formbook | 1cb9eb0fbed2683a2623dca8243a9be47affff1b33b8c86e09a2b64f0d55a9b2

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
27/06/2022, 18:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Payment transfer copy.exe
Size 675KB
Sample220627-xalpmsefb2
SHA256 1cb9eb0fbed2683a2623dca8243a9be47affff1b33b8c86e09a2b64f0d55a9b2
MD5 8fd61d45acb6c35dfd0be44fc7efb681
SHA1 b90176a6244d5db315c2315315c72bdc50c1da4a
SHA512 e1ad98fc9beff689654eabd5492dd4b49b9d2d67bad43b1541321147e4739007fa69bfa402f3eadc88167477e20e096c200ede603205a5b34d06d8dc59203590
MD5 SHA1 SHA512

Score

10^/10

formbook ir93 rat spyware stealer suricata trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

ir93

Decoy

dostavka47.store
mangguoav.xyz
yourhealthstore.life
sharpecartoons.com
webbankrate.com
sublimephotography.online
crudepurple.xyz
basselibrahim.group
peroalkeys.com
vntiktokshop.xyz
lasarview.com
notherdaylope.site
hengqijc.com
thejamstar.com
adityapeen.com
bestseeds-21.xyz
qaaronautoinsurance.xyz
eadservices.online
hubei23.com
lanenucacontenedor.com
achildshealth.com
yemjwebs.com
soft-warehouse.net
knee-pain-treatment-53224.com
mvqvqeqt.com
sunshinebouncetampabay.com
med-blank.com
beautylinkk.com
covineschool.com
admiremarokko.com
aromaperfecto.com
tt43icyo.xyz
us886868.com
bodatz.com
pawsrus.store
stopad.xyz
rhythmoftheflavors.biz
highnotevintners.com
noteit.works
poloat.com
xn--vk1b35zq5cqva.com
japanese-medical.asia
senior-living-seek.life
areaotomasyon.com
snowsdreamz.com
saknuf.online
kalyahealth.com
yuz23h.xyz
lm-saw.com
coinwest.xyz
ferdanitravel.com
calypet.xyz
kzardxm.online
elegantshippingcorp.com
chancekornuth.com
wlkjrh.com
michaelandalexandra.com
g52stf1.xyz
euvivoisso.space
cambridge-tool-die.com
shiztv.xyz
uneswart.xyz
nbxinhegc.com
mullinsmechanicalhvac.com
gasgentechnologies.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Formbook Payload 4 IoCs

rat

resource	yara_rule
behavioral2/memory/4456-140-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/4456-146-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/1704-149-0x0000000000320000-0x000000000034F000-memory.dmp	formbook
behavioral2/memory/1704-152-0x0000000000320000-0x000000000034F000-memory.dmp	formbook

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 5004 set thread context of 4456	5004	Payment transfer copy.exe	95
PID 4456 set thread context of 2812	4456	Payment transfer copy.exe	40
PID 1704 set thread context of 2812	1704	ipconfig.exe	40

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command-Line Interface

T1059

pid	Process
1704	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
5004	Payment transfer copy.exe
5004	Payment transfer copy.exe
5004	Payment transfer copy.exe
5004	Payment transfer copy.exe
5004	Payment transfer copy.exe
5004	Payment transfer copy.exe
5004	Payment transfer copy.exe
5004	Payment transfer copy.exe
4456	Payment transfer copy.exe
4456	Payment transfer copy.exe
4456	Payment transfer copy.exe
4456	Payment transfer copy.exe
1704	ipconfig.exe
1704	ipconfig.exe
1704	ipconfig.exe
1704	ipconfig.exe
1704	ipconfig.exe
1704	ipconfig.exe
1704	ipconfig.exe
1704	ipconfig.exe
1704	ipconfig.exe
1704	ipconfig.exe
1704	ipconfig.exe
1704	ipconfig.exe
1704	ipconfig.exe
1704	ipconfig.exe
1704	ipconfig.exe
1704	ipconfig.exe
1704	ipconfig.exe
1704	ipconfig.exe
1704	ipconfig.exe
1704	ipconfig.exe
1704	ipconfig.exe
1704	ipconfig.exe
1704	ipconfig.exe
1704	ipconfig.exe
1704	ipconfig.exe
1704	ipconfig.exe
1704	ipconfig.exe
1704	ipconfig.exe
1704	ipconfig.exe
1704	ipconfig.exe
1704	ipconfig.exe
1704	ipconfig.exe
1704	ipconfig.exe
1704	ipconfig.exe
1704	ipconfig.exe
1704	ipconfig.exe
1704	ipconfig.exe
1704	ipconfig.exe
1704	ipconfig.exe
1704	ipconfig.exe
1704	ipconfig.exe
1704	ipconfig.exe
1704	ipconfig.exe
1704	ipconfig.exe
1704	ipconfig.exe
1704	ipconfig.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2812	Explorer.EXE

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
4456	Payment transfer copy.exe
4456	Payment transfer copy.exe
4456	Payment transfer copy.exe
1704	ipconfig.exe
1704	ipconfig.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5004	Payment transfer copy.exe
Token: SeDebugPrivilege	4456	Payment transfer copy.exe
Token: SeDebugPrivilege	1704	ipconfig.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 3708	5004	Payment transfer copy.exe	91
PID 5004 wrote to memory of 3708	5004	Payment transfer copy.exe	91
PID 5004 wrote to memory of 3708	5004	Payment transfer copy.exe	91
PID 5004 wrote to memory of 3756	5004	Payment transfer copy.exe	92
PID 5004 wrote to memory of 3756	5004	Payment transfer copy.exe	92
PID 5004 wrote to memory of 3756	5004	Payment transfer copy.exe	92
PID 5004 wrote to memory of 4088	5004	Payment transfer copy.exe	93
PID 5004 wrote to memory of 4088	5004	Payment transfer copy.exe	93
PID 5004 wrote to memory of 4088	5004	Payment transfer copy.exe	93
PID 5004 wrote to memory of 980	5004	Payment transfer copy.exe	94
PID 5004 wrote to memory of 980	5004	Payment transfer copy.exe	94
PID 5004 wrote to memory of 980	5004	Payment transfer copy.exe	94
PID 5004 wrote to memory of 4456	5004	Payment transfer copy.exe	95
PID 5004 wrote to memory of 4456	5004	Payment transfer copy.exe	95
PID 5004 wrote to memory of 4456	5004	Payment transfer copy.exe	95
PID 5004 wrote to memory of 4456	5004	Payment transfer copy.exe	95
PID 5004 wrote to memory of 4456	5004	Payment transfer copy.exe	95
PID 5004 wrote to memory of 4456	5004	Payment transfer copy.exe	95
PID 2812 wrote to memory of 1704	2812	Explorer.EXE	96
PID 2812 wrote to memory of 1704	2812	Explorer.EXE	96
PID 2812 wrote to memory of 1704	2812	Explorer.EXE	96
PID 1704 wrote to memory of 2148	1704	ipconfig.exe	98
PID 1704 wrote to memory of 2148	1704	ipconfig.exe	98
PID 1704 wrote to memory of 2148	1704	ipconfig.exe	98

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2812
- C:\Users\Admin\AppData\Local\Temp\Payment transfer copy.exe
  "C:\Users\Admin\AppData\Local\Temp\Payment transfer copy.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5004
- - C:\Users\Admin\AppData\Local\Temp\Payment transfer copy.exe
    "C:\Users\Admin\AppData\Local\Temp\Payment transfer copy.exe"
    3⤵
    PID:3708
- - C:\Users\Admin\AppData\Local\Temp\Payment transfer copy.exe
    "C:\Users\Admin\AppData\Local\Temp\Payment transfer copy.exe"
    3⤵
    PID:3756
- - C:\Users\Admin\AppData\Local\Temp\Payment transfer copy.exe
    "C:\Users\Admin\AppData\Local\Temp\Payment transfer copy.exe"
    3⤵
    PID:4088
- - C:\Users\Admin\AppData\Local\Temp\Payment transfer copy.exe
    "C:\Users\Admin\AppData\Local\Temp\Payment transfer copy.exe"
    3⤵
    PID:980
- - C:\Users\Admin\AppData\Local\Temp\Payment transfer copy.exe
    "C:\Users\Admin\AppData\Local\Temp\Payment transfer copy.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:4456
- C:\Windows\SysWOW64\ipconfig.exe
  "C:\Windows\SysWOW64\ipconfig.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Gathers network information
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1704
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\Payment transfer copy.exe"
    3⤵
    PID:2148

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1704-152-0x0000000000320000-0x000000000034F000-memory.dmp

Download

memory/1704-151-0x0000000000B70000-0x0000000000C03000-memory.dmp

Download

memory/1704-150-0x0000000000C80000-0x0000000000FCA000-memory.dmp

Download

memory/1704-148-0x0000000000570000-0x000000000057B000-memory.dmp

Download

memory/1704-149-0x0000000000320000-0x000000000034F000-memory.dmp

Download

memory/2812-144-0x0000000008660000-0x00000000087E7000-memory.dmp

Download

memory/2812-154-0x00000000082A0000-0x0000000008383000-memory.dmp

Download

memory/2812-153-0x00000000082A0000-0x0000000008383000-memory.dmp

Download

memory/4456-143-0x0000000000BD0000-0x0000000000BE4000-memory.dmp

Download

memory/4456-142-0x00000000010D0000-0x000000000141A000-memory.dmp

Download

memory/4456-146-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4456-140-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/5004-130-0x0000000000350000-0x0000000000400000-memory.dmp

Download

memory/5004-134-0x00000000070F0000-0x000000000718C000-memory.dmp

Download

memory/5004-133-0x0000000004C90000-0x0000000004C9A000-memory.dmp

Download

memory/5004-132-0x0000000004CD0000-0x0000000004D62000-memory.dmp

Download

memory/5004-131-0x00000000051E0000-0x0000000005784000-memory.dmp

Download