formbook | ae9b827c9ea8f76498bd357516a966d63a386ae681d57a7defe9b90d5dfec29a

General

Target

tmp.exe
Size

269KB
MD5

ab19893b5cb5cc981ae08a3964f16e15
SHA1

23b5898bcc3ab1fb60a85f46cec31e6b29c6f114
SHA256

ae9b827c9ea8f76498bd357516a966d63a386ae681d57a7defe9b90d5dfec29a
SHA512

56fb7e6b073b54f31eb5c7bbd0da85eb8ad12f88988406e27ee332ae2225660b73465b208cffd5ccb73c7c982300a88f96c8e5032544a9eeb1887c3d463dbb33
SSDEEP

6144:GmubVdOGB4obzF7lT0J1SfNFL3tbUdsSxX7/BWjqFw9Qd:sZ2obzpi8F93twdsSV7ZTFo

Score

10^/10

formbook ph6j rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

ph6j

Decoy

WM1X00j5iDAYA6zcncQr

3CPsxwpxiZ+SikeciM4y

XDDKDkvuplKRxq7feLyksK6Z0g==

/msAxzfw/5RdtIwTnk4=

GHxNObZXuq2sys8=

GPXEaDIkd59RoawN

5M9MVMeb3o4NDeAt4wTxd7OY0A==

A9xTe+i4ZXwyiJvfyapcIw==

RaIVfPihP24siJq9ZtH+s1Y=

B/6EfAHA2/QDKCuTLEv47tg22b7kZQ==

uCu5N6ha86KYvYwTnk4=

vyLwu/BkYQyEhi4Vi7oirhXXOqI=

pv66ktZy6mbiAQ==

jtVK3hed6mbiAQ==

awdUpNKVm80=

NhPiQbxl+x3MEaXauk31+bXZ

OfObW8qMDUjDR+0F

4Wk7Ip9e2wi+AvWciM4y

eGAriArN1AItvGBnMQ==

5bF+B0DO+CJTnjFT+wmvsK6Z0g==

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Suspicious use of SetThreadContext 3 IoCs

Processes:

tmp.exeRegsvcs.exesystray.exe

description	pid	process	target process
PID 3436 set thread context of 4844	3436	tmp.exe	Regsvcs.exe
PID 4844 set thread context of 3048	4844	Regsvcs.exe	Explorer.EXE
PID 5012 set thread context of 3048	5012	systray.exe	Explorer.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

systray.exe

description	ioc	process
Key created	\Registry\User\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	systray.exe

Suspicious behavior: EnumeratesProcesses 62 IoCs

Processes:

Regsvcs.exesystray.exe

pid	process
4844	Regsvcs.exe
4844	Regsvcs.exe
4844	Regsvcs.exe
4844	Regsvcs.exe
4844	Regsvcs.exe
4844	Regsvcs.exe
4844	Regsvcs.exe
4844	Regsvcs.exe
5012	systray.exe
5012	systray.exe
5012	systray.exe
5012	systray.exe
5012	systray.exe
5012	systray.exe
5012	systray.exe
5012	systray.exe
5012	systray.exe
5012	systray.exe
5012	systray.exe
5012	systray.exe
5012	systray.exe
5012	systray.exe
5012	systray.exe
5012	systray.exe
5012	systray.exe
5012	systray.exe
5012	systray.exe
5012	systray.exe
5012	systray.exe
5012	systray.exe
5012	systray.exe
5012	systray.exe
5012	systray.exe
5012	systray.exe
5012	systray.exe
5012	systray.exe
5012	systray.exe
5012	systray.exe
5012	systray.exe
5012	systray.exe
5012	systray.exe
5012	systray.exe
5012	systray.exe
5012	systray.exe
5012	systray.exe
5012	systray.exe
5012	systray.exe
5012	systray.exe
5012	systray.exe
5012	systray.exe
5012	systray.exe
5012	systray.exe
5012	systray.exe
5012	systray.exe
5012	systray.exe
5012	systray.exe
5012	systray.exe
5012	systray.exe
5012	systray.exe
5012	systray.exe
5012	systray.exe
5012	systray.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

3048 Explorer.EXE
Suspicious behavior: MapViewOfSection 7 IoCs

Processes:

Regsvcs.exesystray.exe

pid process

4844 Regsvcs.exe
4844 Regsvcs.exe
4844 Regsvcs.exe
5012 systray.exe
5012 systray.exe
5012 systray.exe
5012 systray.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Regsvcs.exesystray.exe

description pid process

Token: SeDebugPrivilege 4844 Regsvcs.exe
Token: SeDebugPrivilege 5012 systray.exe

pid	process
3048	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	4844	Regsvcs.exe
Token: SeDebugPrivilege	5012	systray.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

tmp.exeExplorer.EXEsystray.exe

description	pid	process	target process
PID 3436 wrote to memory of 4844	3436	tmp.exe	Regsvcs.exe
PID 3436 wrote to memory of 4844	3436	tmp.exe	Regsvcs.exe
PID 3436 wrote to memory of 4844	3436	tmp.exe	Regsvcs.exe
PID 3436 wrote to memory of 4844	3436	tmp.exe	Regsvcs.exe
PID 3436 wrote to memory of 4844	3436	tmp.exe	Regsvcs.exe
PID 3436 wrote to memory of 4844	3436	tmp.exe	Regsvcs.exe
PID 3048 wrote to memory of 5012	3048	Explorer.EXE	systray.exe
PID 3048 wrote to memory of 5012	3048	Explorer.EXE	systray.exe
PID 3048 wrote to memory of 5012	3048	Explorer.EXE	systray.exe
PID 5012 wrote to memory of 3744	5012	systray.exe	Firefox.exe
PID 5012 wrote to memory of 3744	5012	systray.exe	Firefox.exe
PID 5012 wrote to memory of 3744	5012	systray.exe	Firefox.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3048

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3436

C:\Windows\Microsoft.NET\Framework\v4.0.30319\Regsvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Regsvcs.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4844

C:\Windows\SysWOW64\systray.exe
"C:\Windows\SysWOW64\systray.exe"
2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5012

C:\Program Files\Mozilla Firefox\Firefox.exe
"C:\Program Files\Mozilla Firefox\Firefox.exe"
3⤵
PID:3744

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3048-151-0x00000000031D0000-0x0000000003286000-memory.dmp

Filesize
728KB

Download
memory/3048-149-0x00000000031D0000-0x0000000003286000-memory.dmp

Filesize
728KB

Download
memory/3048-143-0x0000000007EF0000-0x000000000809D000-memory.dmp

Filesize
1.7MB

Download
memory/3436-132-0x000001D1E0410000-0x000001D1E0458000-memory.dmp

Filesize
288KB

Download
memory/3436-135-0x00007FFB86930000-0x00007FFB873F1000-memory.dmp

Filesize
10.8MB

Download
memory/3436-137-0x00007FFB86930000-0x00007FFB873F1000-memory.dmp

Filesize
10.8MB

Download
memory/4844-141-0x0000000000401000-0x000000000042F000-memory.dmp

Filesize
184KB

Download
memory/4844-142-0x00000000013C0000-0x00000000013D0000-memory.dmp

Filesize
64KB

Download
memory/4844-140-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4844-139-0x00000000013F0000-0x000000000173A000-memory.dmp

Filesize
3.3MB

Download
memory/4844-138-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4844-134-0x00000000004012B0-mapping.dmp

Download
memory/4844-133-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5012-144-0x0000000000000000-mapping.dmp

Download
memory/5012-145-0x0000000000BA0000-0x0000000000BA6000-memory.dmp

Filesize
24KB

Download
memory/5012-146-0x0000000000690000-0x00000000006BD000-memory.dmp

Filesize
180KB

Download
memory/5012-147-0x0000000002620000-0x000000000296A000-memory.dmp

Filesize
3.3MB

Download
memory/5012-148-0x0000000002390000-0x000000000241F000-memory.dmp

Filesize
572KB

Download
memory/5012-150-0x0000000000690000-0x00000000006BD000-memory.dmp

Filesize
180KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads