formbook | 02b628dcbfaa0cad2ccde62b1cfb16425a8d40b4cad9de200569ce1b84981612

General

Target

SecuriteInfo.com.Win32.CrypterX-gen.24274.13707.exe
Size

885KB
MD5

630ffd21c1de8a583a4e1627b8ac6534
SHA1

7cdb7d33a07326fa3b2699bb7308889a0920541a
SHA256

02b628dcbfaa0cad2ccde62b1cfb16425a8d40b4cad9de200569ce1b84981612
SHA512

9ee857113df144f0fed19c1c831cf4731b866e8b5a92417b11c445d2cb9a374c430a6c2fc4a7318bd01a0fdc756132d7f4895f0798a3fdf194ac3b223f10cd68
SSDEEP

24576:hIVD2ISXOaDU11ecODssqm/6rw5Roa/W9DdEPf:ha2RXOKcLsq46s5RoafP

Score

10^/10

formbook f9r5 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

f9r5

Decoy

teknotimur.com

zuliboo.com

remmingtoncampbell.com

vehicletitleloansphoenix.com

sen-computer.com

98731.biz

shelikesblu.com

canis-totem.com

metaversemedianetwork.com

adsdu.com

vanishmediasystems.com

astewaykebede.com

wszhongxue.com

gacha-animator-free.com

papatyadekorasyon.com

mqc168.top

simplebrilliantsolutions.com

jubileehawkesprairie.com

ridflab.com

conboysfilm.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/584-67-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/584-68-0x000000000041F150-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

SecuriteInfo.com.Win32.CrypterX-gen.24274.13707.exe

description	pid	process	target process
PID 1368 set thread context of 584	1368	SecuriteInfo.com.Win32.CrypterX-gen.24274.13707.exe	SecuriteInfo.com.Win32.CrypterX-gen.24274.13707.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1820 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

SecuriteInfo.com.Win32.CrypterX-gen.24274.13707.exepowershell.exe

pid process

584 SecuriteInfo.com.Win32.CrypterX-gen.24274.13707.exe
1832 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1832 powershell.exe

pid	process
1820	schtasks.exe

pid	process
584	SecuriteInfo.com.Win32.CrypterX-gen.24274.13707.exe
1832	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1832	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

SecuriteInfo.com.Win32.CrypterX-gen.24274.13707.exe

description	pid	process	target process
PID 1368 wrote to memory of 1832	1368	SecuriteInfo.com.Win32.CrypterX-gen.24274.13707.exe	powershell.exe
PID 1368 wrote to memory of 1832	1368	SecuriteInfo.com.Win32.CrypterX-gen.24274.13707.exe	powershell.exe
PID 1368 wrote to memory of 1832	1368	SecuriteInfo.com.Win32.CrypterX-gen.24274.13707.exe	powershell.exe
PID 1368 wrote to memory of 1832	1368	SecuriteInfo.com.Win32.CrypterX-gen.24274.13707.exe	powershell.exe
PID 1368 wrote to memory of 1820	1368	SecuriteInfo.com.Win32.CrypterX-gen.24274.13707.exe	schtasks.exe
PID 1368 wrote to memory of 1820	1368	SecuriteInfo.com.Win32.CrypterX-gen.24274.13707.exe	schtasks.exe
PID 1368 wrote to memory of 1820	1368	SecuriteInfo.com.Win32.CrypterX-gen.24274.13707.exe	schtasks.exe
PID 1368 wrote to memory of 1820	1368	SecuriteInfo.com.Win32.CrypterX-gen.24274.13707.exe	schtasks.exe
PID 1368 wrote to memory of 584	1368	SecuriteInfo.com.Win32.CrypterX-gen.24274.13707.exe	SecuriteInfo.com.Win32.CrypterX-gen.24274.13707.exe
PID 1368 wrote to memory of 584	1368	SecuriteInfo.com.Win32.CrypterX-gen.24274.13707.exe	SecuriteInfo.com.Win32.CrypterX-gen.24274.13707.exe
PID 1368 wrote to memory of 584	1368	SecuriteInfo.com.Win32.CrypterX-gen.24274.13707.exe	SecuriteInfo.com.Win32.CrypterX-gen.24274.13707.exe
PID 1368 wrote to memory of 584	1368	SecuriteInfo.com.Win32.CrypterX-gen.24274.13707.exe	SecuriteInfo.com.Win32.CrypterX-gen.24274.13707.exe
PID 1368 wrote to memory of 584	1368	SecuriteInfo.com.Win32.CrypterX-gen.24274.13707.exe	SecuriteInfo.com.Win32.CrypterX-gen.24274.13707.exe
PID 1368 wrote to memory of 584	1368	SecuriteInfo.com.Win32.CrypterX-gen.24274.13707.exe	SecuriteInfo.com.Win32.CrypterX-gen.24274.13707.exe
PID 1368 wrote to memory of 584	1368	SecuriteInfo.com.Win32.CrypterX-gen.24274.13707.exe	SecuriteInfo.com.Win32.CrypterX-gen.24274.13707.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterX-gen.24274.13707.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterX-gen.24274.13707.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\owFIYUUG.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1832
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\owFIYUUG" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE773.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1820
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterX-gen.24274.13707.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterX-gen.24274.13707.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:584

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpE773.tmp

Filesize
1KB

MD5
3065bf846c0152430f39bb4abe8fc794

SHA1
b5ae86b27fe20702d0e23efa89af4c1365c5b261

SHA256
8266a23b4722923f1e23dedfc672399157f926fa9e841c25cc13d6c5d0ae5031

SHA512
0a0c35cf63c00bc3107cec95f962b49bad39886bbe1ff5dcfb66ba10261a17b022f7871609fa258d5c0c2178c71e35a3f550c937594703d3a2baa379efdab3bc

Download Submit
memory/584-69-0x0000000000860000-0x0000000000B63000-memory.dmp

Filesize
3.0MB

Download
memory/584-68-0x000000000041F150-mapping.dmp

Download
memory/584-67-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/584-65-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/584-64-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1368-58-0x0000000005770000-0x0000000005802000-memory.dmp

Filesize
584KB

Download
memory/1368-63-0x0000000005050000-0x00000000050A8000-memory.dmp

Filesize
352KB

Download
memory/1368-54-0x0000000001340000-0x0000000001424000-memory.dmp

Filesize
912KB

Download
memory/1368-57-0x0000000000440000-0x000000000044E000-memory.dmp

Filesize
56KB

Download
memory/1368-56-0x00000000003E0000-0x00000000003F6000-memory.dmp

Filesize
88KB

Download
memory/1368-55-0x0000000075521000-0x0000000075523000-memory.dmp

Filesize
8KB

Download
memory/1820-60-0x0000000000000000-mapping.dmp

Download
memory/1832-59-0x0000000000000000-mapping.dmp

Download
memory/1832-70-0x000000006F2B0000-0x000000006F85B000-memory.dmp

Filesize
5.7MB

Download
memory/1832-71-0x000000006F2B0000-0x000000006F85B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads