formbook | a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e

General

Target

a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe
Size

859KB
MD5

0a801edee20ba056f42dfc13f6dc0502
SHA1

37f08902fec2903e053b5b1897dcde4a72fbad4e
SHA256

a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e
SHA512

a8e4643eda7016ee33a1479c1815d28d9492fa8d7e756f9a6b93b7fd8d5fd684dd071e344cb03545927a6d718c8dcb73af63cc762d8ef5f1f4a68e2f449f9f1c
SSDEEP

12288:ZqXsd0wFzNFJmpjIjNh3fEWupqdmTX1CAiNGs/O:ZqXsdRlHojIZxfEW2w

Score

10^/10

formbook g2fg rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

g2fg

Decoy

snowcrash.website

pointman.us

newheartvalve.care

drandl.com

sandspringsramblers.com

programagubernamental.online

boja.us

mvrsnike.com

mentallyillmotherhood.com

facom.us

programagubernamental.store

izivente.com

roller-v.fr

amazonbioactives.com

metaverseapple.xyz

5gt-mobilevsverizon.com

gtwebsolutions.co

scottdunn.life

usdp.trade

pikmin.run

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4816-145-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe

description	pid	process	target process
PID 2116 set thread context of 4816	2116	a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe	a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

8 schtasks.exe

pid	process
8	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exea06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe

pid	process
228	powershell.exe
4816	a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe
4816	a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe
228	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 228 powershell.exe

description	pid	process
Token: SeDebugPrivilege	228	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe

description	pid	process	target process
PID 2116 wrote to memory of 228	2116	a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe	powershell.exe
PID 2116 wrote to memory of 228	2116	a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe	powershell.exe
PID 2116 wrote to memory of 228	2116	a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe	powershell.exe
PID 2116 wrote to memory of 8	2116	a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe	schtasks.exe
PID 2116 wrote to memory of 8	2116	a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe	schtasks.exe
PID 2116 wrote to memory of 8	2116	a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe	schtasks.exe
PID 2116 wrote to memory of 4816	2116	a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe	a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe
PID 2116 wrote to memory of 4816	2116	a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe	a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe
PID 2116 wrote to memory of 4816	2116	a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe	a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe
PID 2116 wrote to memory of 4816	2116	a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe	a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe
PID 2116 wrote to memory of 4816	2116	a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe	a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe
PID 2116 wrote to memory of 4816	2116	a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe	a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe

C:\Users\Admin\AppData\Local\Temp\a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe
"C:\Users\Admin\AppData\Local\Temp\a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2116

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\SxfIUEdouwqNB.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:228

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SxfIUEdouwqNB" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7511.tmp"
2⤵
- Creates scheduled task(s)
PID:8

C:\Users\Admin\AppData\Local\Temp\a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe
"C:\Users\Admin\AppData\Local\Temp\a06999e015bc924adb4a463c17853e238886b5a7c2c3de6f3614413e0794528e.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4816

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp7511.tmp
Filesize
1KB

MD5
63d5cdb3096c9d2d83831afe6a0ef6ec

SHA1
55e8327735e137fe6b079e9f79046ec830c348e1

SHA256
d0f6748b4496906323d067569a9a74ec12d454eaa0982b420f4a51359c413ed1

SHA512
69daaa760baddc232fd15a90cc8f69873cc1af85938a7fbaf0307f4d353b090a9eaf7dec852f69212b5c05d749464f75bd4875ead7e2e6bd666fd822717c57ef

Download Submit
memory/8-139-0x0000000000000000-mapping.dmp

Download
memory/228-146-0x0000000005AE0000-0x0000000005B46000-memory.dmp

Filesize
408KB

Download
memory/228-138-0x0000000000000000-mapping.dmp

Download
memory/228-158-0x0000000007860000-0x0000000007868000-memory.dmp

Filesize
32KB

Download
memory/228-157-0x0000000007880000-0x000000000789A000-memory.dmp

Filesize
104KB

Download
memory/228-156-0x0000000007770000-0x000000000777E000-memory.dmp

Filesize
56KB

Download
memory/228-155-0x00000000077C0000-0x0000000007856000-memory.dmp

Filesize
600KB

Download
memory/228-140-0x0000000004C50000-0x0000000004C86000-memory.dmp

Filesize
216KB

Download
memory/228-148-0x0000000005BE0000-0x0000000005BFE000-memory.dmp

Filesize
120KB

Download
memory/228-142-0x00000000052C0000-0x00000000058E8000-memory.dmp

Filesize
6.2MB

Download
memory/228-144-0x0000000005270000-0x0000000005292000-memory.dmp

Filesize
136KB

Download
memory/228-154-0x00000000075B0000-0x00000000075BA000-memory.dmp

Filesize
40KB

Download
memory/228-153-0x0000000007540000-0x000000000755A000-memory.dmp

Filesize
104KB

Download
memory/228-152-0x0000000007B80000-0x00000000081FA000-memory.dmp

Filesize
6.5MB

Download
memory/228-151-0x00000000067C0000-0x00000000067DE000-memory.dmp

Filesize
120KB

Download
memory/228-150-0x0000000073510000-0x000000007355C000-memory.dmp

Filesize
304KB

Download
memory/228-149-0x0000000006810000-0x0000000006842000-memory.dmp

Filesize
200KB

Download
memory/2116-133-0x00000000055C0000-0x0000000005B64000-memory.dmp

Filesize
5.6MB

Download
memory/2116-135-0x0000000005030000-0x000000000503A000-memory.dmp

Filesize
40KB

Download
memory/2116-136-0x000000000BCD0000-0x000000000BD6C000-memory.dmp

Filesize
624KB

Download
memory/2116-132-0x00000000006F0000-0x00000000007CE000-memory.dmp

Filesize
888KB

Download
memory/2116-134-0x00000000050B0000-0x0000000005142000-memory.dmp

Filesize
584KB

Download
memory/2116-137-0x000000000BDE0000-0x000000000BE46000-memory.dmp

Filesize
408KB

Download
memory/4816-145-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4816-147-0x0000000001950000-0x0000000001C9A000-memory.dmp

Filesize
3.3MB

Download
memory/4816-143-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads