formbook | b1313b8c8d249728b5fe9756332a98c1415468df5f7001f2c1e4c26826edb83e

General

Target

SecuriteInfo.com.Trojan.Olock.1.19122.exe
Size

450KB
MD5

0c7194673ca5c213b88c8696d285d205
SHA1

d4575c2ea9fc7bc24ca086f403d132b70167cc49
SHA256

b1313b8c8d249728b5fe9756332a98c1415468df5f7001f2c1e4c26826edb83e
SHA512

a0732717dab0521c73fd6668053311cc96d82176f71b82cbcf91bd484c9cf7803fdde0a42960af338f8aa6b5be505dff71a94c18283c7838b2c0e7cd36821f1c

Score

10^/10

formbook t19g rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

t19g

Decoy

playstationspiele.com

cakesbyannal.com

racepin.space

anti-offender.com

magnetque.com

farragorealtybrokerage.com

khuludmohammed.com

v33696.com

84ggg.com

d440.com

soccersmarthome.com

ofthis.world

fivestaryardcards.com

lusyard.com

gghft.com

viajesfortur.com

rationalirrationality.com

hanaramenrestaurant.com

exactlycleanse.com

martensenargentina.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1548-67-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1548-68-0x000000000041F1B0-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

SecuriteInfo.com.Trojan.Olock.1.19122.exe

description	pid	process	target process
PID 1896 set thread context of 1548	1896	SecuriteInfo.com.Trojan.Olock.1.19122.exe	SecuriteInfo.com.Trojan.Olock.1.19122.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

932 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

SecuriteInfo.com.Trojan.Olock.1.19122.exepowershell.exe

pid process

1548 SecuriteInfo.com.Trojan.Olock.1.19122.exe
1328 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1328 powershell.exe

pid	process
932	schtasks.exe

pid	process
1548	SecuriteInfo.com.Trojan.Olock.1.19122.exe
1328	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1328	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

SecuriteInfo.com.Trojan.Olock.1.19122.exe

description	pid	process	target process
PID 1896 wrote to memory of 1328	1896	SecuriteInfo.com.Trojan.Olock.1.19122.exe	powershell.exe
PID 1896 wrote to memory of 1328	1896	SecuriteInfo.com.Trojan.Olock.1.19122.exe	powershell.exe
PID 1896 wrote to memory of 1328	1896	SecuriteInfo.com.Trojan.Olock.1.19122.exe	powershell.exe
PID 1896 wrote to memory of 1328	1896	SecuriteInfo.com.Trojan.Olock.1.19122.exe	powershell.exe
PID 1896 wrote to memory of 932	1896	SecuriteInfo.com.Trojan.Olock.1.19122.exe	schtasks.exe
PID 1896 wrote to memory of 932	1896	SecuriteInfo.com.Trojan.Olock.1.19122.exe	schtasks.exe
PID 1896 wrote to memory of 932	1896	SecuriteInfo.com.Trojan.Olock.1.19122.exe	schtasks.exe
PID 1896 wrote to memory of 932	1896	SecuriteInfo.com.Trojan.Olock.1.19122.exe	schtasks.exe
PID 1896 wrote to memory of 1548	1896	SecuriteInfo.com.Trojan.Olock.1.19122.exe	SecuriteInfo.com.Trojan.Olock.1.19122.exe
PID 1896 wrote to memory of 1548	1896	SecuriteInfo.com.Trojan.Olock.1.19122.exe	SecuriteInfo.com.Trojan.Olock.1.19122.exe
PID 1896 wrote to memory of 1548	1896	SecuriteInfo.com.Trojan.Olock.1.19122.exe	SecuriteInfo.com.Trojan.Olock.1.19122.exe
PID 1896 wrote to memory of 1548	1896	SecuriteInfo.com.Trojan.Olock.1.19122.exe	SecuriteInfo.com.Trojan.Olock.1.19122.exe
PID 1896 wrote to memory of 1548	1896	SecuriteInfo.com.Trojan.Olock.1.19122.exe	SecuriteInfo.com.Trojan.Olock.1.19122.exe
PID 1896 wrote to memory of 1548	1896	SecuriteInfo.com.Trojan.Olock.1.19122.exe	SecuriteInfo.com.Trojan.Olock.1.19122.exe
PID 1896 wrote to memory of 1548	1896	SecuriteInfo.com.Trojan.Olock.1.19122.exe	SecuriteInfo.com.Trojan.Olock.1.19122.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Olock.1.19122.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Olock.1.19122.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1896

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\TGArRC.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1328

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TGArRC" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1095.tmp"
2⤵
- Creates scheduled task(s)
PID:932

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Olock.1.19122.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Olock.1.19122.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1548

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp1095.tmp
Filesize
1KB

MD5
0f58d3f3cbdbb1e641c1678c07d01772

SHA1
18eefaf7e6607f1b49d919d2f5aac1052128969d

SHA256
95e0cfea649f6ac9d44a06741c39f3ae0dba6d29059ccbc54d9a5a737d47ea4a

SHA512
a966356dbfe48664ce4c7ea751958b16387ecbbc7f058508cc2db11c5343c29a60af006f8f94ba44d51d46c6401900c6e4c7525ae8b5cd349ceadda077809410

Download Submit
memory/932-60-0x0000000000000000-mapping.dmp

Download
memory/1328-71-0x000000006E830000-0x000000006EDDB000-memory.dmp

Filesize
5.7MB

Download
memory/1328-70-0x000000006E830000-0x000000006EDDB000-memory.dmp

Filesize
5.7MB

Download
memory/1328-59-0x0000000000000000-mapping.dmp

Download
memory/1548-65-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1548-69-0x0000000000830000-0x0000000000B33000-memory.dmp

Filesize
3.0MB

Download
memory/1548-68-0x000000000041F1B0-mapping.dmp

Download
memory/1548-67-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1548-64-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1896-58-0x00000000053E0000-0x000000000544C000-memory.dmp

Filesize
432KB

Download
memory/1896-63-0x0000000002060000-0x0000000002094000-memory.dmp

Filesize
208KB

Download
memory/1896-54-0x0000000000260000-0x00000000002D6000-memory.dmp

Filesize
472KB

Download
memory/1896-57-0x0000000000500000-0x000000000050A000-memory.dmp

Filesize
40KB

Download
memory/1896-56-0x0000000000250000-0x0000000000264000-memory.dmp

Filesize
80KB

Download
memory/1896-55-0x0000000076081000-0x0000000076083000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads