formbook | e2cb7aaa6bdd1a9029dd1db1ac0107556641d03608b8e8d520229e216462d779

General

Target

e2cb7aaa6bdd1a9029dd1db1ac0107556641d03608b8e8d520229e216462d779.exe
Size

753KB
MD5

194e6e2cb1b914c33e5d0ea233f7a813
SHA1

82eb016de527bdee7cc391219e1e6cdcdb64ad3d
SHA256

e2cb7aaa6bdd1a9029dd1db1ac0107556641d03608b8e8d520229e216462d779
SHA512

4cf030e4d43791e0c2006dffb7619e2a1f2b8ca596db01d8e3091b99f04b1d93a5ef36c21fda3189837e4901cc750f0c8c6a9ead93af67c5148c6b663242681b

Score

10^/10

formbook metastealer fs8 rat spyware stealer suricata trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

fs8

Decoy

deanpalm.net

dinu-living.com

setsomegoals.com

craftyfresh.email

cleantons.com

szysjfjx.com

shestakova.info

70skinstore.com

ampletrade.ltd

cmmcwomen.group

michinoeki-taka.com

auntoni.com

huochegw.com

abovekulture.com

gzjige.com

americastandproudagain.com

hobbyhousekennels.com

1020waterviewdrive.com

5927399.com

gabipareras.net

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Meta Stealer Stealer
Meta Stealer steals passwords stored in browsers, written in C++.
stealer metastealer
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Formbook Payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/2844-139-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral2/memory/3160-146-0x0000000001200000-0x000000000122E000-memory.dmp	formbook

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	e2cb7aaa6bdd1a9029dd1db1ac0107556641d03608b8e8d520229e216462d779.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2248 set thread context of 2844	2248	e2cb7aaa6bdd1a9029dd1db1ac0107556641d03608b8e8d520229e216462d779.exe	92
PID 2844 set thread context of 3028	2844	RegSvcs.exe	43
PID 3160 set thread context of 3028	3160	wscript.exe	43

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1768	schtasks.exe

Suspicious behavior: EnumeratesProcesses 45 IoCs

pid	Process
2248	e2cb7aaa6bdd1a9029dd1db1ac0107556641d03608b8e8d520229e216462d779.exe
2844	RegSvcs.exe
2844	RegSvcs.exe
2844	RegSvcs.exe
2844	RegSvcs.exe
3160	wscript.exe
3160	wscript.exe
3160	wscript.exe
3160	wscript.exe
3160	wscript.exe
3160	wscript.exe
3160	wscript.exe
3160	wscript.exe
3160	wscript.exe
3160	wscript.exe
3160	wscript.exe
3160	wscript.exe
3160	wscript.exe
3160	wscript.exe
3160	wscript.exe
3160	wscript.exe
3160	wscript.exe
3160	wscript.exe
3160	wscript.exe
3160	wscript.exe
3160	wscript.exe
3160	wscript.exe
3160	wscript.exe
3160	wscript.exe
3160	wscript.exe
3160	wscript.exe
3160	wscript.exe
3160	wscript.exe
3160	wscript.exe
3160	wscript.exe
3160	wscript.exe
3160	wscript.exe
3160	wscript.exe
3160	wscript.exe
3160	wscript.exe
3160	wscript.exe
3160	wscript.exe
3160	wscript.exe
3160	wscript.exe
3160	wscript.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3028	Explorer.EXE

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
2844	RegSvcs.exe
2844	RegSvcs.exe
2844	RegSvcs.exe
3160	wscript.exe
3160	wscript.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2248	e2cb7aaa6bdd1a9029dd1db1ac0107556641d03608b8e8d520229e216462d779.exe
Token: SeDebugPrivilege	2844	RegSvcs.exe
Token: SeDebugPrivilege	3160	wscript.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 1768	2248	e2cb7aaa6bdd1a9029dd1db1ac0107556641d03608b8e8d520229e216462d779.exe	90
PID 2248 wrote to memory of 1768	2248	e2cb7aaa6bdd1a9029dd1db1ac0107556641d03608b8e8d520229e216462d779.exe	90
PID 2248 wrote to memory of 1768	2248	e2cb7aaa6bdd1a9029dd1db1ac0107556641d03608b8e8d520229e216462d779.exe	90
PID 2248 wrote to memory of 2844	2248	e2cb7aaa6bdd1a9029dd1db1ac0107556641d03608b8e8d520229e216462d779.exe	92
PID 2248 wrote to memory of 2844	2248	e2cb7aaa6bdd1a9029dd1db1ac0107556641d03608b8e8d520229e216462d779.exe	92
PID 2248 wrote to memory of 2844	2248	e2cb7aaa6bdd1a9029dd1db1ac0107556641d03608b8e8d520229e216462d779.exe	92
PID 2248 wrote to memory of 2844	2248	e2cb7aaa6bdd1a9029dd1db1ac0107556641d03608b8e8d520229e216462d779.exe	92
PID 2248 wrote to memory of 2844	2248	e2cb7aaa6bdd1a9029dd1db1ac0107556641d03608b8e8d520229e216462d779.exe	92
PID 2248 wrote to memory of 2844	2248	e2cb7aaa6bdd1a9029dd1db1ac0107556641d03608b8e8d520229e216462d779.exe	92
PID 3028 wrote to memory of 3160	3028	Explorer.EXE	93
PID 3028 wrote to memory of 3160	3028	Explorer.EXE	93
PID 3028 wrote to memory of 3160	3028	Explorer.EXE	93
PID 3160 wrote to memory of 4072	3160	wscript.exe	94
PID 3160 wrote to memory of 4072	3160	wscript.exe	94
PID 3160 wrote to memory of 4072	3160	wscript.exe	94

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Users\Admin\AppData\Local\Temp\e2cb7aaa6bdd1a9029dd1db1ac0107556641d03608b8e8d520229e216462d779.exe
  "C:\Users\Admin\AppData\Local\Temp\e2cb7aaa6bdd1a9029dd1db1ac0107556641d03608b8e8d520229e216462d779.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2248
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kiAbIarP" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEBC5.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:1768
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "{path}"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:2844
- C:\Windows\SysWOW64\wscript.exe
  "C:\Windows\SysWOW64\wscript.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3160
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    PID:4072

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpEBC5.tmp

Filesize
1KB

MD5
c192cf76b77d3e8022bc460aa16014ae

SHA1
db7aabbeb97bc99c3cf1b5423050d903e67a0058

SHA256
ccd42729ff5ca33c9d3e5dc073f639e67dcc4256d48eb4e581f4fe19eca0cc0c

SHA512
84f0fb234931b8e3e3954da18e04a884181f086bd59a7de6db2496057b9a97eb79b82976394c6779253224d110eaf483c60cb5e37a976201d5256bc9c8f6235c

Download Submit
memory/2248-130-0x00000000001F0000-0x00000000002B2000-memory.dmp

Filesize
776KB

Download
memory/2248-131-0x00000000095D0000-0x0000000009B74000-memory.dmp

Filesize
5.6MB

Download
memory/2248-132-0x0000000004D40000-0x0000000004DD2000-memory.dmp

Filesize
584KB

Download
memory/2248-133-0x0000000004B50000-0x0000000004B5A000-memory.dmp

Filesize
40KB

Download
memory/2248-134-0x0000000008550000-0x0000000008A7C000-memory.dmp

Filesize
5.2MB

Download
memory/2248-135-0x0000000008B20000-0x0000000008BBC000-memory.dmp

Filesize
624KB

Download
memory/2844-141-0x00000000012F0000-0x000000000163A000-memory.dmp

Filesize
3.3MB

Download
memory/2844-139-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2844-142-0x0000000001780000-0x0000000001794000-memory.dmp

Filesize
80KB

Download
memory/3028-143-0x00000000080B0000-0x00000000081D3000-memory.dmp

Filesize
1.1MB

Download
memory/3028-150-0x0000000002FA0000-0x000000000308D000-memory.dmp

Filesize
948KB

Download
memory/3160-145-0x00000000007A0000-0x00000000007C7000-memory.dmp

Filesize
156KB

Download
memory/3160-146-0x0000000001200000-0x000000000122E000-memory.dmp

Filesize
184KB

Download
memory/3160-147-0x00000000031F0000-0x000000000353A000-memory.dmp

Filesize
3.3MB

Download
memory/3160-149-0x0000000003090000-0x0000000003123000-memory.dmp

Filesize
588KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads