formbook | f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5

General

Target

f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exe
Size

961KB
MD5

489a932f0f830c254f5985659d39c62e
SHA1

0f7e2d9f7968229472e440e574143147601921a1
SHA256

f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5
SHA512

454d77ad50dfd9fefbdce4acd270fb5c0f0b16b1269116bdcf08868b503dd89f8cbcbd7ab1234320e54d60aa6e3808317a031a738d78f7219b3b70aa74a1e3f7
SSDEEP

12288:SK16ZLSbKnkXl5ZwH4kIF9RcvYk4+CWfJf2IOl7de:SKEZYckXLZwYk4cCIfx2B7d

Score

10^/10

formbook ntg rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ntg

Decoy

successwithyolandafgreen.com

theordinaryph.com

atamyo-therapeutics.com

pophazard.com

anthonyfultz.com

pasanglham.com

kanekhushi.com

littlefishyswim.com

kaieteurny.com

fanavartima.com

digexpo.com

se-rto.com

chaos.finance

bakldx.com

after-school.pro

faithfromphilly.com

estudiomuradian.com

albertocerasini.com

andronna.com

wingspotusa.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1960-141-0x0000000000400000-0x000000000042E000-memory.dmp	formbook

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exe

description	pid	process	target process
PID 616 set thread context of 1960	616	f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exe	f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4708 schtasks.exe

pid	process
4708	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exe

pid	process
1960	f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exe
1960	f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exe

description	pid	process	target process
PID 616 wrote to memory of 4708	616	f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exe	schtasks.exe
PID 616 wrote to memory of 4708	616	f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exe	schtasks.exe
PID 616 wrote to memory of 4708	616	f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exe	schtasks.exe
PID 616 wrote to memory of 1960	616	f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exe	f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exe
PID 616 wrote to memory of 1960	616	f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exe	f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exe
PID 616 wrote to memory of 1960	616	f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exe	f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exe
PID 616 wrote to memory of 1960	616	f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exe	f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exe
PID 616 wrote to memory of 1960	616	f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exe	f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exe
PID 616 wrote to memory of 1960	616	f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exe	f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exe

C:\Users\Admin\AppData\Local\Temp\f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exe
"C:\Users\Admin\AppData\Local\Temp\f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:616

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mwjzVbUGarqP" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEAAE.tmp"
2⤵
- Creates scheduled task(s)
PID:4708

C:\Users\Admin\AppData\Local\Temp\f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exe
"C:\Users\Admin\AppData\Local\Temp\f786969468695b70b06cc87c4628d1c64888068a88007326376bfa977c887fe5.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1960

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpEAAE.tmp
Filesize
1KB

MD5
2660544d162fce4c7e8cba192c00c9a7

SHA1
a2a0eb27f2dbc1f9b43d264b079eab7ad8816d3f

SHA256
a5acbad57f9ebb2d7cac75b0e207d60b854b7c82da1b61620f46d095d4d88084

SHA512
1670de84164ca6172b3337e44296758e80be895551788c9e72138344fba3d13c70744db63c817b7dcc9ff581c866b22c0c040ba37d6d11189dc11ca2c5e6e6d3

Download Submit
memory/616-132-0x0000000000C20000-0x0000000000D16000-memory.dmp

Filesize
984KB

Download
memory/616-133-0x00000000056C0000-0x000000000575C000-memory.dmp

Filesize
624KB

Download
memory/616-134-0x0000000005D10000-0x00000000062B4000-memory.dmp

Filesize
5.6MB

Download
memory/616-135-0x0000000005800000-0x0000000005892000-memory.dmp

Filesize
584KB

Download
memory/616-136-0x0000000005760000-0x000000000576A000-memory.dmp

Filesize
40KB

Download
memory/616-137-0x0000000005990000-0x00000000059E6000-memory.dmp

Filesize
344KB

Download
memory/1960-140-0x0000000000000000-mapping.dmp

Download
memory/1960-141-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1960-142-0x00000000012F0000-0x000000000163A000-memory.dmp

Filesize
3.3MB

Download
memory/4708-138-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads