formbook | 030e7b505d912efbdebba3bd4c0783f029d8bd4caf54ecf988427e47cdea0b16

General

Target

Transfer Request_pdf.exe
Size

261KB
MD5

5083abe9d59d3fa08c31af8a52a6fc52
SHA1

0a321017cb103515232af89c9648c5b0423d603f
SHA256

030e7b505d912efbdebba3bd4c0783f029d8bd4caf54ecf988427e47cdea0b16
SHA512

3e16697e5ec1a06476a17147abfc1995ddd6620bb6a60351e2a8cd8077137af67d6b11ff4d08f618676b98d6797a75ff175750624546bc84e4eb9f3ae7a02b45
SSDEEP

6144:QBn1jjE5+EdKaAHyu/IVOzxjl9ZY1X7lOlSrXhZ1zanK29tr1HEQwo+:gjw5+EXBugVO9L+1X70wr71eHH+o+

Score

10^/10

formbook sy01 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

sy01

Decoy

aeria.life

jotted.community

mozarspalace.com

bfkoxoih.work

doganmuzik.com

ljsq.shop

vitalitycook.store

74574575.xyz

infiniteuniverse.site

storkrv.com

amendmentsymmetrical.top

adevodigital.com

renammsac.com

tptretry.info

ninfainacquerello.com

25038.top

httpsthothub.lol

yvxbt.com

72028.top

vzxtopi.xyz

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4796-139-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/4604-146-0x0000000000160000-0x000000000018F000-memory.dmp	formbook
behavioral2/memory/4604-150-0x0000000000160000-0x000000000018F000-memory.dmp	formbook

Executes dropped EXE 2 IoCs

Processes:

ddsrh.exeddsrh.exe

pid process

916 ddsrh.exe
4796 ddsrh.exe

pid	process
916	ddsrh.exe
4796	ddsrh.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

ddsrh.exeddsrh.execontrol.exe

description	pid	process	target process
PID 916 set thread context of 4796	916	ddsrh.exe	ddsrh.exe
PID 4796 set thread context of 2016	4796	ddsrh.exe	Explorer.EXE
PID 4604 set thread context of 2016	4604	control.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 60 IoCs

Processes:

ddsrh.execontrol.exe

pid	process
4796	ddsrh.exe
4796	ddsrh.exe
4796	ddsrh.exe
4796	ddsrh.exe
4604	control.exe
4604	control.exe
4604	control.exe
4604	control.exe
4604	control.exe
4604	control.exe
4604	control.exe
4604	control.exe
4604	control.exe
4604	control.exe
4604	control.exe
4604	control.exe
4604	control.exe
4604	control.exe
4604	control.exe
4604	control.exe
4604	control.exe
4604	control.exe
4604	control.exe
4604	control.exe
4604	control.exe
4604	control.exe
4604	control.exe
4604	control.exe
4604	control.exe
4604	control.exe
4604	control.exe
4604	control.exe
4604	control.exe
4604	control.exe
4604	control.exe
4604	control.exe
4604	control.exe
4604	control.exe
4604	control.exe
4604	control.exe
4604	control.exe
4604	control.exe
4604	control.exe
4604	control.exe
4604	control.exe
4604	control.exe
4604	control.exe
4604	control.exe
4604	control.exe
4604	control.exe
4604	control.exe
4604	control.exe
4604	control.exe
4604	control.exe
4604	control.exe
4604	control.exe
4604	control.exe
4604	control.exe
4604	control.exe
4604	control.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

2016 Explorer.EXE
Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

ddsrh.exeddsrh.execontrol.exe

pid process

916 ddsrh.exe
4796 ddsrh.exe
4796 ddsrh.exe
4796 ddsrh.exe
4604 control.exe
4604 control.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

ddsrh.execontrol.exe

description pid process

Token: SeDebugPrivilege 4796 ddsrh.exe
Token: SeDebugPrivilege 4604 control.exe

pid	process
2016	Explorer.EXE

pid	process
916	ddsrh.exe
4796	ddsrh.exe
4796	ddsrh.exe
4796	ddsrh.exe
4604	control.exe
4604	control.exe

description	pid	process
Token: SeDebugPrivilege	4796	ddsrh.exe
Token: SeDebugPrivilege	4604	control.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

Transfer Request_pdf.exeddsrh.exeExplorer.EXEcontrol.exe

description	pid	process	target process
PID 1212 wrote to memory of 916	1212	Transfer Request_pdf.exe	ddsrh.exe
PID 1212 wrote to memory of 916	1212	Transfer Request_pdf.exe	ddsrh.exe
PID 1212 wrote to memory of 916	1212	Transfer Request_pdf.exe	ddsrh.exe
PID 916 wrote to memory of 4796	916	ddsrh.exe	ddsrh.exe
PID 916 wrote to memory of 4796	916	ddsrh.exe	ddsrh.exe
PID 916 wrote to memory of 4796	916	ddsrh.exe	ddsrh.exe
PID 916 wrote to memory of 4796	916	ddsrh.exe	ddsrh.exe
PID 2016 wrote to memory of 4604	2016	Explorer.EXE	control.exe
PID 2016 wrote to memory of 4604	2016	Explorer.EXE	control.exe
PID 2016 wrote to memory of 4604	2016	Explorer.EXE	control.exe
PID 4604 wrote to memory of 2712	4604	control.exe	cmd.exe
PID 4604 wrote to memory of 2712	4604	control.exe	cmd.exe
PID 4604 wrote to memory of 2712	4604	control.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2016

C:\Users\Admin\AppData\Local\Temp\Transfer Request_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Transfer Request_pdf.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1212

C:\Users\Admin\AppData\Local\Temp\ddsrh.exe
"C:\Users\Admin\AppData\Local\Temp\ddsrh.exe" C:\Users\Admin\AppData\Local\Temp\bwtlvmcfq.pbk
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:916

C:\Users\Admin\AppData\Local\Temp\ddsrh.exe
"C:\Users\Admin\AppData\Local\Temp\ddsrh.exe" C:\Users\Admin\AppData\Local\Temp\bwtlvmcfq.pbk
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4796

C:\Windows\SysWOW64\control.exe
"C:\Windows\SysWOW64\control.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4604

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\ddsrh.exe"
3⤵
PID:2712

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bwtlvmcfq.pbk
Filesize
5KB

MD5
ff59d29e165fc600236aaa8e5a9a0fd1

SHA1
7e9f164ce2ec76137d1f86b177449d8f94d45a05

SHA256
fb0c1c134bd3d958986bb4cad2f87a6ebfda3411148b9e73d6c624e7bcb3603a

SHA512
f793059b19fe45e5fd2d6b31f8da092778fe787fd5029f227b203dde6cf788e13d5e8a8684c3ed4a21f9d364c9c79bc80fc7039756e6e34ab2d5ff55810cce3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\ddsrh.exe
Filesize
122KB

MD5
dcb1a737b2307f78f3afef6397e0b429

SHA1
2ccf9bf6dce9c62591a7720560f9722e6a03e946

SHA256
d39b47bb2f74019385b853b2aa7af0b56110f7ed55c9326c5ae92eaac65c4a7b

SHA512
5cb0fbaebc32cf30141a475507a8da9156dcdf99c4f65b82d4036c77099ae6ebe42fdc12c942fe38a702f5d1669c55147af4904ce3bbbbb4c374a57502ceb62b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ddsrh.exe
Filesize
122KB

MD5
dcb1a737b2307f78f3afef6397e0b429

SHA1
2ccf9bf6dce9c62591a7720560f9722e6a03e946

SHA256
d39b47bb2f74019385b853b2aa7af0b56110f7ed55c9326c5ae92eaac65c4a7b

SHA512
5cb0fbaebc32cf30141a475507a8da9156dcdf99c4f65b82d4036c77099ae6ebe42fdc12c942fe38a702f5d1669c55147af4904ce3bbbbb4c374a57502ceb62b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ddsrh.exe
Filesize
122KB

MD5
dcb1a737b2307f78f3afef6397e0b429

SHA1
2ccf9bf6dce9c62591a7720560f9722e6a03e946

SHA256
d39b47bb2f74019385b853b2aa7af0b56110f7ed55c9326c5ae92eaac65c4a7b

SHA512
5cb0fbaebc32cf30141a475507a8da9156dcdf99c4f65b82d4036c77099ae6ebe42fdc12c942fe38a702f5d1669c55147af4904ce3bbbbb4c374a57502ceb62b

Download Submit
C:\Users\Admin\AppData\Local\Temp\xycgadhep.hvw
Filesize
185KB

MD5
68e55844773cb4cd26a091bca4e67ddb

SHA1
889c5a4fd366830b42c7b80e2e3440d81a8cdbee

SHA256
3df4da4f0f579bdd8e7f7d2e633c4457779a2eed04f00f4f6de70e7b88f4a0ae

SHA512
6645ac3f76e37f5ea3609b6b27f35f979fdf3c1284b3c8285e104c80204580833f9c665f5893eeece7dcfae5cd88c098a309ae303d2b7adff6a0df647319a096

Download Submit
memory/916-132-0x0000000000000000-mapping.dmp

Download
memory/2016-142-0x0000000002810000-0x000000000298A000-memory.dmp

Filesize
1.5MB

Download
memory/2016-151-0x0000000007070000-0x00000000071F0000-memory.dmp

Filesize
1.5MB

Download
memory/2016-149-0x0000000007070000-0x00000000071F0000-memory.dmp

Filesize
1.5MB

Download
memory/2712-144-0x0000000000000000-mapping.dmp

Download
memory/4604-147-0x00000000022B0000-0x00000000025FA000-memory.dmp

Filesize
3.3MB

Download
memory/4604-143-0x0000000000000000-mapping.dmp

Download
memory/4604-146-0x0000000000160000-0x000000000018F000-memory.dmp

Filesize
188KB

Download
memory/4604-145-0x0000000000E70000-0x0000000000E97000-memory.dmp

Filesize
156KB

Download
memory/4604-148-0x0000000000C50000-0x0000000000CE3000-memory.dmp

Filesize
588KB

Download
memory/4604-150-0x0000000000160000-0x000000000018F000-memory.dmp

Filesize
188KB

Download
memory/4796-141-0x0000000000510000-0x0000000000524000-memory.dmp

Filesize
80KB

Download
memory/4796-140-0x0000000000A60000-0x0000000000DAA000-memory.dmp

Filesize
3.3MB

Download
memory/4796-139-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4796-137-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads