formbook | 6de750cf7e7a9f7a3fced7712ebde1360102bf175362c71e3f304d01eaa59e30

General

Target

SecuriteInfo.com.W32.AIDetectNet.01.10877.exe
Size

919KB
MD5

78cce3c1d0cadadd8be8fe9022be5f44
SHA1

dd881fdfca2d2dd2a466e49f46811c38a1172327
SHA256

6de750cf7e7a9f7a3fced7712ebde1360102bf175362c71e3f304d01eaa59e30
SHA512

f2dec41a90a0b52e1354cd75daca5fd7f614c78b8f7a57762548f24ef5ebd78dace3c915307e06ea5d133a3301d12bbf898aec850eb041d8d421c5aa15971a69

Score

10^/10

formbook de08 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

de08

Decoy

retirecloudyyard.com

fabiyan.xyz

chrisarlyde.com

selapex.com

vivalosgales.com

specialty-medicine.com

contasesolucoes.com

satunusanews.net

allyibc.com

alameda1876.com

artofdala.com

yukoidusp.xyz

steeldrumbandnearme.com

stonewedgetechnology.com

kentonai.com

macquarie-private.com

ddgwy.com

megagreenhousekits.com

descomplicaomarketing.com

inclusiverealtor.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2724-145-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/2724-159-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/1420-162-0x0000000000D60000-0x0000000000D8F000-memory.dmp	formbook
behavioral2/memory/1420-170-0x0000000000D60000-0x0000000000D8F000-memory.dmp	formbook

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

SecuriteInfo.com.W32.AIDetectNet.01.10877.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\Control Panel\International\Geo\Nation	SecuriteInfo.com.W32.AIDetectNet.01.10877.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

SecuriteInfo.com.W32.AIDetectNet.01.10877.exeRegSvcs.execolorcpl.exe

description	pid	process	target process
PID 2456 set thread context of 2724	2456	SecuriteInfo.com.W32.AIDetectNet.01.10877.exe	RegSvcs.exe
PID 2724 set thread context of 2096	2724	RegSvcs.exe	Explorer.EXE
PID 1420 set thread context of 2096	1420	colorcpl.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4504 schtasks.exe

pid	process
4504	schtasks.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

Processes:

SecuriteInfo.com.W32.AIDetectNet.01.10877.exepowershell.exeRegSvcs.execolorcpl.exe

pid	process
2456	SecuriteInfo.com.W32.AIDetectNet.01.10877.exe
2456	SecuriteInfo.com.W32.AIDetectNet.01.10877.exe
632	powershell.exe
2724	RegSvcs.exe
2724	RegSvcs.exe
632	powershell.exe
2724	RegSvcs.exe
2724	RegSvcs.exe
1420	colorcpl.exe
1420	colorcpl.exe
1420	colorcpl.exe
1420	colorcpl.exe
1420	colorcpl.exe
1420	colorcpl.exe
1420	colorcpl.exe
1420	colorcpl.exe
1420	colorcpl.exe
1420	colorcpl.exe
1420	colorcpl.exe
1420	colorcpl.exe
1420	colorcpl.exe
1420	colorcpl.exe
1420	colorcpl.exe
1420	colorcpl.exe
1420	colorcpl.exe
1420	colorcpl.exe
1420	colorcpl.exe
1420	colorcpl.exe
1420	colorcpl.exe
1420	colorcpl.exe
1420	colorcpl.exe
1420	colorcpl.exe
1420	colorcpl.exe
1420	colorcpl.exe
1420	colorcpl.exe
1420	colorcpl.exe
1420	colorcpl.exe
1420	colorcpl.exe
1420	colorcpl.exe
1420	colorcpl.exe
1420	colorcpl.exe
1420	colorcpl.exe
1420	colorcpl.exe
1420	colorcpl.exe
1420	colorcpl.exe
1420	colorcpl.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

2096 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

RegSvcs.execolorcpl.exe

pid process

2724 RegSvcs.exe
2724 RegSvcs.exe
2724 RegSvcs.exe
1420 colorcpl.exe
1420 colorcpl.exe

pid	process
2096	Explorer.EXE

pid	process
2724	RegSvcs.exe
2724	RegSvcs.exe
2724	RegSvcs.exe
1420	colorcpl.exe
1420	colorcpl.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

SecuriteInfo.com.W32.AIDetectNet.01.10877.exepowershell.exeRegSvcs.execolorcpl.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	2456	SecuriteInfo.com.W32.AIDetectNet.01.10877.exe
Token: SeDebugPrivilege	632	powershell.exe
Token: SeDebugPrivilege	2724	RegSvcs.exe
Token: SeDebugPrivilege	1420	colorcpl.exe
Token: SeShutdownPrivilege	2096	Explorer.EXE
Token: SeCreatePagefilePrivilege	2096	Explorer.EXE

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

SecuriteInfo.com.W32.AIDetectNet.01.10877.exeExplorer.EXEcolorcpl.exe

description	pid	process	target process
PID 2456 wrote to memory of 632	2456	SecuriteInfo.com.W32.AIDetectNet.01.10877.exe	powershell.exe
PID 2456 wrote to memory of 632	2456	SecuriteInfo.com.W32.AIDetectNet.01.10877.exe	powershell.exe
PID 2456 wrote to memory of 632	2456	SecuriteInfo.com.W32.AIDetectNet.01.10877.exe	powershell.exe
PID 2456 wrote to memory of 4504	2456	SecuriteInfo.com.W32.AIDetectNet.01.10877.exe	schtasks.exe
PID 2456 wrote to memory of 4504	2456	SecuriteInfo.com.W32.AIDetectNet.01.10877.exe	schtasks.exe
PID 2456 wrote to memory of 4504	2456	SecuriteInfo.com.W32.AIDetectNet.01.10877.exe	schtasks.exe
PID 2456 wrote to memory of 460	2456	SecuriteInfo.com.W32.AIDetectNet.01.10877.exe	RegSvcs.exe
PID 2456 wrote to memory of 460	2456	SecuriteInfo.com.W32.AIDetectNet.01.10877.exe	RegSvcs.exe
PID 2456 wrote to memory of 460	2456	SecuriteInfo.com.W32.AIDetectNet.01.10877.exe	RegSvcs.exe
PID 2456 wrote to memory of 2724	2456	SecuriteInfo.com.W32.AIDetectNet.01.10877.exe	RegSvcs.exe
PID 2456 wrote to memory of 2724	2456	SecuriteInfo.com.W32.AIDetectNet.01.10877.exe	RegSvcs.exe
PID 2456 wrote to memory of 2724	2456	SecuriteInfo.com.W32.AIDetectNet.01.10877.exe	RegSvcs.exe
PID 2456 wrote to memory of 2724	2456	SecuriteInfo.com.W32.AIDetectNet.01.10877.exe	RegSvcs.exe
PID 2456 wrote to memory of 2724	2456	SecuriteInfo.com.W32.AIDetectNet.01.10877.exe	RegSvcs.exe
PID 2456 wrote to memory of 2724	2456	SecuriteInfo.com.W32.AIDetectNet.01.10877.exe	RegSvcs.exe
PID 2096 wrote to memory of 1420	2096	Explorer.EXE	colorcpl.exe
PID 2096 wrote to memory of 1420	2096	Explorer.EXE	colorcpl.exe
PID 2096 wrote to memory of 1420	2096	Explorer.EXE	colorcpl.exe
PID 1420 wrote to memory of 1276	1420	colorcpl.exe	cmd.exe
PID 1420 wrote to memory of 1276	1420	colorcpl.exe	cmd.exe
PID 1420 wrote to memory of 1276	1420	colorcpl.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2096

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.10877.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.10877.exe"
2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2456

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\jQQlGgDoQsDzy.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:632

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jQQlGgDoQsDzy" /XML "C:\Users\Admin\AppData\Local\Temp\tmp69D6.tmp"
3⤵
- Creates scheduled task(s)
PID:4504

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
3⤵
PID:460

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2724

C:\Windows\SysWOW64\colorcpl.exe
"C:\Windows\SysWOW64\colorcpl.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1420

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
3⤵
PID:1276

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp69D6.tmp
Filesize
1KB

MD5
9a0286afba01faa27afccb5bd6c69dd6

SHA1
74e72bdd0139e2fada4a384bc66a622f4d6c0d79

SHA256
60daa9d21b2af134809b6a5d6f40a84193d4fa7ddb07217fbc0277afd9c11531

SHA512
e95a999f5ce2a2d79fe915b57c0be1c151f89a06a329fe42440a0f9edc725752cd7656e8bafecf79a12c40e6e8e1afa18b534c1ec20e677455a8347365f301a6

Download Submit
memory/460-142-0x0000000000000000-mapping.dmp

Download
memory/632-153-0x0000000006EF0000-0x0000000006F22000-memory.dmp

Filesize
200KB

Download
memory/632-163-0x0000000007EB0000-0x0000000007F46000-memory.dmp

Filesize
600KB

Download
memory/632-154-0x0000000070E80000-0x0000000070ECC000-memory.dmp

Filesize
304KB

Download
memory/632-157-0x0000000007C30000-0x0000000007C4A000-memory.dmp

Filesize
104KB

Download
memory/632-138-0x0000000000000000-mapping.dmp

Download
memory/632-156-0x0000000008270000-0x00000000088EA000-memory.dmp

Filesize
6.5MB

Download
memory/632-140-0x0000000005360000-0x0000000005396000-memory.dmp

Filesize
216KB

Download
memory/632-168-0x0000000007F50000-0x0000000007F58000-memory.dmp

Filesize
32KB

Download
memory/632-167-0x0000000007F70000-0x0000000007F8A000-memory.dmp

Filesize
104KB

Download
memory/632-143-0x0000000005A10000-0x0000000006038000-memory.dmp

Filesize
6.2MB

Download
memory/632-166-0x0000000007E60000-0x0000000007E6E000-memory.dmp

Filesize
56KB

Download
memory/632-160-0x0000000007CA0000-0x0000000007CAA000-memory.dmp

Filesize
40KB

Download
memory/632-146-0x0000000005970000-0x0000000005992000-memory.dmp

Filesize
136KB

Download
memory/632-147-0x0000000006270000-0x00000000062D6000-memory.dmp

Filesize
408KB

Download
memory/632-149-0x0000000006920000-0x000000000693E000-memory.dmp

Filesize
120KB

Download
memory/632-155-0x0000000006ED0000-0x0000000006EEE000-memory.dmp

Filesize
120KB

Download
memory/1276-164-0x0000000000000000-mapping.dmp

Download
memory/1420-158-0x0000000000000000-mapping.dmp

Download
memory/1420-162-0x0000000000D60000-0x0000000000D8F000-memory.dmp

Filesize
188KB

Download
memory/1420-161-0x00000000009F0000-0x0000000000A09000-memory.dmp

Filesize
100KB

Download
memory/1420-165-0x0000000002E30000-0x000000000317A000-memory.dmp

Filesize
3.3MB

Download
memory/1420-169-0x0000000002CB0000-0x0000000002D43000-memory.dmp

Filesize
588KB

Download
memory/1420-170-0x0000000000D60000-0x0000000000D8F000-memory.dmp

Filesize
188KB

Download
memory/2096-171-0x0000000008610000-0x000000000877E000-memory.dmp

Filesize
1.4MB

Download
memory/2096-152-0x0000000008170000-0x00000000082A2000-memory.dmp

Filesize
1.2MB

Download
memory/2096-172-0x0000000008610000-0x000000000877E000-memory.dmp

Filesize
1.4MB

Download
memory/2456-134-0x0000000004C40000-0x0000000004CD2000-memory.dmp

Filesize
584KB

Download
memory/2456-133-0x0000000005150000-0x00000000056F4000-memory.dmp

Filesize
5.6MB

Download
memory/2456-132-0x0000000000110000-0x00000000001FC000-memory.dmp

Filesize
944KB

Download
memory/2456-137-0x0000000008A50000-0x0000000008AB6000-memory.dmp

Filesize
408KB

Download
memory/2456-136-0x00000000089B0000-0x0000000008A4C000-memory.dmp

Filesize
624KB

Download
memory/2456-135-0x0000000004B80000-0x0000000004B8A000-memory.dmp

Filesize
40KB

Download
memory/2724-150-0x0000000001740000-0x0000000001A8A000-memory.dmp

Filesize
3.3MB

Download
memory/2724-151-0x00000000013A0000-0x00000000013B4000-memory.dmp

Filesize
80KB

Download
memory/2724-145-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2724-144-0x0000000000000000-mapping.dmp

Download
memory/2724-159-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4504-139-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads