formbook | 5bc5d93665bc0242f56ecf2f76c0d25bfb8d78536ad9ea4fea4e723500acf59b

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20220414-en
submitted
05/05/2022, 10:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6918e243c51505d5769b394fbf8e29c5.exe
Size 12KB
Sample220505-ml4pgsaefj
SHA256 5bc5d93665bc0242f56ecf2f76c0d25bfb8d78536ad9ea4fea4e723500acf59b
MD5 6918e243c51505d5769b394fbf8e29c5
SHA1 37623ba59abf882d5f776150581c39f0558366fc
SHA512 752ac197a95ae3a4c170ca691de1d2ad586ce0bf1ea46f494d8d6a64887c176e6ef6f93ef36d4248240033352ab8691bb91b3e18c1b4e2e40e87e3fd8d05810f
MD5 SHA1 SHA512

Score

10^/10

formbook s4s9 rat spyware stealer suricata trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

s4s9

Decoy

qianyuandianshang.com
bernardklein.com
slhomeservices.com
findasaas.com
janellelancaster.xyz
umkpro.site
nr6949.online
mersquare.club
lanariproperties.com
3rdeyefocused.com
giftexpress8260.xyz
hilleleven.xyz
beajod.com
kosazs.online
ishare.team
mb314.com
xjjinxingda.com
ayekooprojectamazing.com
ballsybanter.com
todayshoppingbd.com
recomdietvl.store
zakladmalarstwa.com
bj-ours.com
hubwealth.com
watchmyreview.com
sallyliddicoat.com
eventiliveitalia.com
worldchannelconference.com
suciptahadi.online
ksht5566.com
topfastcashsystemwebshop.com
eyeiieyetv.com
thewarchannel.net
valorousgamers.com
vip01ytre.xyz
szec.tech
233365.xyz
specialroute.net
eugenachase.com
pikoulas.com
shorter-658423.site
win8856.com
burleyqpersianscom.com
sidetrackedmusic.com
chungketvinhomesspotlight.com
qiange.site
motconsultant.com
yottatic.com
usaprostatecenter.com
putovanjazasve.com
kozykornerpizza.com
hainpore.com
52appmj.com
albanyskylights.com
keropy.xyz
infosecrety.xyz
ethlogo.com
labohack.com
veridiumid.xyz
gaylebong.com
rsmegastore.com
janschlesinger.com
cshong-ya.com
shopevix.com
preciousssllc.net

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Formbook Payload 4 IoCs

rat

resource	yara_rule
behavioral1/memory/688-64-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/688-65-0x000000000041F0E0-mapping.dmp	formbook
behavioral1/memory/688-67-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1744-74-0x0000000000080000-0x00000000000AF000-memory.dmp	formbook

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1324 set thread context of 688	1324	6918e243c51505d5769b394fbf8e29c5.exe	31
PID 688 set thread context of 1232	688	MSBuild.exe	7
PID 1744 set thread context of 1232	1744	netsh.exe	7

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1612	timeout.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
1324	6918e243c51505d5769b394fbf8e29c5.exe
1324	6918e243c51505d5769b394fbf8e29c5.exe
688	MSBuild.exe
688	MSBuild.exe
1744	netsh.exe
1744	netsh.exe
1744	netsh.exe
1744	netsh.exe
1744	netsh.exe
1744	netsh.exe
1744	netsh.exe
1744	netsh.exe
1744	netsh.exe
1744	netsh.exe
1744	netsh.exe
1744	netsh.exe
1744	netsh.exe
1744	netsh.exe
1744	netsh.exe
1744	netsh.exe
1744	netsh.exe
1744	netsh.exe
1744	netsh.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
688	MSBuild.exe
688	MSBuild.exe
688	MSBuild.exe
1744	netsh.exe
1744	netsh.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1324	6918e243c51505d5769b394fbf8e29c5.exe
Token: SeDebugPrivilege	688	MSBuild.exe
Token: SeDebugPrivilege	1744	netsh.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 872	1324	6918e243c51505d5769b394fbf8e29c5.exe	28
PID 1324 wrote to memory of 872	1324	6918e243c51505d5769b394fbf8e29c5.exe	28
PID 1324 wrote to memory of 872	1324	6918e243c51505d5769b394fbf8e29c5.exe	28
PID 1324 wrote to memory of 872	1324	6918e243c51505d5769b394fbf8e29c5.exe	28
PID 872 wrote to memory of 1612	872	cmd.exe	30
PID 872 wrote to memory of 1612	872	cmd.exe	30
PID 872 wrote to memory of 1612	872	cmd.exe	30
PID 872 wrote to memory of 1612	872	cmd.exe	30
PID 1324 wrote to memory of 688	1324	6918e243c51505d5769b394fbf8e29c5.exe	31
PID 1324 wrote to memory of 688	1324	6918e243c51505d5769b394fbf8e29c5.exe	31
PID 1324 wrote to memory of 688	1324	6918e243c51505d5769b394fbf8e29c5.exe	31
PID 1324 wrote to memory of 688	1324	6918e243c51505d5769b394fbf8e29c5.exe	31
PID 1324 wrote to memory of 688	1324	6918e243c51505d5769b394fbf8e29c5.exe	31
PID 1324 wrote to memory of 688	1324	6918e243c51505d5769b394fbf8e29c5.exe	31
PID 1324 wrote to memory of 688	1324	6918e243c51505d5769b394fbf8e29c5.exe	31
PID 1232 wrote to memory of 1744	1232	Explorer.EXE	32
PID 1232 wrote to memory of 1744	1232	Explorer.EXE	32
PID 1232 wrote to memory of 1744	1232	Explorer.EXE	32
PID 1232 wrote to memory of 1744	1232	Explorer.EXE	32
PID 1744 wrote to memory of 1820	1744	netsh.exe	33
PID 1744 wrote to memory of 1820	1744	netsh.exe	33
PID 1744 wrote to memory of 1820	1744	netsh.exe	33
PID 1744 wrote to memory of 1820	1744	netsh.exe	33

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Users\Admin\AppData\Local\Temp\6918e243c51505d5769b394fbf8e29c5.exe
  "C:\Users\Admin\AppData\Local\Temp\6918e243c51505d5769b394fbf8e29c5.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1324
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout 2
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:872
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 2
      4⤵
      Delays execution with timeout.exe
      PID:1612
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:688
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\SysWOW64\netsh.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:1820

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/688-69-0x0000000000290000-0x00000000002A4000-memory.dmp

Download

memory/688-68-0x0000000000B70000-0x0000000000E73000-memory.dmp

Download

memory/688-67-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/688-61-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/688-62-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/688-64-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1232-77-0x0000000007020000-0x0000000007192000-memory.dmp

Download

memory/1232-70-0x0000000004BE0000-0x0000000004D12000-memory.dmp

Download

memory/1324-59-0x00000000048D5000-0x00000000048E6000-memory.dmp

Download

memory/1324-60-0x0000000004E30000-0x0000000004E7C000-memory.dmp

Download

memory/1324-54-0x0000000000D50000-0x0000000000D58000-memory.dmp

Download

memory/1324-56-0x00000000089F0000-0x0000000008B66000-memory.dmp

Download

memory/1324-55-0x0000000076011000-0x0000000076013000-memory.dmp

Download

memory/1744-73-0x00000000015A0000-0x00000000015BB000-memory.dmp

Download

memory/1744-74-0x0000000000080000-0x00000000000AF000-memory.dmp

Download

memory/1744-75-0x0000000000B40000-0x0000000000E43000-memory.dmp

Download

memory/1744-76-0x0000000000950000-0x00000000009E3000-memory.dmp

Download