formbook | f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5

General

Target

f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exe
Size

961KB
MD5

489a932f0f830c254f5985659d39c62e
SHA1

0f7e2d9f7968229472e440e574143147601921a1
SHA256

f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5
SHA512

454d77ad50dfd9fefbdce4acd270fb5c0f0b16b1269116bdcf08868b503dd89f8cbcbd7ab1234320e54d60aa6e3808317a031a738d78f7219b3b70aa74a1e3f7
SSDEEP

12288:SK16ZLSbKnkXl5ZwH4kIF9RcvYk4+CWfJf2IOl7de:SKEZYckXLZwYk4cCIfx2B7d

Score

10^/10

formbook ntg rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ntg

Decoy

successwithyolandafgreen.com

theordinaryph.com

atamyo-therapeutics.com

pophazard.com

anthonyfultz.com

pasanglham.com

kanekhushi.com

littlefishyswim.com

kaieteurny.com

fanavartima.com

digexpo.com

se-rto.com

chaos.finance

bakldx.com

after-school.pro

faithfromphilly.com

estudiomuradian.com

albertocerasini.com

andronna.com

wingspotusa.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1696-64-0x000000000041EB00-mapping.dmp	formbook
behavioral1/memory/1696-63-0x0000000000400000-0x000000000042E000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exe

description	pid	process	target process
PID 2016 set thread context of 1696	2016	f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exe	f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2024 schtasks.exe

pid	process
2024	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exef786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exe

pid	process
2016	f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exe
1696	f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exe

description pid process

Token: SeDebugPrivilege 2016 f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exe

description	pid	process
Token: SeDebugPrivilege	2016	f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exe

description	pid	process	target process
PID 2016 wrote to memory of 2024	2016	f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exe	schtasks.exe
PID 2016 wrote to memory of 2024	2016	f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exe	schtasks.exe
PID 2016 wrote to memory of 2024	2016	f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exe	schtasks.exe
PID 2016 wrote to memory of 2024	2016	f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exe	schtasks.exe
PID 2016 wrote to memory of 1696	2016	f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exe	f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exe
PID 2016 wrote to memory of 1696	2016	f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exe	f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exe
PID 2016 wrote to memory of 1696	2016	f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exe	f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exe
PID 2016 wrote to memory of 1696	2016	f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exe	f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exe
PID 2016 wrote to memory of 1696	2016	f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exe	f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exe
PID 2016 wrote to memory of 1696	2016	f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exe	f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exe
PID 2016 wrote to memory of 1696	2016	f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exe	f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exe

C:\Users\Admin\AppData\Local\Temp\f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exe
"C:\Users\Admin\AppData\Local\Temp\f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2016

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mwjzVbUGarqP" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6578.tmp"
2⤵
- Creates scheduled task(s)
PID:2024

C:\Users\Admin\AppData\Local\Temp\f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exe
"C:\Users\Admin\AppData\Local\Temp\f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1696

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp6578.tmp
Filesize
1KB

MD5
74a0582b708064cd95fe527a8b6a6cb9

SHA1
a7ece95888d30ac7e88fd6da48b46e9882acaa38

SHA256
6802f758d6ac8e578da7e99ce3a06de11d393c55a907821791c07bb987c8a504

SHA512
9b4f189ff1c25e50c7ce382d8f9f02e5a48c6918b84877db7085004d6f93f2b4e2e30f6e783af88e941e2417820ca3d0d370f9478ffe6e1babf91db5e0f48fe3

Download Submit
memory/1696-60-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1696-61-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1696-64-0x000000000041EB00-mapping.dmp

Download
memory/1696-63-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1696-65-0x0000000000B80000-0x0000000000E83000-memory.dmp

Filesize
3.0MB

Download
memory/2016-54-0x0000000000A80000-0x0000000000B76000-memory.dmp

Filesize
984KB

Download
memory/2016-55-0x0000000075A71000-0x0000000075A73000-memory.dmp

Filesize
8KB

Download
memory/2016-56-0x0000000000330000-0x000000000033A000-memory.dmp

Filesize
40KB

Download
memory/2016-57-0x00000000047F0000-0x0000000004852000-memory.dmp

Filesize
392KB

Download
memory/2024-58-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads