formbook | 064b63296e5ed2b796567b20dba4dde90783018b9058facf6fe407c360df7779

Analysis

max time kernel
150s
max time network
149s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/11/2022, 02:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Payment Confirmation.exe
Size 632KB
Sample221105-ddv8psdbb9
SHA256 064b63296e5ed2b796567b20dba4dde90783018b9058facf6fe407c360df7779
MD5 e6e980686110b2e688ba0abbdc8b6ff7
SHA1 759682422be8d1df52d3725876380f1b690b7c7e
SHA512 ab1d200a2af619e6b811a7289ee3fb92af279330c8e2a8ebd3bca6d37c813b8d93532e8ccfee9f8c35a7fd3df09c5aae8f2b420cdca8a3f29067ed01674ea382
SSDEEP 12288:xwhuJIQvV4Eiu33NUQBXS/4pboT4GSi4otf4VUcBkLCCY3zps7:iuJd/iu33NUUi//4GRFtZcBmC3Ns7
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook oi05 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

oi05

Decoy

fluidavail.online
blchain.tech
kyocera.website
sangmine.xyz
thepolicyjacket.info
ssvhelpman.net
y-t-design.com
eminentabroad.com
codingcamp.store
bester.capital
tanjiya23.site
bheniamyn.dev
top5monitor.com
bit-prim.trade
airstreamsocialclub.com
darkwarspod.com
zazisalesdistribution.com
vivolentlo.online
daftburo.net
elemangelsin.xyz
chasewildfire.buzz
olioubnajo.buzz
agoura.dental
ky4352.com
finechoice.mobi
studioarchadroit.com
5009townesouth.com
tik454register.xyz
divaresesaat.xyz
projektwrestling.com
krystalclearmemories.net
vinaychhaparia.com
sodexosupplychain.info
uudai.store
demontya.site
cloudydad.cloud
mewzom.online
20010906.xyz
epuken.link
saludaldia.tech
generto.com
mbenzmotorsport.com
voidssl.life
elbetolacakbirgece10.com
cdncleaningservices.com
kuzs248.top
verus.website
wisefocus.net
xn--nergie-de-gaia-9jb.com
wowsportsbet.com
vhkopiu.top
shopify-postmaster15.info
lysiimmobilier.site
princess.express
betebrands.com
6tldsuoacvrlwc1g4i.top
labucarimini.net
hogushinotakumi.com
turnhappy.shop
geenpaii.xyz
pyrrhadev.xyz
minhasaudeelevada.com
oblk.pics
recursosdijitales.com
vivencie.shop

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 5 IoCs

rat

resource	yara_rule
behavioral1/memory/912-67-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/912-68-0x000000000041F100-mapping.dmp	formbook
behavioral1/memory/912-70-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/912-80-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/436-84-0x0000000000080000-0x00000000000AF000-memory.dmp	formbook

Deletes itself 1 IoCs

pid	Process
1388	cmd.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1928 set thread context of 912	1928	Payment Confirmation.exe	30
PID 912 set thread context of 1400	912	Payment Confirmation.exe	20
PID 912 set thread context of 1400	912	Payment Confirmation.exe	20
PID 436 set thread context of 1400	436	ipconfig.exe	20

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1776	schtasks.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command-Line Interface

T1059

pid	Process
436	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
912	Payment Confirmation.exe
912	Payment Confirmation.exe
1052	powershell.exe
912	Payment Confirmation.exe
436	ipconfig.exe
436	ipconfig.exe
436	ipconfig.exe
436	ipconfig.exe
436	ipconfig.exe
436	ipconfig.exe
436	ipconfig.exe
436	ipconfig.exe
436	ipconfig.exe
436	ipconfig.exe
436	ipconfig.exe
436	ipconfig.exe
436	ipconfig.exe
436	ipconfig.exe
436	ipconfig.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
912	Payment Confirmation.exe
912	Payment Confirmation.exe
912	Payment Confirmation.exe
912	Payment Confirmation.exe
436	ipconfig.exe
436	ipconfig.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	912	Payment Confirmation.exe
Token: SeDebugPrivilege	1052	powershell.exe
Token: SeDebugPrivilege	436	ipconfig.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1400	Explorer.EXE
1400	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1400	Explorer.EXE
1400	Explorer.EXE

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 1052	1928	Payment Confirmation.exe	26
PID 1928 wrote to memory of 1052	1928	Payment Confirmation.exe	26
PID 1928 wrote to memory of 1052	1928	Payment Confirmation.exe	26
PID 1928 wrote to memory of 1052	1928	Payment Confirmation.exe	26
PID 1928 wrote to memory of 1776	1928	Payment Confirmation.exe	28
PID 1928 wrote to memory of 1776	1928	Payment Confirmation.exe	28
PID 1928 wrote to memory of 1776	1928	Payment Confirmation.exe	28
PID 1928 wrote to memory of 1776	1928	Payment Confirmation.exe	28
PID 1928 wrote to memory of 912	1928	Payment Confirmation.exe	30
PID 1928 wrote to memory of 912	1928	Payment Confirmation.exe	30
PID 1928 wrote to memory of 912	1928	Payment Confirmation.exe	30
PID 1928 wrote to memory of 912	1928	Payment Confirmation.exe	30
PID 1928 wrote to memory of 912	1928	Payment Confirmation.exe	30
PID 1928 wrote to memory of 912	1928	Payment Confirmation.exe	30
PID 1928 wrote to memory of 912	1928	Payment Confirmation.exe	30
PID 912 wrote to memory of 436	912	Payment Confirmation.exe	32
PID 912 wrote to memory of 436	912	Payment Confirmation.exe	32
PID 912 wrote to memory of 436	912	Payment Confirmation.exe	32
PID 912 wrote to memory of 436	912	Payment Confirmation.exe	32
PID 436 wrote to memory of 1388	436	ipconfig.exe	33
PID 436 wrote to memory of 1388	436	ipconfig.exe	33
PID 436 wrote to memory of 1388	436	ipconfig.exe	33
PID 436 wrote to memory of 1388	436	ipconfig.exe	33

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1400
- C:\Users\Admin\AppData\Local\Temp\Payment Confirmation.exe
  "C:\Users\Admin\AppData\Local\Temp\Payment Confirmation.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1928
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\EAkdUlQbPHHbnd.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1052
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\EAkdUlQbPHHbnd" /XML "C:\Users\Admin\AppData\Local\Temp\tmp13DF.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:1776
- - C:\Users\Admin\AppData\Local\Temp\Payment Confirmation.exe
    "C:\Users\Admin\AppData\Local\Temp\Payment Confirmation.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:912
  - - C:\Windows\SysWOW64\ipconfig.exe
      "C:\Windows\SysWOW64\ipconfig.exe"
      4⤵
      Suspicious use of SetThreadContext
      Gathers network information
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:436
    - - C:\Windows\SysWOW64\cmd.exe
        
        /c del "C:\Users\Admin\AppData\Local\Temp\Payment Confirmation.exe"
        5⤵
        Deletes itself
        
        PID:1388
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:692

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp13DF.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp13DF.tmp
Size 1KB
SHA256 1e29b50ec3398b45595753400c6ec3d0eb6583321c27641d03c131316956b226
MD5 6cb538d2505be50c997618e1cfd8f65e
SHA1 aa129cafac2ad99d5d5aac148ede6ca5c2208748
SHA512 bdfbf56cec6620f82fb1f96440072c1d22c0282e85912a269f9ddff960cda0941f2a3ac733912e3ca4a8342477b0bd5d3d71a29a83c965507de4b3b429efe56a
MD5 SHA1 SHA512

Submit Download

memory/436-86-0x0000000000E80000-0x0000000000F13000-memory.dmp

Download

memory/436-85-0x0000000000B70000-0x0000000000E73000-memory.dmp

Download

memory/436-84-0x0000000000080000-0x00000000000AF000-memory.dmp

Download

memory/436-83-0x0000000000F80000-0x0000000000F8A000-memory.dmp

Download

memory/912-80-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/912-72-0x0000000000770000-0x0000000000A73000-memory.dmp

Download

memory/912-77-0x0000000000A80000-0x0000000000A94000-memory.dmp

Download

memory/912-65-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/912-64-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/912-67-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/912-70-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/912-73-0x00000000002C0000-0x00000000002D4000-memory.dmp

Download

memory/1052-75-0x00000000739D0000-0x0000000073F7B000-memory.dmp

Download

memory/1052-71-0x00000000739D0000-0x0000000073F7B000-memory.dmp

Download

memory/1400-87-0x0000000004980000-0x0000000004A42000-memory.dmp

Download

memory/1400-74-0x0000000005FB0000-0x000000000606A000-memory.dmp

Download

memory/1400-78-0x0000000006070000-0x0000000006124000-memory.dmp

Download

memory/1400-88-0x0000000004980000-0x0000000004A42000-memory.dmp

Download

memory/1928-63-0x0000000005030000-0x0000000005064000-memory.dmp

Download

memory/1928-57-0x0000000002040000-0x000000000204C000-memory.dmp

Download

memory/1928-56-0x00000000046B0000-0x00000000046CA000-memory.dmp

Download

memory/1928-55-0x00000000762B1000-0x00000000762B3000-memory.dmp

Download

memory/1928-58-0x0000000004DD0000-0x0000000004E40000-memory.dmp

Download

memory/1928-54-0x0000000000B10000-0x0000000000BB4000-memory.dmp

Download