formbook | bbc249b1ba93cacc8bae2d88ae2bbe88fdeedcffcc35f55645acfe94fdc67bf9

Analysis

max time kernel
147s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
05/05/2022, 05:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ca3a57a6b1feb39cf130554c73ca8681.exe
Size 40KB
Sample220505-gd1d7saadr
SHA256 bbc249b1ba93cacc8bae2d88ae2bbe88fdeedcffcc35f55645acfe94fdc67bf9
MD5 ca3a57a6b1feb39cf130554c73ca8681
SHA1 f7b0e31a12b866dec0fdf82fa8657401132ada45
SHA512 53d0dbac166a3c65460ce8b478629cf920170bb615705df87e327b52e31369f4bbf841634ba6223bcfd0054638701b87e3b7331da1743f3f5c6e46f1e8e27ef9
MD5 SHA1 SHA512

Score

10^/10

formbook s4s9 rat spyware stealer suricata trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

s4s9

Decoy

qianyuandianshang.com
bernardklein.com
slhomeservices.com
findasaas.com
janellelancaster.xyz
umkpro.site
nr6949.online
mersquare.club
lanariproperties.com
3rdeyefocused.com
giftexpress8260.xyz
hilleleven.xyz
beajod.com
kosazs.online
ishare.team
mb314.com
xjjinxingda.com
ayekooprojectamazing.com
ballsybanter.com
todayshoppingbd.com
recomdietvl.store
zakladmalarstwa.com
bj-ours.com
hubwealth.com
watchmyreview.com
sallyliddicoat.com
eventiliveitalia.com
worldchannelconference.com
suciptahadi.online
ksht5566.com
topfastcashsystemwebshop.com
eyeiieyetv.com
thewarchannel.net
valorousgamers.com
vip01ytre.xyz
szec.tech
233365.xyz
specialroute.net
eugenachase.com
pikoulas.com
shorter-658423.site
win8856.com
burleyqpersianscom.com
sidetrackedmusic.com
chungketvinhomesspotlight.com
qiange.site
motconsultant.com
yottatic.com
usaprostatecenter.com
putovanjazasve.com
kozykornerpizza.com
hainpore.com
52appmj.com
albanyskylights.com
keropy.xyz
infosecrety.xyz
ethlogo.com
labohack.com
veridiumid.xyz
gaylebong.com
rsmegastore.com
janschlesinger.com
cshong-ya.com
shopevix.com
preciousssllc.net

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Formbook Payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/4560-137-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/4560-139-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/1268-146-0x0000000000F40000-0x0000000000F6F000-memory.dmp	formbook

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	ca3a57a6b1feb39cf130554c73ca8681.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 536 set thread context of 4560	536	ca3a57a6b1feb39cf130554c73ca8681.exe	92
PID 4560 set thread context of 672	4560	MSBuild.exe	26
PID 1268 set thread context of 672	1268	cmstp.exe	26

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2276	timeout.exe

Suspicious behavior: EnumeratesProcesses 52 IoCs

pid	Process
536	ca3a57a6b1feb39cf130554c73ca8681.exe
536	ca3a57a6b1feb39cf130554c73ca8681.exe
4560	MSBuild.exe
4560	MSBuild.exe
4560	MSBuild.exe
4560	MSBuild.exe
1268	cmstp.exe
1268	cmstp.exe
1268	cmstp.exe
1268	cmstp.exe
1268	cmstp.exe
1268	cmstp.exe
1268	cmstp.exe
1268	cmstp.exe
1268	cmstp.exe
1268	cmstp.exe
1268	cmstp.exe
1268	cmstp.exe
1268	cmstp.exe
1268	cmstp.exe
1268	cmstp.exe
1268	cmstp.exe
1268	cmstp.exe
1268	cmstp.exe
1268	cmstp.exe
1268	cmstp.exe
1268	cmstp.exe
1268	cmstp.exe
1268	cmstp.exe
1268	cmstp.exe
1268	cmstp.exe
1268	cmstp.exe
1268	cmstp.exe
1268	cmstp.exe
1268	cmstp.exe
1268	cmstp.exe
1268	cmstp.exe
1268	cmstp.exe
1268	cmstp.exe
1268	cmstp.exe
1268	cmstp.exe
1268	cmstp.exe
1268	cmstp.exe
1268	cmstp.exe
1268	cmstp.exe
1268	cmstp.exe
1268	cmstp.exe
1268	cmstp.exe
1268	cmstp.exe
1268	cmstp.exe
1268	cmstp.exe
1268	cmstp.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
672	Explorer.EXE

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
4560	MSBuild.exe
4560	MSBuild.exe
4560	MSBuild.exe
1268	cmstp.exe
1268	cmstp.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	536	ca3a57a6b1feb39cf130554c73ca8681.exe
Token: SeDebugPrivilege	4560	MSBuild.exe
Token: SeDebugPrivilege	1268	cmstp.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 2352	536	ca3a57a6b1feb39cf130554c73ca8681.exe	89
PID 536 wrote to memory of 2352	536	ca3a57a6b1feb39cf130554c73ca8681.exe	89
PID 536 wrote to memory of 2352	536	ca3a57a6b1feb39cf130554c73ca8681.exe	89
PID 2352 wrote to memory of 2276	2352	cmd.exe	91
PID 2352 wrote to memory of 2276	2352	cmd.exe	91
PID 2352 wrote to memory of 2276	2352	cmd.exe	91
PID 536 wrote to memory of 4560	536	ca3a57a6b1feb39cf130554c73ca8681.exe	92
PID 536 wrote to memory of 4560	536	ca3a57a6b1feb39cf130554c73ca8681.exe	92
PID 536 wrote to memory of 4560	536	ca3a57a6b1feb39cf130554c73ca8681.exe	92
PID 536 wrote to memory of 4560	536	ca3a57a6b1feb39cf130554c73ca8681.exe	92
PID 536 wrote to memory of 4560	536	ca3a57a6b1feb39cf130554c73ca8681.exe	92
PID 536 wrote to memory of 4560	536	ca3a57a6b1feb39cf130554c73ca8681.exe	92
PID 672 wrote to memory of 1268	672	Explorer.EXE	99
PID 672 wrote to memory of 1268	672	Explorer.EXE	99
PID 672 wrote to memory of 1268	672	Explorer.EXE	99
PID 1268 wrote to memory of 2648	1268	cmstp.exe	101
PID 1268 wrote to memory of 2648	1268	cmstp.exe	101
PID 1268 wrote to memory of 2648	1268	cmstp.exe	101

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:672
- C:\Users\Admin\AppData\Local\Temp\ca3a57a6b1feb39cf130554c73ca8681.exe
  "C:\Users\Admin\AppData\Local\Temp\ca3a57a6b1feb39cf130554c73ca8681.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:536
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout 2
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2352
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 2
      4⤵
      Delays execution with timeout.exe
      PID:2276
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:4560
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:1648
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:1276
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:952
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:1104
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:3124
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:1148
- C:\Windows\SysWOW64\cmstp.exe
  "C:\Windows\SysWOW64\cmstp.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1268
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:2648

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/536-131-0x0000000005590000-0x0000000005B34000-memory.dmp

Download

memory/536-132-0x0000000004FE0000-0x0000000005072000-memory.dmp

Download

memory/536-133-0x0000000004F90000-0x0000000004F9A000-memory.dmp

Download

memory/536-130-0x00000000005D0000-0x00000000005DE000-memory.dmp

Download

memory/672-149-0x0000000008E70000-0x0000000008FF4000-memory.dmp

Download

memory/672-142-0x00000000032E0000-0x00000000033EF000-memory.dmp

Download

memory/1268-148-0x0000000002EF0000-0x0000000002F83000-memory.dmp

Download

memory/1268-147-0x0000000003080000-0x00000000033CA000-memory.dmp

Download

memory/1268-145-0x0000000000550000-0x0000000000566000-memory.dmp

Download

memory/1268-146-0x0000000000F40000-0x0000000000F6F000-memory.dmp

Download

memory/4560-141-0x0000000001340000-0x0000000001354000-memory.dmp

Download

memory/4560-140-0x0000000000EC0000-0x000000000120A000-memory.dmp

Download

memory/4560-139-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4560-137-0x0000000000400000-0x000000000042F000-memory.dmp

Download