formbook | 49bee43f1928c8c6cf9c0d2d692df4581235784d51ded3051685fd18a51d5599

General

Target

Justificante de transferencia ES080049 EUR57904 221010.exe
Size

1009KB
MD5

5cc24a82bbdaab6f009d121f24fff1cc
SHA1

c43cc47611c09cc6504c6079b2b15d250f8d17ea
SHA256

49bee43f1928c8c6cf9c0d2d692df4581235784d51ded3051685fd18a51d5599
SHA512

c236ef4a7925959248366132af212b7785fd239d584e968b781174ca7f5a91881c5626a7147bedab3962ee833497b412656016aa51d06b76d245de643b92b6f9
SSDEEP

12288:8I1daQlg2iNSv+LwDAbn250bdzpBi7jYEFiyPHDmTthqtxypR7RAAu:di4g1VzqAlPi3YEFl7ConyzRB

Score

10^/10

formbook jr22 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

jr22

Decoy

941zhe.com

lunarportal.space

xn--osmaniyeiek-t9ab.online

trejoscar.com

nrnursery.com

quizcannot.cfd

seedstockersthailand.com

watsonwindow.com

wjfholdings.com

weziclondon.com

naruot.xyz

yeji.plus

classicmenstore.com

oharatravel.com

therapyplankits.com

keviegreshonpt.com

qdlyner.com

seithupaarungal.com

casinorates.online

8ug4as.icu

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 5 IoCs

rat

resource	yara_rule
behavioral1/memory/1724-65-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1724-66-0x000000000041F150-mapping.dmp	formbook
behavioral1/memory/1724-68-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/584-76-0x0000000000100000-0x000000000012F000-memory.dmp	formbook
behavioral1/memory/584-81-0x0000000000100000-0x000000000012F000-memory.dmp	formbook

Deletes itself 1 IoCs

pid	Process
852	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1932 set thread context of 1724	1932	Justificante de transferencia ES080049 EUR57904 221010.exe	30
PID 1724 set thread context of 1256	1724	Justificante de transferencia ES080049 EUR57904 221010.exe	15
PID 584 set thread context of 1256	584	systray.exe	15

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1932	Justificante de transferencia ES080049 EUR57904 221010.exe
1724	Justificante de transferencia ES080049 EUR57904 221010.exe
1724	Justificante de transferencia ES080049 EUR57904 221010.exe
1980	powershell.exe
584	systray.exe
584	systray.exe
584	systray.exe
584	systray.exe
584	systray.exe
584	systray.exe
584	systray.exe
584	systray.exe
584	systray.exe
584	systray.exe
584	systray.exe
584	systray.exe
584	systray.exe
584	systray.exe
584	systray.exe
584	systray.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
1724	Justificante de transferencia ES080049 EUR57904 221010.exe
1724	Justificante de transferencia ES080049 EUR57904 221010.exe
1724	Justificante de transferencia ES080049 EUR57904 221010.exe
584	systray.exe
584	systray.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1932	Justificante de transferencia ES080049 EUR57904 221010.exe
Token: SeDebugPrivilege	1724	Justificante de transferencia ES080049 EUR57904 221010.exe
Token: SeDebugPrivilege	1980	powershell.exe
Token: SeDebugPrivilege	584	systray.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1256	Explorer.EXE
1256	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1256	Explorer.EXE
1256	Explorer.EXE

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 1980	1932	Justificante de transferencia ES080049 EUR57904 221010.exe	27
PID 1932 wrote to memory of 1980	1932	Justificante de transferencia ES080049 EUR57904 221010.exe	27
PID 1932 wrote to memory of 1980	1932	Justificante de transferencia ES080049 EUR57904 221010.exe	27
PID 1932 wrote to memory of 1980	1932	Justificante de transferencia ES080049 EUR57904 221010.exe	27
PID 1932 wrote to memory of 968	1932	Justificante de transferencia ES080049 EUR57904 221010.exe	29
PID 1932 wrote to memory of 968	1932	Justificante de transferencia ES080049 EUR57904 221010.exe	29
PID 1932 wrote to memory of 968	1932	Justificante de transferencia ES080049 EUR57904 221010.exe	29
PID 1932 wrote to memory of 968	1932	Justificante de transferencia ES080049 EUR57904 221010.exe	29
PID 1932 wrote to memory of 1724	1932	Justificante de transferencia ES080049 EUR57904 221010.exe	30
PID 1932 wrote to memory of 1724	1932	Justificante de transferencia ES080049 EUR57904 221010.exe	30
PID 1932 wrote to memory of 1724	1932	Justificante de transferencia ES080049 EUR57904 221010.exe	30
PID 1932 wrote to memory of 1724	1932	Justificante de transferencia ES080049 EUR57904 221010.exe	30
PID 1932 wrote to memory of 1724	1932	Justificante de transferencia ES080049 EUR57904 221010.exe	30
PID 1932 wrote to memory of 1724	1932	Justificante de transferencia ES080049 EUR57904 221010.exe	30
PID 1932 wrote to memory of 1724	1932	Justificante de transferencia ES080049 EUR57904 221010.exe	30
PID 1256 wrote to memory of 584	1256	Explorer.EXE	31
PID 1256 wrote to memory of 584	1256	Explorer.EXE	31
PID 1256 wrote to memory of 584	1256	Explorer.EXE	31
PID 1256 wrote to memory of 584	1256	Explorer.EXE	31
PID 584 wrote to memory of 852	584	systray.exe	32
PID 584 wrote to memory of 852	584	systray.exe	32
PID 584 wrote to memory of 852	584	systray.exe	32
PID 584 wrote to memory of 852	584	systray.exe	32

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Users\Admin\AppData\Local\Temp\Justificante de transferencia ES080049 EUR57904 221010.exe
  "C:\Users\Admin\AppData\Local\Temp\Justificante de transferencia ES080049 EUR57904 221010.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1932
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Justificante de transferencia ES080049 EUR57904 221010.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1980
- - C:\Users\Admin\AppData\Local\Temp\Justificante de transferencia ES080049 EUR57904 221010.exe
    "C:\Users\Admin\AppData\Local\Temp\Justificante de transferencia ES080049 EUR57904 221010.exe"
    3⤵
    PID:968
- - C:\Users\Admin\AppData\Local\Temp\Justificante de transferencia ES080049 EUR57904 221010.exe
    "C:\Users\Admin\AppData\Local\Temp\Justificante de transferencia ES080049 EUR57904 221010.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:1724
- C:\Windows\SysWOW64\systray.exe
  "C:\Windows\SysWOW64\systray.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:584
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\Justificante de transferencia ES080049 EUR57904 221010.exe"
    3⤵
    - Deletes itself
    PID:852

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/584-76-0x0000000000100000-0x000000000012F000-memory.dmp

Filesize
188KB

Download
memory/584-81-0x0000000000100000-0x000000000012F000-memory.dmp

Filesize
188KB

Download
memory/584-79-0x0000000000980000-0x0000000000A13000-memory.dmp

Filesize
588KB

Download
memory/584-78-0x0000000000AE0000-0x0000000000DE3000-memory.dmp

Filesize
3.0MB

Download
memory/584-75-0x0000000000FC0000-0x0000000000FC5000-memory.dmp

Filesize
20KB

Download
memory/1256-80-0x0000000004A80000-0x0000000004B3D000-memory.dmp

Filesize
756KB

Download
memory/1256-82-0x0000000004A80000-0x0000000004B3D000-memory.dmp

Filesize
756KB

Download
memory/1256-72-0x0000000003E00000-0x0000000003F51000-memory.dmp

Filesize
1.3MB

Download
memory/1724-65-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1724-68-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1724-63-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1724-70-0x00000000008B0000-0x0000000000BB3000-memory.dmp

Filesize
3.0MB

Download
memory/1724-71-0x0000000000270000-0x0000000000284000-memory.dmp

Filesize
80KB

Download
memory/1724-62-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1932-60-0x0000000004450000-0x0000000004484000-memory.dmp

Filesize
208KB

Download
memory/1932-54-0x0000000000E50000-0x0000000000F52000-memory.dmp

Filesize
1.0MB

Download
memory/1932-58-0x0000000005E70000-0x0000000005EFE000-memory.dmp

Filesize
568KB

Download
memory/1932-57-0x00000000002E0000-0x00000000002EC000-memory.dmp

Filesize
48KB

Download
memory/1932-56-0x0000000000440000-0x0000000000458000-memory.dmp

Filesize
96KB

Download
memory/1932-55-0x0000000075F51000-0x0000000075F53000-memory.dmp

Filesize
8KB

Download
memory/1980-73-0x0000000073FC0000-0x000000007456B000-memory.dmp

Filesize
5.7MB

Download
memory/1980-69-0x0000000073FC0000-0x000000007456B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing