
pettras.com
txherz.icu
freearcae.com
mindpetalsoftwaresolutions.com
my-beautiful-switzerland.com
hpzebike.online
fadsekclub.xyz
newcastledhaka.com
varidsk.com
micursodebelleza.com
neoikos.com
dansilhavy.com
tuagenciademarketing.com
lennyjewelry.com
nomorewinters.life
hvmoon.com
showmethemoneyy.com
the180legacy.com
bearberry-extract.com
leophorm.com
designitumudah.com
212mask.com
globalsky.zone
chincoteagueebikerentals.com
yunsfu.com
kellerwilliambenefits.com
klaunster.com
lk5d3.com
wathft.online
stayweightfree.com
pouchseat.com
lebensraum-beratung.com
luokaihao.art
weldtechinstitute.com
howdy.chat
timioscorp.com
clientes-ayuda-numero.site
motorcycleinsuranc.com
hwbuc.icu
divinggarden.com
favorru.com
hospitalbe.com
cencat.net
saos45.com
cardealsherein.com
kelp.email
orderrosysmexicanrestaurant.com
nexxtgencorporation.com
5ghfbdfgerg.com
theannunziatagroup.com
swisshoneybee.com
4799cf.com
kingfisherexperience.com
freshlyhair.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Formbook Payload 4 IoCs

rat

resource	yara_rule
behavioral1/memory/700-65-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/700-66-0x000000000041F0E0-mapping.dmp	formbook
behavioral1/memory/700-70-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1008-76-0x00000000000C0000-0x00000000000EF000-memory.dmp	formbook

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1328 set thread context of 700	1328	art¡culos de orden de compra.pdf.exe	35
PID 700 set thread context of 1276	700	RegSvcs.exe	20
PID 1008 set thread context of 1276	1008	help.exe	20

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1984	schtasks.exe

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
1328	art¡culos de orden de compra.pdf.exe
1328	art¡culos de orden de compra.pdf.exe
1328	art¡culos de orden de compra.pdf.exe
1328	art¡culos de orden de compra.pdf.exe
1328	art¡culos de orden de compra.pdf.exe
1328	art¡culos de orden de compra.pdf.exe
928	powershell.exe
700	RegSvcs.exe
700	RegSvcs.exe
1008	help.exe
1008	help.exe
1008	help.exe
1008	help.exe
1008	help.exe
1008	help.exe
1008	help.exe
1008	help.exe
1008	help.exe
1008	help.exe
1008	help.exe
1008	help.exe
1008	help.exe
1008	help.exe
1008	help.exe
1008	help.exe
1008	help.exe
1008	help.exe
1008	help.exe
1008	help.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
700	RegSvcs.exe
700	RegSvcs.exe
700	RegSvcs.exe
1008	help.exe
1008	help.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1328	art¡culos de orden de compra.pdf.exe
Token: SeDebugPrivilege	928	powershell.exe
Token: SeDebugPrivilege	700	RegSvcs.exe
Token: SeDebugPrivilege	1008	help.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1276	Explorer.EXE
1276	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1276	Explorer.EXE
1276	Explorer.EXE

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 1328 wrote to memory of 928	1328	art¡culos de orden de compra.pdf.exe	29
PID 1328 wrote to memory of 928	1328	art¡culos de orden de compra.pdf.exe	29
PID 1328 wrote to memory of 928	1328	art¡culos de orden de compra.pdf.exe	29
PID 1328 wrote to memory of 928	1328	art¡culos de orden de compra.pdf.exe	29
PID 1328 wrote to memory of 1984	1328	art¡culos de orden de compra.pdf.exe	31
PID 1328 wrote to memory of 1984	1328	art¡culos de orden de compra.pdf.exe	31
PID 1328 wrote to memory of 1984	1328	art¡culos de orden de compra.pdf.exe	31
PID 1328 wrote to memory of 1984	1328	art¡culos de orden de compra.pdf.exe	31
PID 1328 wrote to memory of 1664	1328	art¡culos de orden de compra.pdf.exe	33
PID 1328 wrote to memory of 1664	1328	art¡culos de orden de compra.pdf.exe	33
PID 1328 wrote to memory of 1664	1328	art¡culos de orden de compra.pdf.exe	33
PID 1328 wrote to memory of 1664	1328	art¡culos de orden de compra.pdf.exe	33
PID 1328 wrote to memory of 1664	1328	art¡culos de orden de compra.pdf.exe	33
PID 1328 wrote to memory of 1664	1328	art¡culos de orden de compra.pdf.exe	33
PID 1328 wrote to memory of 1664	1328	art¡culos de orden de compra.pdf.exe	33
PID 1328 wrote to memory of 860	1328	art¡culos de orden de compra.pdf.exe	34
PID 1328 wrote to memory of 860	1328	art¡culos de orden de compra.pdf.exe	34
PID 1328 wrote to memory of 860	1328	art¡culos de orden de compra.pdf.exe	34
PID 1328 wrote to memory of 860	1328	art¡culos de orden de compra.pdf.exe	34
PID 1328 wrote to memory of 860	1328	art¡culos de orden de compra.pdf.exe	34
PID 1328 wrote to memory of 860	1328	art¡culos de orden de compra.pdf.exe	34
PID 1328 wrote to memory of 860	1328	art¡culos de orden de compra.pdf.exe	34
PID 1328 wrote to memory of 700	1328	art¡culos de orden de compra.pdf.exe	35
PID 1328 wrote to memory of 700	1328	art¡culos de orden de compra.pdf.exe	35
PID 1328 wrote to memory of 700	1328	art¡culos de orden de compra.pdf.exe	35
PID 1328 wrote to memory of 700	1328	art¡culos de orden de compra.pdf.exe	35
PID 1328 wrote to memory of 700	1328	art¡culos de orden de compra.pdf.exe	35
PID 1328 wrote to memory of 700	1328	art¡culos de orden de compra.pdf.exe	35
PID 1328 wrote to memory of 700	1328	art¡culos de orden de compra.pdf.exe	35
PID 1328 wrote to memory of 700	1328	art¡culos de orden de compra.pdf.exe	35
PID 1328 wrote to memory of 700	1328	art¡culos de orden de compra.pdf.exe	35
PID 1328 wrote to memory of 700	1328	art¡culos de orden de compra.pdf.exe	35
PID 1276 wrote to memory of 1008	1276	Explorer.EXE	36
PID 1276 wrote to memory of 1008	1276	Explorer.EXE	36
PID 1276 wrote to memory of 1008	1276	Explorer.EXE	36
PID 1276 wrote to memory of 1008	1276	Explorer.EXE	36
PID 1008 wrote to memory of 964	1008	help.exe	37
PID 1008 wrote to memory of 964	1008	help.exe	37
PID 1008 wrote to memory of 964	1008	help.exe	37
PID 1008 wrote to memory of 964	1008	help.exe	37

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Users\Admin\AppData\Local\Temp\art¡culos de orden de compra.pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\art¡culos de orden de compra.pdf.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1328
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\YKIXrXdfzJS.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:928
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YKIXrXdfzJS" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF538.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:1984
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    PID:1664
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    PID:860
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:700
- C:\Windows\SysWOW64\help.exe
  "C:\Windows\SysWOW64\help.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1008
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    PID:964

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmpF538.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpF538.tmp
Size 1KB
SHA256 ae75688c60dbdb47961ea44d0eded667784f17ebe29bca0525a550a5071d01af
MD5 5ae3f75130c152b8936c465273f902f3
SHA1 8bb4b32537edc428c0ed50c326da3b09e2dd62d1
SHA512 1a86567217d89ef31ccfe55a6825080ef433982c5d560bf6529473c811752baf29cfe03c73234c85030414f6706f7c858c1da1c037a63afabe2a79eb0dc0c8c2
MD5 SHA1 SHA512

Submit Download

memory/700-62-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/700-72-0x0000000000B70000-0x0000000000E73000-memory.dmp

Download

memory/700-73-0x00000000002A0000-0x00000000002B4000-memory.dmp

Download

memory/700-70-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/700-65-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/700-63-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/928-68-0x000000006E600000-0x000000006EBAB000-memory.dmp

Download

memory/928-59-0x0000000075561000-0x0000000075563000-memory.dmp

Download

memory/928-71-0x0000000002580000-0x00000000031CA000-memory.dmp

Download

memory/1008-75-0x0000000000350000-0x0000000000356000-memory.dmp

Download

memory/1008-76-0x00000000000C0000-0x00000000000EF000-memory.dmp

Download

memory/1008-78-0x0000000000880000-0x0000000000B83000-memory.dmp

Download

memory/1008-79-0x00000000005F0000-0x0000000000683000-memory.dmp

Download

memory/1276-69-0x0000000004690000-0x0000000004789000-memory.dmp

Download

memory/1276-80-0x0000000006320000-0x00000000063F5000-memory.dmp

Download

memory/1328-54-0x0000000001210000-0x00000000012E6000-memory.dmp

Download

memory/1328-56-0x0000000004F50000-0x0000000004FFE000-memory.dmp

Download

memory/1328-55-0x0000000000550000-0x000000000055E000-memory.dmp

Download

memory/1328-61-0x0000000005D00000-0x0000000005D6E000-memory.dmp

Download