formbook | a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e

General

Target

a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe
Size

859KB
MD5

0a801edee20ba056f42dfc13f6dc0502
SHA1

37f08902fec2903e053b5b1897dcde4a72fbad4e
SHA256

a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e
SHA512

a8e4643eda7016ee33a1479c1815d28d9492fa8d7e756f9a6b93b7fd8d5fd684dd071e344cb03545927a6d718c8dcb73af63cc762d8ef5f1f4a68e2f449f9f1c
SSDEEP

12288:ZqXsd0wFzNFJmpjIjNh3fEWupqdmTX1CAiNGs/O:ZqXsdRlHojIZxfEW2w

Score

10^/10

formbook g2fg rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

g2fg

Decoy

snowcrash.website

pointman.us

newheartvalve.care

drandl.com

sandspringsramblers.com

programagubernamental.online

boja.us

mvrsnike.com

mentallyillmotherhood.com

facom.us

programagubernamental.store

izivente.com

roller-v.fr

amazonbioactives.com

metaverseapple.xyz

5gt-mobilevsverizon.com

gtwebsolutions.co

scottdunn.life

usdp.trade

pikmin.run

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1548-67-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1548-68-0x000000000041F160-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe

description	pid	process	target process
PID 2044 set thread context of 1548	2044	a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe	a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1064 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exepowershell.exe

pid process

1548 a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe
572 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 572 powershell.exe

pid	process
1064	schtasks.exe

pid	process
1548	a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe
572	powershell.exe

description	pid	process
Token: SeDebugPrivilege	572	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe

description	pid	process	target process
PID 2044 wrote to memory of 572	2044	a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe	powershell.exe
PID 2044 wrote to memory of 572	2044	a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe	powershell.exe
PID 2044 wrote to memory of 572	2044	a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe	powershell.exe
PID 2044 wrote to memory of 572	2044	a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe	powershell.exe
PID 2044 wrote to memory of 1064	2044	a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe	schtasks.exe
PID 2044 wrote to memory of 1064	2044	a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe	schtasks.exe
PID 2044 wrote to memory of 1064	2044	a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe	schtasks.exe
PID 2044 wrote to memory of 1064	2044	a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe	schtasks.exe
PID 2044 wrote to memory of 1548	2044	a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe	a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe
PID 2044 wrote to memory of 1548	2044	a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe	a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe
PID 2044 wrote to memory of 1548	2044	a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe	a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe
PID 2044 wrote to memory of 1548	2044	a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe	a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe
PID 2044 wrote to memory of 1548	2044	a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe	a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe
PID 2044 wrote to memory of 1548	2044	a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe	a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe
PID 2044 wrote to memory of 1548	2044	a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe	a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe

C:\Users\Admin\AppData\Local\Temp\a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe
"C:\Users\Admin\AppData\Local\Temp\a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2044

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\SxfIUEdouwqNB.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:572

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SxfIUEdouwqNB" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB75E.tmp"
2⤵
- Creates scheduled task(s)
PID:1064

C:\Users\Admin\AppData\Local\Temp\a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe
"C:\Users\Admin\AppData\Local\Temp\a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1548

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpB75E.tmp
Filesize
1KB

MD5
264fa93aa8ac9f03c304a097239a50b2

SHA1
4ad3efe7feba57c8afdaf1ef6042c997c1eb728b

SHA256
f5e6cd642e4ce51286dddce8faf92e6f321e748393ce46f939e18bd70612b9ad

SHA512
68743f7e6bbe641db66db918bac4d7422fbaade4889599d4fc67c16457dea75645e514eb361bab87f0d4c4ce272c153df9a43836e9a8b7ab5c2296a5ed2c2f36

Download Submit
memory/572-71-0x000000006EA30000-0x000000006EFDB000-memory.dmp

Filesize
5.7MB

Download
memory/572-70-0x000000006EA30000-0x000000006EFDB000-memory.dmp

Filesize
5.7MB

Download
memory/572-59-0x0000000000000000-mapping.dmp

Download
memory/1064-60-0x0000000000000000-mapping.dmp

Download
memory/1548-65-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1548-69-0x0000000000C20000-0x0000000000F23000-memory.dmp

Filesize
3.0MB

Download
memory/1548-68-0x000000000041F160-mapping.dmp

Download
memory/1548-67-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1548-64-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2044-58-0x0000000000210000-0x000000000029E000-memory.dmp

Filesize
568KB

Download
memory/2044-63-0x0000000005D20000-0x0000000005D54000-memory.dmp

Filesize
208KB

Download
memory/2044-54-0x0000000000B40000-0x0000000000C1E000-memory.dmp

Filesize
888KB

Download
memory/2044-57-0x0000000000420000-0x000000000042C000-memory.dmp

Filesize
48KB

Download
memory/2044-56-0x0000000000650000-0x000000000066A000-memory.dmp

Filesize
104KB

Download
memory/2044-55-0x0000000075631000-0x0000000075633000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads