formbook | 3f84431741cecf17b3a9529c376d23e474c31e8de26bab5da4d688be6c7332cb

General

Target

contract supply list.exe
Size

311KB
MD5

1c8f2480d5bfe4d9bbe8bc432ccc5c97
SHA1

5ff74ec7bd4d10582ce2c949ade827b1ccb23d21
SHA256

24f64f0f4a0f7b860db4e664e4f4c76a08f20d3490966de4637958bbecc618ac
SHA512

158ec88cc3d9ee15c2a96402e58547bd58896be18cc9502c8e204a21e85e3657cd4d07be03fba888911ff4d26e40b882afbc97ab6d04f8f1a67260205126acfe

Score

10^/10

formbook c38r evasion rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

c38r

Decoy

angleprotool.com

drilldownaccountancy.com

puur-bb.info

laptoprepairbrighton.net

mainstale.com

soketones.com

cohi.ltd

washntivow.com

datajagabon.online

solidlike.com

tapaznoncc.com

deadoralive.site

sharkapexdwal.com

tribun-news.com

67chain.com

paramorphous.net

chicagoxqa.com

301zaq.info

mansfieldpowdercoating.net

stopdizzy.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/576-63-0x0000000000400000-0x000000000042D000-memory.dmp	formbook
behavioral1/memory/576-64-0x000000000041E2E0-mapping.dmp	formbook
behavioral1/memory/576-69-0x0000000000400000-0x000000000042D000-memory.dmp	formbook
behavioral1/memory/828-74-0x00000000000C0000-0x00000000000ED000-memory.dmp	formbook

Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

contract supply list.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	contract supply list.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	contract supply list.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1964 cmd.exe

pid	process
1964	cmd.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

contract supply list.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	contract supply list.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	contract supply list.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

contract supply list.execontract supply list.exewlanext.exe

description	pid	process	target process
PID 1876 set thread context of 576	1876	contract supply list.exe	contract supply list.exe
PID 576 set thread context of 1396	576	contract supply list.exe	Explorer.EXE
PID 576 set thread context of 1396	576	contract supply list.exe	Explorer.EXE
PID 828 set thread context of 1396	828	wlanext.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2020 schtasks.exe

pid	process
2020	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

contract supply list.execontract supply list.exewlanext.exe

pid	process
1876	contract supply list.exe
1876	contract supply list.exe
1876	contract supply list.exe
576	contract supply list.exe
576	contract supply list.exe
576	contract supply list.exe
828	wlanext.exe
828	wlanext.exe
828	wlanext.exe
828	wlanext.exe
828	wlanext.exe
828	wlanext.exe
828	wlanext.exe
828	wlanext.exe

Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

contract supply list.exewlanext.exe

pid process

576 contract supply list.exe
576 contract supply list.exe
576 contract supply list.exe
576 contract supply list.exe
828 wlanext.exe
828 wlanext.exe

pid	process
576	contract supply list.exe
576	contract supply list.exe
576	contract supply list.exe
576	contract supply list.exe
828	wlanext.exe
828	wlanext.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

contract supply list.execontract supply list.exewlanext.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	1876	contract supply list.exe
Token: SeDebugPrivilege	576	contract supply list.exe
Token: SeDebugPrivilege	828	wlanext.exe
Token: SeShutdownPrivilege	1396	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1396 Explorer.EXE
1396 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1396 Explorer.EXE
1396 Explorer.EXE

pid	process
1396	Explorer.EXE
1396	Explorer.EXE

pid	process
1396	Explorer.EXE
1396	Explorer.EXE

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

contract supply list.execontract supply list.exewlanext.exe

description	pid	process	target process
PID 1876 wrote to memory of 2020	1876	contract supply list.exe	schtasks.exe
PID 1876 wrote to memory of 2020	1876	contract supply list.exe	schtasks.exe
PID 1876 wrote to memory of 2020	1876	contract supply list.exe	schtasks.exe
PID 1876 wrote to memory of 2020	1876	contract supply list.exe	schtasks.exe
PID 1876 wrote to memory of 268	1876	contract supply list.exe	contract supply list.exe
PID 1876 wrote to memory of 268	1876	contract supply list.exe	contract supply list.exe
PID 1876 wrote to memory of 268	1876	contract supply list.exe	contract supply list.exe
PID 1876 wrote to memory of 268	1876	contract supply list.exe	contract supply list.exe
PID 1876 wrote to memory of 576	1876	contract supply list.exe	contract supply list.exe
PID 1876 wrote to memory of 576	1876	contract supply list.exe	contract supply list.exe
PID 1876 wrote to memory of 576	1876	contract supply list.exe	contract supply list.exe
PID 1876 wrote to memory of 576	1876	contract supply list.exe	contract supply list.exe
PID 1876 wrote to memory of 576	1876	contract supply list.exe	contract supply list.exe
PID 1876 wrote to memory of 576	1876	contract supply list.exe	contract supply list.exe
PID 1876 wrote to memory of 576	1876	contract supply list.exe	contract supply list.exe
PID 576 wrote to memory of 828	576	contract supply list.exe	wlanext.exe
PID 576 wrote to memory of 828	576	contract supply list.exe	wlanext.exe
PID 576 wrote to memory of 828	576	contract supply list.exe	wlanext.exe
PID 576 wrote to memory of 828	576	contract supply list.exe	wlanext.exe
PID 828 wrote to memory of 1964	828	wlanext.exe	cmd.exe
PID 828 wrote to memory of 1964	828	wlanext.exe	cmd.exe
PID 828 wrote to memory of 1964	828	wlanext.exe	cmd.exe
PID 828 wrote to memory of 1964	828	wlanext.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1396

C:\Users\Admin\AppData\Local\Temp\contract supply list.exe
"C:\Users\Admin\AppData\Local\Temp\contract supply list.exe"
2⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1876

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RvBHdj" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9C6F.tmp"
3⤵
- Creates scheduled task(s)
PID:2020

C:\Users\Admin\AppData\Local\Temp\contract supply list.exe
"{path}"
3⤵
PID:268

C:\Users\Admin\AppData\Local\Temp\contract supply list.exe
"{path}"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:576

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
4⤵
PID:1888

C:\Windows\SysWOW64\wlanext.exe
"C:\Windows\SysWOW64\wlanext.exe"
4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:828

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\contract supply list.exe"
5⤵
- Deletes itself
PID:1964

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Virtualization/Sandbox Evasion

2

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp9C6F.tmp

Filesize
1KB

MD5
165b5ac8ebc03bb2274ea8a0bd98f74d

SHA1
4639ff1aea18c235f7ec42a410e8825d0cead8e7

SHA256
ff5ef626305f0984eaa7447fb364717430c5be3bd29bc2f228fe071478103e09

SHA512
367526c52206827aee208ced396d61f4a27b826511c0e1f47684b6fa3a9b0ae0d761dc25591b4f431e6bf57eab9e25d306ad988ac21ac3b48898d077c5a60ce0

Download Submit
memory/576-66-0x0000000000930000-0x0000000000C33000-memory.dmp

Filesize
3.0MB

Download
memory/576-69-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/576-67-0x00000000001C0000-0x00000000001D4000-memory.dmp

Filesize
80KB

Download
memory/576-70-0x0000000000210000-0x0000000000224000-memory.dmp

Filesize
80KB

Download
memory/576-64-0x000000000041E2E0-mapping.dmp

Download
memory/576-60-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/576-61-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/576-63-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/828-73-0x0000000000B80000-0x0000000000B96000-memory.dmp

Filesize
88KB

Download
memory/828-75-0x0000000002130000-0x0000000002433000-memory.dmp

Filesize
3.0MB

Download
memory/828-77-0x0000000000550000-0x00000000005E3000-memory.dmp

Filesize
588KB

Download
memory/828-74-0x00000000000C0000-0x00000000000ED000-memory.dmp

Filesize
180KB

Download
memory/828-72-0x0000000000000000-mapping.dmp

Download
memory/1396-71-0x0000000004C00000-0x0000000004CC9000-memory.dmp

Filesize
804KB

Download
memory/1396-78-0x0000000004CD0000-0x0000000004DA1000-memory.dmp

Filesize
836KB

Download
memory/1396-68-0x00000000049B0000-0x0000000004A75000-memory.dmp

Filesize
788KB

Download
memory/1876-55-0x0000000075371000-0x0000000075373000-memory.dmp

Filesize
8KB

Download
memory/1876-56-0x0000000000450000-0x0000000000458000-memory.dmp

Filesize
32KB

Download
memory/1876-57-0x0000000000710000-0x000000000074A000-memory.dmp

Filesize
232KB

Download
memory/1876-54-0x0000000000DA0000-0x0000000000DF4000-memory.dmp

Filesize
336KB

Download
memory/1964-76-0x0000000000000000-mapping.dmp

Download
memory/2020-58-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads