formbook | 0646127a521c320e61c31e4ae2c035e53438d7ff8d25e28cd7150367f40d9504

General

Target

tmp.exe
Size

257KB
MD5

2bdc884f5196976c0de3167589f63522
SHA1

5b978a100bbb83b0bbec915bd1c3b07525196259
SHA256

0646127a521c320e61c31e4ae2c035e53438d7ff8d25e28cd7150367f40d9504
SHA512

a50a9949662bd8e0eafe665c5ab65b1c488c4e3122535908aea91a8584bc005b6744610cb973fcf761ce3165ae324c627d23d144f211e2a57f63a36d13c6d690
SSDEEP

6144:QBn1Z0jDV/nnSM77DguiCKieVOo5lhuxBaBUAIjmMQ8sXx:gAnSM77VijZV/5lhuxBaBUA6OL

Score

10^/10

formbook us90 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

us90

Decoy

1expresno.app

thepsychic.africa

burjbinghattitower.com

hotelurgell.com

goldenassistant.com

ecovod-servise.ru

kbjnonprofit.com

dope.trade

babylon-it.net

dsatyui.xyz

myexpertisebybbl.app

2185866.com

inboxwired.xyz

lamy.life

gic-invest.info

eliteconstructionsni.co.uk

lamygeo.com

courean.space

cremation-services-75688.com

fapearte.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1900-65-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1900-71-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1356-76-0x00000000000C0000-0x00000000000EF000-memory.dmp	formbook

Executes dropped EXE 2 IoCs

Processes:

dsdbla.exedsdbla.exe

pid process

756 dsdbla.exe
1900 dsdbla.exe
Loads dropped DLL 2 IoCs

Processes:

tmp.exedsdbla.exe

pid process

580 tmp.exe
756 dsdbla.exe

pid	process
756	dsdbla.exe
1900	dsdbla.exe

pid	process
580	tmp.exe
756	dsdbla.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

dsdbla.exedsdbla.execontrol.exe

description	pid	process	target process
PID 756 set thread context of 1900	756	dsdbla.exe	dsdbla.exe
PID 1900 set thread context of 1280	1900	dsdbla.exe	Explorer.EXE
PID 1900 set thread context of 1280	1900	dsdbla.exe	Explorer.EXE
PID 1356 set thread context of 1280	1356	control.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

dsdbla.execontrol.exe

pid	process
1900	dsdbla.exe
1900	dsdbla.exe
1900	dsdbla.exe
1356	control.exe
1356	control.exe
1356	control.exe
1356	control.exe
1356	control.exe
1356	control.exe
1356	control.exe
1356	control.exe
1356	control.exe
1356	control.exe
1356	control.exe
1356	control.exe
1356	control.exe
1356	control.exe
1356	control.exe
1356	control.exe
1356	control.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1280 Explorer.EXE
Suspicious behavior: MapViewOfSection 7 IoCs

Processes:

dsdbla.exedsdbla.execontrol.exe

pid process

756 dsdbla.exe
1900 dsdbla.exe
1900 dsdbla.exe
1900 dsdbla.exe
1900 dsdbla.exe
1356 control.exe
1356 control.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

dsdbla.execontrol.exe

description pid process

Token: SeDebugPrivilege 1900 dsdbla.exe
Token: SeDebugPrivilege 1356 control.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1280 Explorer.EXE
1280 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1280 Explorer.EXE
1280 Explorer.EXE

pid	process
1280	Explorer.EXE

pid	process
756	dsdbla.exe
1900	dsdbla.exe
1900	dsdbla.exe
1900	dsdbla.exe
1900	dsdbla.exe
1356	control.exe
1356	control.exe

description	pid	process
Token: SeDebugPrivilege	1900	dsdbla.exe
Token: SeDebugPrivilege	1356	control.exe

pid	process
1280	Explorer.EXE
1280	Explorer.EXE

pid	process
1280	Explorer.EXE
1280	Explorer.EXE

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

tmp.exedsdbla.exeExplorer.EXEdsdbla.execontrol.exe

description	pid	process	target process
PID 580 wrote to memory of 756	580	tmp.exe	dsdbla.exe
PID 580 wrote to memory of 756	580	tmp.exe	dsdbla.exe
PID 580 wrote to memory of 756	580	tmp.exe	dsdbla.exe
PID 580 wrote to memory of 756	580	tmp.exe	dsdbla.exe
PID 756 wrote to memory of 1900	756	dsdbla.exe	dsdbla.exe
PID 756 wrote to memory of 1900	756	dsdbla.exe	dsdbla.exe
PID 756 wrote to memory of 1900	756	dsdbla.exe	dsdbla.exe
PID 756 wrote to memory of 1900	756	dsdbla.exe	dsdbla.exe
PID 756 wrote to memory of 1900	756	dsdbla.exe	dsdbla.exe
PID 1280 wrote to memory of 1544	1280	Explorer.EXE	msdt.exe
PID 1280 wrote to memory of 1544	1280	Explorer.EXE	msdt.exe
PID 1280 wrote to memory of 1544	1280	Explorer.EXE	msdt.exe
PID 1280 wrote to memory of 1544	1280	Explorer.EXE	msdt.exe
PID 1900 wrote to memory of 1356	1900	dsdbla.exe	control.exe
PID 1900 wrote to memory of 1356	1900	dsdbla.exe	control.exe
PID 1900 wrote to memory of 1356	1900	dsdbla.exe	control.exe
PID 1900 wrote to memory of 1356	1900	dsdbla.exe	control.exe
PID 1356 wrote to memory of 1184	1356	control.exe	cmd.exe
PID 1356 wrote to memory of 1184	1356	control.exe	cmd.exe
PID 1356 wrote to memory of 1184	1356	control.exe	cmd.exe
PID 1356 wrote to memory of 1184	1356	control.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1280

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:580

C:\Users\Admin\AppData\Local\Temp\dsdbla.exe
"C:\Users\Admin\AppData\Local\Temp\dsdbla.exe" C:\Users\Admin\AppData\Local\Temp\liijoebg.mh
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:756

C:\Users\Admin\AppData\Local\Temp\dsdbla.exe
"C:\Users\Admin\AppData\Local\Temp\dsdbla.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1900

C:\Windows\SysWOW64\control.exe
"C:\Windows\SysWOW64\control.exe"
5⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1356

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\dsdbla.exe"
6⤵
PID:1184

C:\Windows\SysWOW64\msdt.exe
"C:\Windows\SysWOW64\msdt.exe"
2⤵
PID:1544

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\dsdbla.exe
Filesize
104KB

MD5
94602804a99dca871f93226f5b96ea72

SHA1
64337e2b7b7774d49063797b68804146481d641d

SHA256
ccb9e20dd6659f49a7e79337849608b121ca1a52f96a1f9420c9eccf9d66acb2

SHA512
c97648551f3c32c723c524c5ccbf7907c664aaa4cadf8dad8de538544a3690aea7b0182452dab59171b3e44dbb125252279314d97c965a36d4d5d10e3870722b

Download Submit
C:\Users\Admin\AppData\Local\Temp\dsdbla.exe
Filesize
104KB

MD5
94602804a99dca871f93226f5b96ea72

SHA1
64337e2b7b7774d49063797b68804146481d641d

SHA256
ccb9e20dd6659f49a7e79337849608b121ca1a52f96a1f9420c9eccf9d66acb2

SHA512
c97648551f3c32c723c524c5ccbf7907c664aaa4cadf8dad8de538544a3690aea7b0182452dab59171b3e44dbb125252279314d97c965a36d4d5d10e3870722b

Download Submit
C:\Users\Admin\AppData\Local\Temp\dsdbla.exe
Filesize
104KB

MD5
94602804a99dca871f93226f5b96ea72

SHA1
64337e2b7b7774d49063797b68804146481d641d

SHA256
ccb9e20dd6659f49a7e79337849608b121ca1a52f96a1f9420c9eccf9d66acb2

SHA512
c97648551f3c32c723c524c5ccbf7907c664aaa4cadf8dad8de538544a3690aea7b0182452dab59171b3e44dbb125252279314d97c965a36d4d5d10e3870722b

Download Submit
C:\Users\Admin\AppData\Local\Temp\gjldvdpgwtq.wu
Filesize
185KB

MD5
dc178368ef86f9e47be7b46d80973b7f

SHA1
188ad6c5b474a5a173b707a401858236052349fa

SHA256
64536c8c1548dfce51f857bfd87cbe2071ab3888fe3ddda942d6a5827680507c

SHA512
f2d00cfeda08309ee9b6c43d3f7b6250bfd8d7668f563da70e28c2963a11202c499f3d3f835b26ccfecb0439a97bb1360f7d5fc50438b5cab73656960acd71bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\liijoebg.mh
Filesize
5KB

MD5
e074e51a3b0f9f1d64f6eeb23b3032e0

SHA1
08aef3eaf7300ef03a83a285edf2b1171b240331

SHA256
c990ccf8006c966795c1de212b08a205c6bbfd11bfdd5e4010ae318941cca399

SHA512
029d2ab2441bbc8716c09161f4127301c1e1ff8d20c85c9b1326c59ac13a5ad1ef459c446564eb1049fbd8add4ebdd47e0aace6b14a10841564c42042852df72

Download Submit
\Users\Admin\AppData\Local\Temp\dsdbla.exe
Filesize
104KB

MD5
94602804a99dca871f93226f5b96ea72

SHA1
64337e2b7b7774d49063797b68804146481d641d

SHA256
ccb9e20dd6659f49a7e79337849608b121ca1a52f96a1f9420c9eccf9d66acb2

SHA512
c97648551f3c32c723c524c5ccbf7907c664aaa4cadf8dad8de538544a3690aea7b0182452dab59171b3e44dbb125252279314d97c965a36d4d5d10e3870722b

Download Submit
\Users\Admin\AppData\Local\Temp\dsdbla.exe
Filesize
104KB

MD5
94602804a99dca871f93226f5b96ea72

SHA1
64337e2b7b7774d49063797b68804146481d641d

SHA256
ccb9e20dd6659f49a7e79337849608b121ca1a52f96a1f9420c9eccf9d66acb2

SHA512
c97648551f3c32c723c524c5ccbf7907c664aaa4cadf8dad8de538544a3690aea7b0182452dab59171b3e44dbb125252279314d97c965a36d4d5d10e3870722b

Download Submit
memory/580-54-0x0000000076D71000-0x0000000076D73000-memory.dmp

Filesize
8KB

Download
memory/756-56-0x0000000000000000-mapping.dmp

Download
memory/1184-78-0x0000000000000000-mapping.dmp

Download
memory/1280-73-0x0000000004720000-0x0000000004844000-memory.dmp

Filesize
1.1MB

Download
memory/1280-70-0x0000000004720000-0x0000000004844000-memory.dmp

Filesize
1.1MB

Download
memory/1280-81-0x0000000007BA0000-0x0000000007CDC000-memory.dmp

Filesize
1.2MB

Download
memory/1280-68-0x0000000006F80000-0x00000000070D1000-memory.dmp

Filesize
1.3MB

Download
memory/1280-80-0x0000000007BA0000-0x0000000007CDC000-memory.dmp

Filesize
1.2MB

Download
memory/1356-75-0x00000000001F0000-0x000000000020F000-memory.dmp

Filesize
124KB

Download
memory/1356-72-0x0000000000000000-mapping.dmp

Download
memory/1356-76-0x00000000000C0000-0x00000000000EF000-memory.dmp

Filesize
188KB

Download
memory/1356-77-0x0000000001FF0000-0x00000000022F3000-memory.dmp

Filesize
3.0MB

Download
memory/1356-79-0x00000000005B0000-0x0000000000643000-memory.dmp

Filesize
588KB

Download
memory/1900-71-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1900-65-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1900-66-0x0000000000820000-0x0000000000B23000-memory.dmp

Filesize
3.0MB

Download
memory/1900-63-0x000000000041F170-mapping.dmp

Download
memory/1900-69-0x00000000003A0000-0x00000000003B4000-memory.dmp

Filesize
80KB

Download
memory/1900-67-0x00000000002E0000-0x00000000002F4000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads