formbook | 937c7c476bb363e55fdf1ff275c87de91ec0f550072e9a759387cc95e6c78c83

General

Target

PI & PACKING LIST.exe
Size

1006KB
MD5

36fbb21511e87e8dddc8916cc2dc9367
SHA1

eda2fa3fe4b62fe3d564cf492cc31a875e8f1922
SHA256

937c7c476bb363e55fdf1ff275c87de91ec0f550072e9a759387cc95e6c78c83
SHA512

85aa4905d89f42acc75d9a31806d16a84ffca0bbd4aaf9b9605d98adc8ff66544616afd8705c9c5295a9153930f1be1d58c6556f9c244e1be163218c42336dc7
SSDEEP

24576:s1uqqdOC2CIep1Vtcl6gIGVfeSvopbGCh9XV:sbqdO+IAInVnFCh9X

Score

10^/10

formbook m5oe rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

m5oe

Decoy

HdR8hG6r12hBYuHY4zv6YeeFPQ==

tD1V9gswYvgQXEGd

1xKtJ1LdqRYMRMC84U1A

MbhjiWb7Lz8z7KIWl3UyUIJwA6Tb

joVB5Xggy2RtE+odsZg=

TrduAIay6Y3SvoIK20xI

pSna7LOsXXwXT/zz3Iow4g==

QnthmO4Qst5gC3sDoA==

eAirzOOgO7SOCenz3Iow4g==

xg0uSbfLTg==

YWQXwyGRzPEHzGrDFE8CBSE=

ujLnfuXoH9dbgHIK20xI

291v0XsGFrYQXEGd

MRvTd/qMuaHpjCM=

X131fLC6VWX4MsvCb2IPjIfq8wlksWfg

Y9Bur8DbgqFt/Yni86MMCCE=

q6RTBmJkmy5pWTmmCCrvmuCDPw==

mQS26DojT+EQXEGd

sjHQ+Kav2Wx9FeodsZg=

JA24UKnTA5re1LhcQaVo/w==

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

PI & PACKING LIST.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	PI & PACKING LIST.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

PI & PACKING LIST.exePI & PACKING LIST.exeNETSTAT.EXE

description	pid	process	target process
PID 2276 set thread context of 2700	2276	PI & PACKING LIST.exe	PI & PACKING LIST.exe
PID 2700 set thread context of 2644	2700	PI & PACKING LIST.exe	Explorer.EXE
PID 1468 set thread context of 2644	1468	NETSTAT.EXE	Explorer.EXE

Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command-Line Interface
T1059

Processes:

NETSTAT.EXE

pid process

1468 NETSTAT.EXE

pid	process
1468	NETSTAT.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

PI & PACKING LIST.exeNETSTAT.EXE

pid	process
2700	PI & PACKING LIST.exe
2700	PI & PACKING LIST.exe
2700	PI & PACKING LIST.exe
2700	PI & PACKING LIST.exe
2700	PI & PACKING LIST.exe
2700	PI & PACKING LIST.exe
2700	PI & PACKING LIST.exe
2700	PI & PACKING LIST.exe
1468	NETSTAT.EXE
1468	NETSTAT.EXE
1468	NETSTAT.EXE
1468	NETSTAT.EXE

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

PI & PACKING LIST.exeNETSTAT.EXE

pid process

2700 PI & PACKING LIST.exe
2700 PI & PACKING LIST.exe
2700 PI & PACKING LIST.exe
1468 NETSTAT.EXE
1468 NETSTAT.EXE
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

PI & PACKING LIST.exeNETSTAT.EXE

description pid process

Token: SeDebugPrivilege 2700 PI & PACKING LIST.exe
Token: SeDebugPrivilege 1468 NETSTAT.EXE

description	pid	process
Token: SeDebugPrivilege	2700	PI & PACKING LIST.exe
Token: SeDebugPrivilege	1468	NETSTAT.EXE

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

PI & PACKING LIST.exeExplorer.EXE

description	pid	process	target process
PID 2276 wrote to memory of 2700	2276	PI & PACKING LIST.exe	PI & PACKING LIST.exe
PID 2276 wrote to memory of 2700	2276	PI & PACKING LIST.exe	PI & PACKING LIST.exe
PID 2276 wrote to memory of 2700	2276	PI & PACKING LIST.exe	PI & PACKING LIST.exe
PID 2276 wrote to memory of 2700	2276	PI & PACKING LIST.exe	PI & PACKING LIST.exe
PID 2276 wrote to memory of 2700	2276	PI & PACKING LIST.exe	PI & PACKING LIST.exe
PID 2276 wrote to memory of 2700	2276	PI & PACKING LIST.exe	PI & PACKING LIST.exe
PID 2644 wrote to memory of 1468	2644	Explorer.EXE	NETSTAT.EXE
PID 2644 wrote to memory of 1468	2644	Explorer.EXE	NETSTAT.EXE
PID 2644 wrote to memory of 1468	2644	Explorer.EXE	NETSTAT.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:2644

C:\Users\Admin\AppData\Local\Temp\PI & PACKING LIST.exe
"C:\Users\Admin\AppData\Local\Temp\PI & PACKING LIST.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2276

C:\Users\Admin\AppData\Local\Temp\PI & PACKING LIST.exe
"C:\Users\Admin\AppData\Local\Temp\PI & PACKING LIST.exe"
3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2700

C:\Windows\SysWOW64\NETSTAT.EXE
"C:\Windows\SysWOW64\NETSTAT.EXE"
2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1468

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1468-149-0x0000000001860000-0x0000000001BAA000-memory.dmp

Filesize
3.3MB

Download
memory/1468-152-0x0000000001100000-0x000000000112D000-memory.dmp

Filesize
180KB

Download
memory/1468-150-0x00000000017A0000-0x000000000182F000-memory.dmp

Filesize
572KB

Download
memory/1468-146-0x0000000000000000-mapping.dmp

Download
memory/1468-148-0x0000000001100000-0x000000000112D000-memory.dmp

Filesize
180KB

Download
memory/1468-147-0x0000000000BA0000-0x0000000000BAB000-memory.dmp

Filesize
44KB

Download
memory/2276-133-0x0000000005520000-0x0000000005AC4000-memory.dmp

Filesize
5.6MB

Download
memory/2276-134-0x0000000005010000-0x00000000050A2000-memory.dmp

Filesize
584KB

Download
memory/2276-135-0x0000000005400000-0x000000000540A000-memory.dmp

Filesize
40KB

Download
memory/2276-136-0x00000000073A0000-0x000000000743C000-memory.dmp

Filesize
624KB

Download
memory/2276-132-0x0000000000540000-0x0000000000642000-memory.dmp

Filesize
1.0MB

Download
memory/2644-151-0x0000000003770000-0x000000000385D000-memory.dmp

Filesize
948KB

Download
memory/2644-145-0x0000000003320000-0x0000000003462000-memory.dmp

Filesize
1.3MB

Download
memory/2700-137-0x0000000000000000-mapping.dmp

Download
memory/2700-144-0x0000000001170000-0x0000000001180000-memory.dmp

Filesize
64KB

Download
memory/2700-143-0x0000000001700000-0x0000000001A4A000-memory.dmp

Filesize
3.3MB

Download
memory/2700-142-0x0000000000401000-0x000000000042F000-memory.dmp

Filesize
184KB

Download
memory/2700-141-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2700-140-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2700-138-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads