formbook | a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7

General

Target

a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe
Size

555KB
MD5

c57658ef781e0f31e6539263bb87c7fc
SHA1

4a8902bdbfe4d490aac56b9962caec5598e5604c
SHA256

a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7
SHA512

637f1ef12dc4e3d86f8d5dec18c1cbe88c08db1a150de090e9f1135643136e0abd73f75b0b1c14c6cd144280b736cb25cbe28be13747ccc01e5420fed4a56922
SSDEEP

12288:B3tTTCkyO2KnJVr7tjoH5QPpCuzYGWrrUN8ywGIgyfOZadEVFMWM:B9b1r785e1zW8N8ywLfK7F

Score

10^/10

formbook bft rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

bft

Decoy

edenicities.com

buntingfordhomeservices.com

nuanceproducoes.com

divasinspire.com

capiturn.com

zbjsn.com

thegioicaytrongnha.com

featherventure.com

onbrandtrading.com

sanguoban.com

doorman.pro

ourhomie.net

iwassickonholiday.com

mrcskin.com

reallycoolmask.com

tkrbeautyinstitut.com

keytomiami.com

sesliduybeni.com

asherwebber.com

starkweatherwindows.net

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/836-62-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/836-63-0x000000000041EB40-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe

description	pid	process	target process
PID 1080 set thread context of 836	1080	a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe	a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1736 schtasks.exe

pid	process
1736	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exea45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe

pid	process
1080	a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe
1080	a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe
836	a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe

description pid process

Token: SeDebugPrivilege 1080 a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe

description	pid	process
Token: SeDebugPrivilege	1080	a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe

C:\Users\Admin\AppData\Local\Temp\a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe
"C:\Users\Admin\AppData\Local\Temp\a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1080

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bKeWepQJXUfB" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA1F.tmp"
2⤵
- Creates scheduled task(s)
PID:1736

C:\Users\Admin\AppData\Local\Temp\a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe
"C:\Users\Admin\AppData\Local\Temp\a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe"
2⤵
PID:1396

C:\Users\Admin\AppData\Local\Temp\a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe
"C:\Users\Admin\AppData\Local\Temp\a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:836

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpA1F.tmp
Filesize
1KB

MD5
338826394bdc7a98b1b7931550042200

SHA1
a23db8d6d2fa4e0d1f388b33ac9a80a0d7789221

SHA256
d8986640a6b7f8c22286abed5267d6d207330dc4f92d4269fbea2d0f0fdee5f0

SHA512
5b0a6ebe112007e82ba3a977c5944e86dbe17af5e3a6d1d9489e56e80851e676132001ed83ba400f6ba3361beaa642965b281446141a9889b0446a33609700d6

Download Submit
memory/836-59-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/836-60-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/836-62-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/836-63-0x000000000041EB40-mapping.dmp

Download
memory/836-65-0x0000000000A20000-0x0000000000D23000-memory.dmp

Filesize
3.0MB

Download
memory/1080-54-0x00000000758C1000-0x00000000758C3000-memory.dmp

Filesize
8KB

Download
memory/1080-55-0x0000000074700000-0x0000000074CAB000-memory.dmp

Filesize
5.7MB

Download
memory/1080-56-0x0000000074700000-0x0000000074CAB000-memory.dmp

Filesize
5.7MB

Download
memory/1080-64-0x0000000074700000-0x0000000074CAB000-memory.dmp

Filesize
5.7MB

Download
memory/1736-57-0x0000000000000000-mapping.dmp

Download

description	pid	process	target process
PID 1080 wrote to memory of 1736	1080	a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe	schtasks.exe
PID 1080 wrote to memory of 1736	1080	a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe	schtasks.exe
PID 1080 wrote to memory of 1736	1080	a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe	schtasks.exe
PID 1080 wrote to memory of 1736	1080	a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe	schtasks.exe
PID 1080 wrote to memory of 1396	1080	a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe	a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe
PID 1080 wrote to memory of 1396	1080	a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe	a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe
PID 1080 wrote to memory of 1396	1080	a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe	a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe
PID 1080 wrote to memory of 1396	1080	a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe	a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe
PID 1080 wrote to memory of 836	1080	a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe	a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe
PID 1080 wrote to memory of 836	1080	a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe	a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe
PID 1080 wrote to memory of 836	1080	a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe	a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe
PID 1080 wrote to memory of 836	1080	a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe	a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe
PID 1080 wrote to memory of 836	1080	a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe	a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe
PID 1080 wrote to memory of 836	1080	a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe	a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe
PID 1080 wrote to memory of 836	1080	a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe	a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads