formbook | a8d97304d740bb44b27e40303d72326a34d30973e801161f4bf026fff552c1a8

General

Target

a8d97304d740bb44b27e40303d72326a34d30973e801161f4bf026fff552c1a8.exe
Size

2.1MB
MD5

dc86d8c67a66d23d6cba86036dacd475
SHA1

3c803edc8f87f3c69c460ccf1255ed8c9c1651f6
SHA256

a8d97304d740bb44b27e40303d72326a34d30973e801161f4bf026fff552c1a8
SHA512

941b380f3c393ebb776b0d181b290550b528534f50b6bb55ada418f3639d8ccd07587303a7b680937c0b641e838cc2f98265d93f56d7bbcd9419e7a2512a69f3
SSDEEP

24576:MuOolI+AqJiMqbPf8/cEnn8jrO+jfn2QaRgRBmjb+Ba56r19EvAI3eQFZ:x3Aq0U/cbjjL2Q+gRBKyq6r19mAI3RF

Score

10^/10

formbook do25 persistence rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

do25

Decoy

nickifarina.site

nfptrwge.bar

nobreemporio.com

split-acres.com

sharingservice-act.com

nakedinktees.shop

zhensheng1988.com

ipiton.com

liftoffdigitalmarketing.com

karen.cool

theprotestantchurch.com

shirhadarr.com

azdtwp.com

comzestdent.com

jnsjh.com

in-heat-cool.com

dfefej.top

tumingchun.com

eisei-shouji.tokyo

sparecreeping.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1772-63-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1772-64-0x000000000041F160-mapping.dmp	formbook

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

a8d97304d740bb44b27e40303d72326a34d30973e801161f4bf026fff552c1a8.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\gedata = "\"C:\\Users\\Admin\\AppData\\Roaming\\gedata.exe\""	a8d97304d740bb44b27e40303d72326a34d30973e801161f4bf026fff552c1a8.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

a8d97304d740bb44b27e40303d72326a34d30973e801161f4bf026fff552c1a8.exe

description	pid	process	target process
PID 1272 set thread context of 1772	1272	a8d97304d740bb44b27e40303d72326a34d30973e801161f4bf026fff552c1a8.exe	a8d97304d740bb44b27e40303d72326a34d30973e801161f4bf026fff552c1a8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exea8d97304d740bb44b27e40303d72326a34d30973e801161f4bf026fff552c1a8.exe

pid process

484 powershell.exe
1772 a8d97304d740bb44b27e40303d72326a34d30973e801161f4bf026fff552c1a8.exe

pid	process
484	powershell.exe
1772	a8d97304d740bb44b27e40303d72326a34d30973e801161f4bf026fff552c1a8.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

a8d97304d740bb44b27e40303d72326a34d30973e801161f4bf026fff552c1a8.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1272	a8d97304d740bb44b27e40303d72326a34d30973e801161f4bf026fff552c1a8.exe
Token: SeDebugPrivilege	484	powershell.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

a8d97304d740bb44b27e40303d72326a34d30973e801161f4bf026fff552c1a8.exe

description	pid	process	target process
PID 1272 wrote to memory of 484	1272	a8d97304d740bb44b27e40303d72326a34d30973e801161f4bf026fff552c1a8.exe	powershell.exe
PID 1272 wrote to memory of 484	1272	a8d97304d740bb44b27e40303d72326a34d30973e801161f4bf026fff552c1a8.exe	powershell.exe
PID 1272 wrote to memory of 484	1272	a8d97304d740bb44b27e40303d72326a34d30973e801161f4bf026fff552c1a8.exe	powershell.exe
PID 1272 wrote to memory of 484	1272	a8d97304d740bb44b27e40303d72326a34d30973e801161f4bf026fff552c1a8.exe	powershell.exe
PID 1272 wrote to memory of 1772	1272	a8d97304d740bb44b27e40303d72326a34d30973e801161f4bf026fff552c1a8.exe	a8d97304d740bb44b27e40303d72326a34d30973e801161f4bf026fff552c1a8.exe
PID 1272 wrote to memory of 1772	1272	a8d97304d740bb44b27e40303d72326a34d30973e801161f4bf026fff552c1a8.exe	a8d97304d740bb44b27e40303d72326a34d30973e801161f4bf026fff552c1a8.exe
PID 1272 wrote to memory of 1772	1272	a8d97304d740bb44b27e40303d72326a34d30973e801161f4bf026fff552c1a8.exe	a8d97304d740bb44b27e40303d72326a34d30973e801161f4bf026fff552c1a8.exe
PID 1272 wrote to memory of 1772	1272	a8d97304d740bb44b27e40303d72326a34d30973e801161f4bf026fff552c1a8.exe	a8d97304d740bb44b27e40303d72326a34d30973e801161f4bf026fff552c1a8.exe
PID 1272 wrote to memory of 1772	1272	a8d97304d740bb44b27e40303d72326a34d30973e801161f4bf026fff552c1a8.exe	a8d97304d740bb44b27e40303d72326a34d30973e801161f4bf026fff552c1a8.exe
PID 1272 wrote to memory of 1772	1272	a8d97304d740bb44b27e40303d72326a34d30973e801161f4bf026fff552c1a8.exe	a8d97304d740bb44b27e40303d72326a34d30973e801161f4bf026fff552c1a8.exe
PID 1272 wrote to memory of 1772	1272	a8d97304d740bb44b27e40303d72326a34d30973e801161f4bf026fff552c1a8.exe	a8d97304d740bb44b27e40303d72326a34d30973e801161f4bf026fff552c1a8.exe

C:\Users\Admin\AppData\Local\Temp\a8d97304d740bb44b27e40303d72326a34d30973e801161f4bf026fff552c1a8.exe
"C:\Users\Admin\AppData\Local\Temp\a8d97304d740bb44b27e40303d72326a34d30973e801161f4bf026fff552c1a8.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1272

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwAA==
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:484

C:\Users\Admin\AppData\Local\Temp\a8d97304d740bb44b27e40303d72326a34d30973e801161f4bf026fff552c1a8.exe
C:\Users\Admin\AppData\Local\Temp\a8d97304d740bb44b27e40303d72326a34d30973e801161f4bf026fff552c1a8.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1772

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/484-56-0x0000000000000000-mapping.dmp

Download
memory/484-57-0x00000000764C1000-0x00000000764C3000-memory.dmp

Filesize
8KB

Download
memory/484-58-0x000000006EAA0000-0x000000006F04B000-memory.dmp

Filesize
5.7MB

Download
memory/484-59-0x000000006EAA0000-0x000000006F04B000-memory.dmp

Filesize
5.7MB

Download
memory/1272-54-0x0000000001290000-0x00000000014AA000-memory.dmp

Filesize
2.1MB

Download
memory/1272-55-0x00000000048B0000-0x0000000004AC4000-memory.dmp

Filesize
2.1MB

Download
memory/1772-60-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1772-61-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1772-63-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1772-64-0x000000000041F160-mapping.dmp

Download
memory/1772-65-0x0000000000840000-0x0000000000B43000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads