formbook | 05fafaa473d50e4df54ac7f838b816f90fbb1cc1313cd514a275aed45ac1f6c3

General

Target

PO.9758752img.exe
Size

419KB
MD5

58727beb95ca8e5ec902f266901f3ebe
SHA1

6322381826a448cc3618ad343ebba8e82d309984
SHA256

359e02b2d5f52a490ef6811663993437866b52e86e9c9c4e633f30b716d73883
SHA512

30b9248a37190f486c3507eb517fb9ca2153b2ecb1989ff3e1aebc8c0b63507ca776dc08e4976e94308075a9d848aee4fedf9d2579d2be1ce12f14a0caf14e73

Score

10^/10

formbook duj evasion rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

duj

Decoy

deapink.pink

tkmdz.com

nytzshicai.com

photos-identite-dijon.com

ekanun.net

xn--fiqy4bxl57l9sag6f6wb.ink

slivercat5.com

ai-ethics.net

510ns.com

inotherways.com

ridesharesettelment.com

zjxiangnong.com

aoraessentials.com

sheap-list.com

heshengqy.com

experts-comptables-paris-17.com

parissummerolympics2024.info

gtyx88.com

devopsonjob.com

vodacred.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/832-62-0x000000000041E2E0-mapping.dmp	formbook
behavioral1/memory/832-61-0x0000000000400000-0x000000000042D000-memory.dmp	formbook
behavioral1/memory/832-67-0x0000000000400000-0x000000000042D000-memory.dmp	formbook
behavioral1/memory/268-72-0x0000000000080000-0x00000000000AD000-memory.dmp	formbook

Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

PO.9758752img.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	PO.9758752img.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	PO.9758752img.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

PO.9758752img.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	PO.9758752img.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	PO.9758752img.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

PO.9758752img.exeMSBuild.exe

description	pid	process	target process
PID 1956 set thread context of 832	1956	PO.9758752img.exe	MSBuild.exe
PID 832 set thread context of 1220	832	MSBuild.exe	Explorer.EXE
PID 832 set thread context of 1220	832	MSBuild.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

784 schtasks.exe
Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

chkdsk.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe
Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

PO.9758752img.exeMSBuild.exechkdsk.exe

pid process

1956 PO.9758752img.exe
1956 PO.9758752img.exe
832 MSBuild.exe
832 MSBuild.exe
832 MSBuild.exe
268 chkdsk.exe
268 chkdsk.exe
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

MSBuild.exechkdsk.exe

pid process

832 MSBuild.exe
832 MSBuild.exe
832 MSBuild.exe
832 MSBuild.exe
268 chkdsk.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

PO.9758752img.exeMSBuild.exechkdsk.exe

description pid process

Token: SeDebugPrivilege 1956 PO.9758752img.exe
Token: SeDebugPrivilege 832 MSBuild.exe
Token: SeDebugPrivilege 268 chkdsk.exe

pid	process
784	schtasks.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	chkdsk.exe

pid	process
1956	PO.9758752img.exe
1956	PO.9758752img.exe
832	MSBuild.exe
832	MSBuild.exe
832	MSBuild.exe
268	chkdsk.exe
268	chkdsk.exe

pid	process
832	MSBuild.exe
832	MSBuild.exe
832	MSBuild.exe
832	MSBuild.exe
268	chkdsk.exe

description	pid	process
Token: SeDebugPrivilege	1956	PO.9758752img.exe
Token: SeDebugPrivilege	832	MSBuild.exe
Token: SeDebugPrivilege	268	chkdsk.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

PO.9758752img.exeMSBuild.exechkdsk.exe

description	pid	process	target process
PID 1956 wrote to memory of 784	1956	PO.9758752img.exe	schtasks.exe
PID 1956 wrote to memory of 784	1956	PO.9758752img.exe	schtasks.exe
PID 1956 wrote to memory of 784	1956	PO.9758752img.exe	schtasks.exe
PID 1956 wrote to memory of 784	1956	PO.9758752img.exe	schtasks.exe
PID 1956 wrote to memory of 832	1956	PO.9758752img.exe	MSBuild.exe
PID 1956 wrote to memory of 832	1956	PO.9758752img.exe	MSBuild.exe
PID 1956 wrote to memory of 832	1956	PO.9758752img.exe	MSBuild.exe
PID 1956 wrote to memory of 832	1956	PO.9758752img.exe	MSBuild.exe
PID 1956 wrote to memory of 832	1956	PO.9758752img.exe	MSBuild.exe
PID 1956 wrote to memory of 832	1956	PO.9758752img.exe	MSBuild.exe
PID 1956 wrote to memory of 832	1956	PO.9758752img.exe	MSBuild.exe
PID 832 wrote to memory of 268	832	MSBuild.exe	chkdsk.exe
PID 832 wrote to memory of 268	832	MSBuild.exe	chkdsk.exe
PID 832 wrote to memory of 268	832	MSBuild.exe	chkdsk.exe
PID 832 wrote to memory of 268	832	MSBuild.exe	chkdsk.exe
PID 268 wrote to memory of 848	268	chkdsk.exe	cmd.exe
PID 268 wrote to memory of 848	268	chkdsk.exe	cmd.exe
PID 268 wrote to memory of 848	268	chkdsk.exe	cmd.exe
PID 268 wrote to memory of 848	268	chkdsk.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1220

C:\Users\Admin\AppData\Local\Temp\PO.9758752img.exe
"C:\Users\Admin\AppData\Local\Temp\PO.9758752img.exe"
2⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1956

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cWBTWBNA" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF632.tmp"
3⤵
- Creates scheduled task(s)
PID:784

C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
"{path}"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:832

C:\Windows\SysWOW64\chkdsk.exe
"C:\Windows\SysWOW64\chkdsk.exe"
4⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:268

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
5⤵
PID:848

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:1276

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:1880

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:1792

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:656

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:1944

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:368

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Discovery

Query Registry

5

T1012

Virtualization/Sandbox Evasion

2

T1497

System Information Discovery

4

T1082

Peripheral Device Discovery

1

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpF632.tmp
Filesize
1KB

MD5
215cf68d098e2991e007cb753b4f0ec7

SHA1
92d72b12593ce69af46663b9beaa9c950accaf71

SHA256
bcdfde9f31c610e6c98212c673b00830c7a2cf01a82eec45ecef9d67a06ad0e6

SHA512
595b3bed8c69a9fe73fe565b9bf3755140b600d71aa1ee37bb80018fb225e39c5cee4227575da9b5f34e9af5032d2cf189751ff1267099ee5859824c3d748869

Download Submit
memory/268-70-0x0000000000000000-mapping.dmp

Download
memory/268-74-0x0000000002010000-0x0000000002313000-memory.dmp

Filesize
3.0MB

Download
memory/268-72-0x0000000000080000-0x00000000000AD000-memory.dmp

Filesize
180KB

Download
memory/268-71-0x0000000000930000-0x0000000000937000-memory.dmp

Filesize
28KB

Download
memory/784-56-0x0000000000000000-mapping.dmp

Download
memory/832-64-0x0000000000890000-0x0000000000B93000-memory.dmp

Filesize
3.0MB

Download
memory/832-61-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/832-65-0x0000000000150000-0x0000000000164000-memory.dmp

Filesize
80KB

Download
memory/832-67-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/832-68-0x00000000003B0000-0x00000000003C4000-memory.dmp

Filesize
80KB

Download
memory/832-62-0x000000000041E2E0-mapping.dmp

Download
memory/832-59-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/832-58-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/848-73-0x0000000000000000-mapping.dmp

Download
memory/1220-66-0x00000000060B0000-0x00000000061DC000-memory.dmp

Filesize
1.2MB

Download
memory/1220-69-0x00000000061E0000-0x000000000630A000-memory.dmp

Filesize
1.2MB

Download
memory/1956-54-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download
memory/1956-55-0x0000000074AE0000-0x000000007508B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads