formbook | 362bf939fb73269fe4298d695eceb9dd95161f6346b75fcf1b756010903d05d3

General

Target

MV. WBC TBN 1._PARTICULARS.exe
Size

429KB
MD5

f9ab0dee05ae6ec17cc0d971213ff477
SHA1

11b0ca2284db669e655624bbdf06c96bbc21e989
SHA256

362bf939fb73269fe4298d695eceb9dd95161f6346b75fcf1b756010903d05d3
SHA512

13b37c3c6f765ab4c6d974a33d471aa2274d73fc9f07c0055dc5fa7bda502f8a9d9568f8ec95043b9578e7c2abfab9dcfed6d32ccd842183ce9be2ee3a2fd7f1
SSDEEP

6144:ooqVyigXq1rRPYU4VSyv4IAXp9il7kDnobvh6JvH9ASHjOXUBMFsR:6Vy2fPOOpANGUh2vH9AfEBMY

Score

10^/10

formbook ermr rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

ermr

Decoy

ErOK6LFCgNIAlQmH54oaYOL/CN29Z78=

qNSdDhu/PT/1fgafDagiCSZH1SY=

wLpPOAkYS8EABl3pHGc4hNT/Q1sHBrU=

jSxRvptHkeTGl7PT0SEmaZmjqzanuA==

b91oL+2wCcpyhnd6yvF6Pg==

mr81yp1/qqZX

hy7Xsz/PU/LWHMcGL4UYJx9n3A==

KlwrHt1gouPaXaWhoQ==

ng8M320IRJL9Ptw=

8GQbOXuaWxvKnNM=

XndOL7E5sNpVUNty4d/a

rryPBBC8PybYb+2h2MF3FHGL

kEoeyERSVCYO0g==

5/P+SBDby5hO

1fYXc30/h9W7iO17

34X+YKR+wRFE

8ir/X2MlVByh5lQ1ow8=

u9ikm2UMZ7J7hpCYow==

FLI+c3clp1BNDjVAfvC2Dnw=

t21Erq8/r09wAzAJTAH3Ng==

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

MV. WBC TBN 1._PARTICULARS.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	MV. WBC TBN 1._PARTICULARS.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

MV. WBC TBN 1._PARTICULARS.exeMV. WBC TBN 1._PARTICULARS.exemsdt.exe

description	pid	process	target process
PID 5048 set thread context of 2612	5048	MV. WBC TBN 1._PARTICULARS.exe	MV. WBC TBN 1._PARTICULARS.exe
PID 2612 set thread context of 2984	2612	MV. WBC TBN 1._PARTICULARS.exe	Explorer.EXE
PID 4320 set thread context of 2984	4320	msdt.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 56 IoCs

Processes:

MV. WBC TBN 1._PARTICULARS.exemsdt.exe

pid	process
2612	MV. WBC TBN 1._PARTICULARS.exe
2612	MV. WBC TBN 1._PARTICULARS.exe
2612	MV. WBC TBN 1._PARTICULARS.exe
2612	MV. WBC TBN 1._PARTICULARS.exe
2612	MV. WBC TBN 1._PARTICULARS.exe
2612	MV. WBC TBN 1._PARTICULARS.exe
2612	MV. WBC TBN 1._PARTICULARS.exe
2612	MV. WBC TBN 1._PARTICULARS.exe
4320	msdt.exe
4320	msdt.exe
4320	msdt.exe
4320	msdt.exe
4320	msdt.exe
4320	msdt.exe
4320	msdt.exe
4320	msdt.exe
4320	msdt.exe
4320	msdt.exe
4320	msdt.exe
4320	msdt.exe
4320	msdt.exe
4320	msdt.exe
4320	msdt.exe
4320	msdt.exe
4320	msdt.exe
4320	msdt.exe
4320	msdt.exe
4320	msdt.exe
4320	msdt.exe
4320	msdt.exe
4320	msdt.exe
4320	msdt.exe
4320	msdt.exe
4320	msdt.exe
4320	msdt.exe
4320	msdt.exe
4320	msdt.exe
4320	msdt.exe
4320	msdt.exe
4320	msdt.exe
4320	msdt.exe
4320	msdt.exe
4320	msdt.exe
4320	msdt.exe
4320	msdt.exe
4320	msdt.exe
4320	msdt.exe
4320	msdt.exe
4320	msdt.exe
4320	msdt.exe
4320	msdt.exe
4320	msdt.exe
4320	msdt.exe
4320	msdt.exe
4320	msdt.exe
4320	msdt.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

2984 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

MV. WBC TBN 1._PARTICULARS.exemsdt.exe

pid process

2612 MV. WBC TBN 1._PARTICULARS.exe
2612 MV. WBC TBN 1._PARTICULARS.exe
2612 MV. WBC TBN 1._PARTICULARS.exe
4320 msdt.exe
4320 msdt.exe

pid	process
2984	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

MV. WBC TBN 1._PARTICULARS.exeMV. WBC TBN 1._PARTICULARS.exemsdt.exe

description	pid	process
Token: SeDebugPrivilege	5048	MV. WBC TBN 1._PARTICULARS.exe
Token: SeDebugPrivilege	2612	MV. WBC TBN 1._PARTICULARS.exe
Token: SeDebugPrivilege	4320	msdt.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

MV. WBC TBN 1._PARTICULARS.exeExplorer.EXEmsdt.exe

description	pid	process	target process
PID 5048 wrote to memory of 2612	5048	MV. WBC TBN 1._PARTICULARS.exe	MV. WBC TBN 1._PARTICULARS.exe
PID 5048 wrote to memory of 2612	5048	MV. WBC TBN 1._PARTICULARS.exe	MV. WBC TBN 1._PARTICULARS.exe
PID 5048 wrote to memory of 2612	5048	MV. WBC TBN 1._PARTICULARS.exe	MV. WBC TBN 1._PARTICULARS.exe
PID 5048 wrote to memory of 2612	5048	MV. WBC TBN 1._PARTICULARS.exe	MV. WBC TBN 1._PARTICULARS.exe
PID 5048 wrote to memory of 2612	5048	MV. WBC TBN 1._PARTICULARS.exe	MV. WBC TBN 1._PARTICULARS.exe
PID 5048 wrote to memory of 2612	5048	MV. WBC TBN 1._PARTICULARS.exe	MV. WBC TBN 1._PARTICULARS.exe
PID 2984 wrote to memory of 4320	2984	Explorer.EXE	msdt.exe
PID 2984 wrote to memory of 4320	2984	Explorer.EXE	msdt.exe
PID 2984 wrote to memory of 4320	2984	Explorer.EXE	msdt.exe
PID 4320 wrote to memory of 3816	4320	msdt.exe	cmd.exe
PID 4320 wrote to memory of 3816	4320	msdt.exe	cmd.exe
PID 4320 wrote to memory of 3816	4320	msdt.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2984

C:\Users\Admin\AppData\Local\Temp\MV. WBC TBN 1._PARTICULARS.exe
"C:\Users\Admin\AppData\Local\Temp\MV. WBC TBN 1._PARTICULARS.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5048

C:\Users\Admin\AppData\Local\Temp\MV. WBC TBN 1._PARTICULARS.exe
"C:\Users\Admin\AppData\Local\Temp\MV. WBC TBN 1._PARTICULARS.exe"
3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2612

C:\Windows\SysWOW64\autochk.exe
"C:\Windows\SysWOW64\autochk.exe"
2⤵
PID:380

C:\Windows\SysWOW64\autochk.exe
"C:\Windows\SysWOW64\autochk.exe"
2⤵
PID:3324

C:\Windows\SysWOW64\msdt.exe
"C:\Windows\SysWOW64\msdt.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4320

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\MV. WBC TBN 1._PARTICULARS.exe"
3⤵
PID:3816

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2612-140-0x0000000001A40000-0x0000000001A51000-memory.dmp

Filesize
68KB

Download
memory/2612-138-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2612-139-0x00000000016F0000-0x0000000001A3A000-memory.dmp

Filesize
3.3MB

Download
memory/2612-135-0x0000000000000000-mapping.dmp

Download
memory/2612-136-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2984-151-0x0000000008A70000-0x0000000008BA2000-memory.dmp

Filesize
1.2MB

Download
memory/2984-141-0x00000000086C0000-0x00000000087AA000-memory.dmp

Filesize
936KB

Download
memory/2984-149-0x0000000008A70000-0x0000000008BA2000-memory.dmp

Filesize
1.2MB

Download
memory/2984-147-0x00000000086C0000-0x00000000087AA000-memory.dmp

Filesize
936KB

Download
memory/3816-145-0x0000000000000000-mapping.dmp

Download
memory/4320-148-0x0000000003000000-0x0000000003090000-memory.dmp

Filesize
576KB

Download
memory/4320-143-0x0000000000860000-0x00000000008B7000-memory.dmp

Filesize
348KB

Download
memory/4320-144-0x0000000001200000-0x000000000122D000-memory.dmp

Filesize
180KB

Download
memory/4320-146-0x00000000031C0000-0x000000000350A000-memory.dmp

Filesize
3.3MB

Download
memory/4320-150-0x0000000001200000-0x000000000122D000-memory.dmp

Filesize
180KB

Download
memory/4320-142-0x0000000000000000-mapping.dmp

Download
memory/5048-133-0x0000000005CF0000-0x0000000006294000-memory.dmp

Filesize
5.6MB

Download
memory/5048-132-0x0000000000C40000-0x0000000000CB0000-memory.dmp

Filesize
448KB

Download
memory/5048-134-0x0000000005740000-0x00000000057A6000-memory.dmp

Filesize
408KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads