formbook | a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7

General

Target

a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe
Size

555KB
MD5

c57658ef781e0f31e6539263bb87c7fc
SHA1

4a8902bdbfe4d490aac56b9962caec5598e5604c
SHA256

a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7
SHA512

637f1ef12dc4e3d86f8d5dec18c1cbe88c08db1a150de090e9f1135643136e0abd73f75b0b1c14c6cd144280b736cb25cbe28be13747ccc01e5420fed4a56922
SSDEEP

12288:B3tTTCkyO2KnJVr7tjoH5QPpCuzYGWrrUN8ywGIgyfOZadEVFMWM:B9b1r785e1zW8N8ywLfK7F

Score

10^/10

formbook bft rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

bft

Decoy

edenicities.com

buntingfordhomeservices.com

nuanceproducoes.com

divasinspire.com

capiturn.com

zbjsn.com

thegioicaytrongnha.com

featherventure.com

onbrandtrading.com

sanguoban.com

doorman.pro

ourhomie.net

iwassickonholiday.com

mrcskin.com

reallycoolmask.com

tkrbeautyinstitut.com

keytomiami.com

sesliduybeni.com

asherwebber.com

starkweatherwindows.net

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2756-137-0x0000000000400000-0x000000000042E000-memory.dmp	formbook

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe

description	pid	process	target process
PID 4736 set thread context of 2756	4736	a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe	a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1784 schtasks.exe

pid	process
1784	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe

pid	process
2756	a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe
2756	a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe

description	pid	process	target process
PID 4736 wrote to memory of 1784	4736	a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe	schtasks.exe
PID 4736 wrote to memory of 1784	4736	a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe	schtasks.exe
PID 4736 wrote to memory of 1784	4736	a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe	schtasks.exe
PID 4736 wrote to memory of 2756	4736	a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe	a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe
PID 4736 wrote to memory of 2756	4736	a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe	a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe
PID 4736 wrote to memory of 2756	4736	a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe	a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe
PID 4736 wrote to memory of 2756	4736	a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe	a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe
PID 4736 wrote to memory of 2756	4736	a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe	a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe
PID 4736 wrote to memory of 2756	4736	a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe	a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe

C:\Users\Admin\AppData\Local\Temp\a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe
"C:\Users\Admin\AppData\Local\Temp\a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4736

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bKeWepQJXUfB" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2C5A.tmp"
2⤵
- Creates scheduled task(s)
PID:1784

C:\Users\Admin\AppData\Local\Temp\a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe
"C:\Users\Admin\AppData\Local\Temp\a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2756

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp2C5A.tmp
Filesize
1KB

MD5
4506661deeab2ed90403faccca2ff179

SHA1
dc0f72d0b7ab56266bb7242a178e252caa866829

SHA256
8c000cfbab46108b70db8804a60220c57bdd0bf22e121d872f8591227ce6e796

SHA512
0d90731400be7b627722de8d4973740b5f992a31cf86ae284dc166ea7339a01ebc874b94ff786afed7c845ed74f69f84dc01a9a77978d965b72ce98baed8c762

Download Submit
memory/1784-134-0x0000000000000000-mapping.dmp

Download
memory/2756-136-0x0000000000000000-mapping.dmp

Download
memory/2756-137-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2756-139-0x0000000001790000-0x0000000001ADA000-memory.dmp

Filesize
3.3MB

Download
memory/4736-132-0x00000000748A0000-0x0000000074E51000-memory.dmp

Filesize
5.7MB

Download
memory/4736-133-0x00000000748A0000-0x0000000074E51000-memory.dmp

Filesize
5.7MB

Download
memory/4736-138-0x00000000748A0000-0x0000000074E51000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads