formbook | bf3f26dfdfa937db7f856c20013d77ff05c76cb6f359b703d3f25e840686a9a4

General

Target

Qfrmegh.exe
Size

168KB
MD5

dfb8e69404268f25876c462adc10479a
SHA1

a5c7ab73c4bf71c64c0bb1f3345516ca14d5d13e
SHA256

bf3f26dfdfa937db7f856c20013d77ff05c76cb6f359b703d3f25e840686a9a4
SHA512

2f9381e0d336e97c767aff166928c5ee6d6a26940c7131ed5753aa0702d377d0d8abfceaa80271498120cefd609c10026ec2bd5bf87dc1fdab2e9bbaacf9e527

Score

10^/10

formbook ba17 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ba17

Decoy

bearwant.com

sdsguanfang.com

steamcommunityvia.top

sugarplumtreasures.com

koronislakefishing.com

jmae.xyz

xhxnqemkiqe.xyz

playzcrew.com

zatwsbq.com

lankofix.com

sh-zhepeng.com

mibodamisxv.online

butterflyjewelry.store

finestrecitalto-spottoday.info

globomateria.com

royalmdarts.com

d4af10836709.com

shepwill.com

67aldrich.info

trustedmakers.club

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 6 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/268-66-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/268-67-0x000000000041F1E0-mapping.dmp	formbook
behavioral1/memory/268-69-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/268-77-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/848-81-0x0000000000080000-0x00000000000AF000-memory.dmp	formbook
behavioral1/memory/848-83-0x0000000000080000-0x00000000000AF000-memory.dmp	formbook

Suspicious use of SetThreadContext 4 IoCs

Processes:

Qfrmegh.exeMSBuild.exewininit.exe

description	pid	process	target process
PID 1824 set thread context of 268	1824	Qfrmegh.exe	MSBuild.exe
PID 268 set thread context of 1272	268	MSBuild.exe	Explorer.EXE
PID 268 set thread context of 1272	268	MSBuild.exe	Explorer.EXE
PID 848 set thread context of 1272	848	wininit.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 25 IoCs

Processes:

powershell.exeQfrmegh.exeMSBuild.exewininit.exe

pid	process
900	powershell.exe
1824	Qfrmegh.exe
1824	Qfrmegh.exe
1824	Qfrmegh.exe
268	MSBuild.exe
268	MSBuild.exe
268	MSBuild.exe
848	wininit.exe
848	wininit.exe
848	wininit.exe
848	wininit.exe
848	wininit.exe
848	wininit.exe
848	wininit.exe
848	wininit.exe
848	wininit.exe
848	wininit.exe
848	wininit.exe
848	wininit.exe
848	wininit.exe
848	wininit.exe
848	wininit.exe
848	wininit.exe
848	wininit.exe
848	wininit.exe

Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

MSBuild.exewininit.exe

pid process

268 MSBuild.exe
268 MSBuild.exe
268 MSBuild.exe
268 MSBuild.exe
848 wininit.exe
848 wininit.exe

pid	process
268	MSBuild.exe
268	MSBuild.exe
268	MSBuild.exe
268	MSBuild.exe
848	wininit.exe
848	wininit.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

Qfrmegh.exepowershell.exeMSBuild.exewininit.exe

description	pid	process
Token: SeDebugPrivilege	1824	Qfrmegh.exe
Token: SeDebugPrivilege	900	powershell.exe
Token: SeDebugPrivilege	268	MSBuild.exe
Token: SeDebugPrivilege	848	wininit.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

Qfrmegh.exeExplorer.EXEwininit.exe

description	pid	process	target process
PID 1824 wrote to memory of 900	1824	Qfrmegh.exe	powershell.exe
PID 1824 wrote to memory of 900	1824	Qfrmegh.exe	powershell.exe
PID 1824 wrote to memory of 900	1824	Qfrmegh.exe	powershell.exe
PID 1824 wrote to memory of 900	1824	Qfrmegh.exe	powershell.exe
PID 1824 wrote to memory of 696	1824	Qfrmegh.exe	MSBuild.exe
PID 1824 wrote to memory of 696	1824	Qfrmegh.exe	MSBuild.exe
PID 1824 wrote to memory of 696	1824	Qfrmegh.exe	MSBuild.exe
PID 1824 wrote to memory of 696	1824	Qfrmegh.exe	MSBuild.exe
PID 1824 wrote to memory of 268	1824	Qfrmegh.exe	MSBuild.exe
PID 1824 wrote to memory of 268	1824	Qfrmegh.exe	MSBuild.exe
PID 1824 wrote to memory of 268	1824	Qfrmegh.exe	MSBuild.exe
PID 1824 wrote to memory of 268	1824	Qfrmegh.exe	MSBuild.exe
PID 1824 wrote to memory of 268	1824	Qfrmegh.exe	MSBuild.exe
PID 1824 wrote to memory of 268	1824	Qfrmegh.exe	MSBuild.exe
PID 1824 wrote to memory of 268	1824	Qfrmegh.exe	MSBuild.exe
PID 1272 wrote to memory of 848	1272	Explorer.EXE	wininit.exe
PID 1272 wrote to memory of 848	1272	Explorer.EXE	wininit.exe
PID 1272 wrote to memory of 848	1272	Explorer.EXE	wininit.exe
PID 1272 wrote to memory of 848	1272	Explorer.EXE	wininit.exe
PID 848 wrote to memory of 1880	848	wininit.exe	cmd.exe
PID 848 wrote to memory of 1880	848	wininit.exe	cmd.exe
PID 848 wrote to memory of 1880	848	wininit.exe	cmd.exe
PID 848 wrote to memory of 1880	848	wininit.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:1272

C:\Users\Admin\AppData\Local\Temp\Qfrmegh.exe
"C:\Users\Admin\AppData\Local\Temp\Qfrmegh.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1824

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:900

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
3⤵
PID:696

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:268

C:\Windows\SysWOW64\wininit.exe
"C:\Windows\SysWOW64\wininit.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:848

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
3⤵
PID:1880

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/268-64-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/268-77-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/268-74-0x0000000000190000-0x00000000001A5000-memory.dmp

Filesize
84KB

Download
memory/268-71-0x0000000000140000-0x0000000000155000-memory.dmp

Filesize
84KB

Download
memory/268-70-0x0000000000A40000-0x0000000000D43000-memory.dmp

Filesize
3.0MB

Download
memory/268-69-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/268-67-0x000000000041F1E0-mapping.dmp

Download
memory/268-66-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/268-63-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/848-79-0x0000000000A20000-0x0000000000A3A000-memory.dmp

Filesize
104KB

Download
memory/848-80-0x0000000001FD0000-0x00000000022D3000-memory.dmp

Filesize
3.0MB

Download
memory/848-83-0x0000000000080000-0x00000000000AF000-memory.dmp

Filesize
188KB

Download
memory/848-82-0x0000000000520000-0x00000000005B4000-memory.dmp

Filesize
592KB

Download
memory/848-81-0x0000000000080000-0x00000000000AF000-memory.dmp

Filesize
188KB

Download
memory/848-76-0x0000000000000000-mapping.dmp

Download
memory/900-58-0x0000000000000000-mapping.dmp

Download
memory/900-61-0x0000000070900000-0x0000000070EAB000-memory.dmp

Filesize
5.7MB

Download
memory/900-60-0x0000000070900000-0x0000000070EAB000-memory.dmp

Filesize
5.7MB

Download
memory/900-62-0x0000000070900000-0x0000000070EAB000-memory.dmp

Filesize
5.7MB

Download
memory/1272-85-0x0000000006F90000-0x00000000070E8000-memory.dmp

Filesize
1.3MB

Download
memory/1272-75-0x0000000006510000-0x0000000006632000-memory.dmp

Filesize
1.1MB

Download
memory/1272-72-0x0000000004EC0000-0x0000000004FCA000-memory.dmp

Filesize
1.0MB

Download
memory/1272-84-0x0000000006F90000-0x00000000070E8000-memory.dmp

Filesize
1.3MB

Download
memory/1824-57-0x00000000005E0000-0x000000000062C000-memory.dmp

Filesize
304KB

Download
memory/1824-54-0x00000000000A0000-0x00000000000D0000-memory.dmp

Filesize
192KB

Download
memory/1824-55-0x0000000075E31000-0x0000000075E33000-memory.dmp

Filesize
8KB

Download
memory/1824-56-0x0000000004D80000-0x0000000004E26000-memory.dmp

Filesize
664KB

Download
memory/1880-78-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads