formbook | 5eab382b9338d93188634d7f10e192a9fe644753910f4a65c483ba76d440f133

General

Target

36858bb18574315047429775c5bdca18.exe
Size

1.0MB
MD5

36858bb18574315047429775c5bdca18
SHA1

ebb242dcb189f0501f2631324af21eca9b7094a1
SHA256

5eab382b9338d93188634d7f10e192a9fe644753910f4a65c483ba76d440f133
SHA512

9d12738740fe779850a64c3e987eec32e105d7d464d9bdabe2fb124417d2fdbc955eb841b8161efdccb7fb1c66d58b1a56feca50699990499a6e77d12a0f4e8d
SSDEEP

12288:aSZIKqGtTfNuvWUYVoMkta4rHAnaNNZit1MU2adY+IcL1Nz0M4J7jl9Qg:acIEfNNUYVoMq1gaNnI4aV1yM4JrJ

Score

10^/10

formbook pgnt rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

pgnt

Decoy

0WG18LbM4lR9iqMRa4nlBzTb

jcfGYzPgZTqFZVO9FV2yIw==

laIfrdSC8/4CNg==

Q73ilev5GIWuOrAAFV2yIw==

Q2u/pMw7pv4sPA==

TbqvIUHwlQscPo0HFV2yIw==

8PNWfGPyE8n0IQ==

WtgROxXzvY2L

PryaRBNjm4eP

Y9Hdi06Cry1um9Sj68YAu1o=

3Gulyp7CMQtR78jvLkk=

JJ3GasTVTCRQT6Tfz6S6GlI=

RnS42bhb9tI0R6UpD6wOxriNxw==

he1mi2sOGfzTRGHnuA==

eaYjCtjxVjdU5XLRtBMBLKk9quA=

k9rTeEqYzzw8WaTfz6S6GlI=

5luVQwe2vJWKEAiMdF4=

MGW14L9OVk5Y5TaR6w/DqdhYxXVY

mAsYz6k6sQkDC0/DoHj9t1RPWLSgFQ==

y5klhuMbE8n0IQ==

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Suspicious use of SetThreadContext 1 IoCs

Processes:

36858bb18574315047429775c5bdca18.exe

description pid process target process

PID 836 set thread context of 1656 836 36858bb18574315047429775c5bdca18.exe 36858bb18574315047429775c5bdca18.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

752 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

36858bb18574315047429775c5bdca18.exepowershell.exe

pid process

1656 36858bb18574315047429775c5bdca18.exe
812 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 812 powershell.exe

description	pid	process	target process
PID 836 set thread context of 1656	836	36858bb18574315047429775c5bdca18.exe	36858bb18574315047429775c5bdca18.exe

pid	process
752	schtasks.exe

pid	process
1656	36858bb18574315047429775c5bdca18.exe
812	powershell.exe

description	pid	process
Token: SeDebugPrivilege	812	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

36858bb18574315047429775c5bdca18.exe

description	pid	process	target process
PID 836 wrote to memory of 812	836	36858bb18574315047429775c5bdca18.exe	powershell.exe
PID 836 wrote to memory of 812	836	36858bb18574315047429775c5bdca18.exe	powershell.exe
PID 836 wrote to memory of 812	836	36858bb18574315047429775c5bdca18.exe	powershell.exe
PID 836 wrote to memory of 812	836	36858bb18574315047429775c5bdca18.exe	powershell.exe
PID 836 wrote to memory of 752	836	36858bb18574315047429775c5bdca18.exe	schtasks.exe
PID 836 wrote to memory of 752	836	36858bb18574315047429775c5bdca18.exe	schtasks.exe
PID 836 wrote to memory of 752	836	36858bb18574315047429775c5bdca18.exe	schtasks.exe
PID 836 wrote to memory of 752	836	36858bb18574315047429775c5bdca18.exe	schtasks.exe
PID 836 wrote to memory of 1656	836	36858bb18574315047429775c5bdca18.exe	36858bb18574315047429775c5bdca18.exe
PID 836 wrote to memory of 1656	836	36858bb18574315047429775c5bdca18.exe	36858bb18574315047429775c5bdca18.exe
PID 836 wrote to memory of 1656	836	36858bb18574315047429775c5bdca18.exe	36858bb18574315047429775c5bdca18.exe
PID 836 wrote to memory of 1656	836	36858bb18574315047429775c5bdca18.exe	36858bb18574315047429775c5bdca18.exe
PID 836 wrote to memory of 1656	836	36858bb18574315047429775c5bdca18.exe	36858bb18574315047429775c5bdca18.exe
PID 836 wrote to memory of 1656	836	36858bb18574315047429775c5bdca18.exe	36858bb18574315047429775c5bdca18.exe
PID 836 wrote to memory of 1656	836	36858bb18574315047429775c5bdca18.exe	36858bb18574315047429775c5bdca18.exe

C:\Users\Admin\AppData\Local\Temp\36858bb18574315047429775c5bdca18.exe
"C:\Users\Admin\AppData\Local\Temp\36858bb18574315047429775c5bdca18.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:836

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\HRlyZTYWzC.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:812

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HRlyZTYWzC" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDDA3.tmp"
2⤵
- Creates scheduled task(s)
PID:752

C:\Users\Admin\AppData\Local\Temp\36858bb18574315047429775c5bdca18.exe
"C:\Users\Admin\AppData\Local\Temp\36858bb18574315047429775c5bdca18.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1656

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpDDA3.tmp
Filesize
1KB

MD5
799adcb877306e8d8ac4dcbd0acde614

SHA1
864154c8419cd8f6c8dcf413f7ff6b52d718c2d4

SHA256
df91eafafe32e8b0e79247443ad248d4442cf53ddc245cabb1eaa60a96dca536

SHA512
078577e1a82ca91737bd8103cf954ceafd5a90f844cce1328b02306ff8e776bdf9bd8d2b6429bbc28a0a12e0f65ce360b9336065b91105d442d3da6b080c66b5

Download Submit
memory/752-60-0x0000000000000000-mapping.dmp

Download
memory/812-59-0x0000000000000000-mapping.dmp

Download
memory/812-74-0x000000006F140000-0x000000006F6EB000-memory.dmp

Filesize
5.7MB

Download
memory/812-73-0x000000006F140000-0x000000006F6EB000-memory.dmp

Filesize
5.7MB

Download
memory/836-63-0x00000000011D0000-0x0000000001240000-memory.dmp

Filesize
448KB

Download
memory/836-58-0x0000000005E20000-0x0000000005ECA000-memory.dmp

Filesize
680KB

Download
memory/836-57-0x0000000000530000-0x000000000053C000-memory.dmp

Filesize
48KB

Download
memory/836-54-0x0000000001240000-0x0000000001348000-memory.dmp

Filesize
1.0MB

Download
memory/836-56-0x0000000000490000-0x00000000004A8000-memory.dmp

Filesize
96KB

Download
memory/836-55-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download
memory/1656-64-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1656-65-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1656-67-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1656-68-0x00000000004012B0-mapping.dmp

Download
memory/1656-70-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1656-71-0x0000000000401000-0x000000000042F000-memory.dmp

Filesize
184KB

Download
memory/1656-72-0x0000000000970000-0x0000000000C73000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads