formbook | 392d84c160a17dd93a78b8549f5298d43d1f2ead6d236a1780bc290cc864e615

General

Target

formbook5.exe
Size

718KB
MD5

39cffb366d87292f4b5efecf69c32774
SHA1

104fe2e617556e97af1a6f5082bba003a8e9ff3d
SHA256

37e9f15077e6491eade2a03b73b9f48b0037c6995a5fbecdae7a942710d1dde1
SHA512

d508a86dc49fc5737904b23ceab055329ebf47dc77b119297a8d1fb6c1f17217a24ec0a714787e8dcda215381549a04d77d8212f0fd83ddcf1de545453d4078f
SSDEEP

12288:3hUWMtLdsIJ4Il6RXTTpbe0RRnT7QLtAeSfN5r5pHM2as8i9Rr5o7We:xhMtBsy6R82RnTEmewN5rr8i98

Score

10^/10

formbook gs25 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

gs25

Decoy

real-food.store

marketdatalibrary.com

jolidens.space

ydental.info

tattoosbyjayinked.com

buytradesellpei.com

61983.xyz

identitysolver.xyz

mgfang.com

teizer.one

staychillax.com

ylanzarote.com

workte.net

maukigato.shop

coolbag.site

btya1r.com

dkhaohao.shop

zugaro.xyz

boon168.com

xn--80aeegahlwtdkp.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 4 IoCs

rat

resource	yara_rule
behavioral2/memory/3664-140-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/3664-142-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/4280-148-0x0000000000990000-0x00000000009BF000-memory.dmp	formbook
behavioral2/memory/4280-154-0x0000000000990000-0x00000000009BF000-memory.dmp	formbook

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	formbook5.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3708 set thread context of 3664	3708	formbook5.exe	94
PID 3664 set thread context of 3000	3664	RegSvcs.exe	44
PID 4280 set thread context of 3000	4280	wscript.exe	44

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4752	schtasks.exe

Suspicious behavior: EnumeratesProcesses 49 IoCs

pid	Process
3708	formbook5.exe
3664	RegSvcs.exe
3664	RegSvcs.exe
3664	RegSvcs.exe
3664	RegSvcs.exe
4280	wscript.exe
4280	wscript.exe
4280	wscript.exe
4280	wscript.exe
4280	wscript.exe
4280	wscript.exe
4280	wscript.exe
4280	wscript.exe
4280	wscript.exe
4280	wscript.exe
4280	wscript.exe
4280	wscript.exe
4280	wscript.exe
4280	wscript.exe
4280	wscript.exe
4280	wscript.exe
4280	wscript.exe
4280	wscript.exe
4280	wscript.exe
4280	wscript.exe
4280	wscript.exe
4280	wscript.exe
4280	wscript.exe
4280	wscript.exe
4280	wscript.exe
4280	wscript.exe
4280	wscript.exe
4280	wscript.exe
4280	wscript.exe
4280	wscript.exe
4280	wscript.exe
4280	wscript.exe
4280	wscript.exe
4280	wscript.exe
4280	wscript.exe
4280	wscript.exe
4280	wscript.exe
4280	wscript.exe
4280	wscript.exe
4280	wscript.exe
4280	wscript.exe
4280	wscript.exe
4280	wscript.exe
4280	wscript.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3000	Explorer.EXE

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
3664	RegSvcs.exe
3664	RegSvcs.exe
3664	RegSvcs.exe
4280	wscript.exe
4280	wscript.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3708	formbook5.exe
Token: SeDebugPrivilege	3664	RegSvcs.exe
Token: SeDebugPrivilege	4280	wscript.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3708 wrote to memory of 4752	3708	formbook5.exe	92
PID 3708 wrote to memory of 4752	3708	formbook5.exe	92
PID 3708 wrote to memory of 4752	3708	formbook5.exe	92
PID 3708 wrote to memory of 3664	3708	formbook5.exe	94
PID 3708 wrote to memory of 3664	3708	formbook5.exe	94
PID 3708 wrote to memory of 3664	3708	formbook5.exe	94
PID 3708 wrote to memory of 3664	3708	formbook5.exe	94
PID 3708 wrote to memory of 3664	3708	formbook5.exe	94
PID 3708 wrote to memory of 3664	3708	formbook5.exe	94
PID 3000 wrote to memory of 4280	3000	Explorer.EXE	96
PID 3000 wrote to memory of 4280	3000	Explorer.EXE	96
PID 3000 wrote to memory of 4280	3000	Explorer.EXE	96
PID 4280 wrote to memory of 2084	4280	wscript.exe	97
PID 4280 wrote to memory of 2084	4280	wscript.exe	97
PID 4280 wrote to memory of 2084	4280	wscript.exe	97

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Users\Admin\AppData\Local\Temp\formbook5.exe
  "C:\Users\Admin\AppData\Local\Temp\formbook5.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3708
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YaFLXNhWEOOsy" /XML "C:\Users\Admin\AppData\Local\Temp\tmp38F2.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:4752
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "{path}"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:3664
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:4420
- C:\Windows\SysWOW64\wscript.exe
  "C:\Windows\SysWOW64\wscript.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4280
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    PID:2084

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp38F2.tmp

Filesize
1KB

MD5
ddf4decce0b0b03c0a310864f662b663

SHA1
a27ccf1e20cec6395baba516e9ff2929506dd8a6

SHA256
eb9a96964451ebe302f049a928046f0740673567f6780e04ad0c0394003a0253

SHA512
31c7de13065a11486e07705b166db49a1c803a2786c185422ea44c36091fbc366f73931bc37ad34319c47d9f85609e23a6a583b7bd5416ba9ac8bc6d0744b310

Download Submit
memory/3000-151-0x0000000008460000-0x00000000085EB000-memory.dmp

Filesize
1.5MB

Download
memory/3000-153-0x0000000007B00000-0x0000000007C5F000-memory.dmp

Filesize
1.4MB

Download
memory/3000-145-0x0000000008460000-0x00000000085EB000-memory.dmp

Filesize
1.5MB

Download
memory/3000-155-0x0000000007B00000-0x0000000007C5F000-memory.dmp

Filesize
1.4MB

Download
memory/3664-144-0x00000000016F0000-0x0000000001705000-memory.dmp

Filesize
84KB

Download
memory/3664-140-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3664-142-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3664-143-0x0000000001800000-0x0000000001B4A000-memory.dmp

Filesize
3.3MB

Download
memory/3708-136-0x0000000005230000-0x000000000523A000-memory.dmp

Filesize
40KB

Download
memory/3708-135-0x0000000005360000-0x00000000053FC000-memory.dmp

Filesize
624KB

Download
memory/3708-134-0x00000000052A0000-0x0000000005332000-memory.dmp

Filesize
584KB

Download
memory/3708-133-0x0000000005910000-0x0000000005EB4000-memory.dmp

Filesize
5.6MB

Download
memory/3708-132-0x00000000007E0000-0x000000000089A000-memory.dmp

Filesize
744KB

Download
memory/4280-148-0x0000000000990000-0x00000000009BF000-memory.dmp

Filesize
188KB

Download
memory/4280-150-0x00000000029D0000-0x0000000002D1A000-memory.dmp

Filesize
3.3MB

Download
memory/4280-147-0x0000000000C20000-0x0000000000C47000-memory.dmp

Filesize
156KB

Download
memory/4280-152-0x0000000002840000-0x00000000028D4000-memory.dmp

Filesize
592KB

Download
memory/4280-154-0x0000000000990000-0x00000000009BF000-memory.dmp

Filesize
188KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads