formbook | 21e08bb00bf5a84ec339e16296437ef3f5fc98b93d62da5a2e26bebbb2eb5861

General

Target

SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe
Size

947KB
MD5

fa16f4fdb2d9ad31bbb18a35ed5aa8e8
SHA1

9cbe9ad8ae95765033c303abe150cec63642c32a
SHA256

21e08bb00bf5a84ec339e16296437ef3f5fc98b93d62da5a2e26bebbb2eb5861
SHA512

06a71d2636af52bc63524cace2066f5e5287d4d68fbb5f7db6f965d6cddbc9b0d92340f8a1e938d2b11acb5eeeff2e5abd15b9e7ab15cb489df351936a74f943
SSDEEP

12288:k2lmLFCXGPtdUA7pY+ZmBjHUk+qTBcrovP4uo7T2TwmiaY+A7e6u6Z/knOY9y5NI:1YCWl9FhZmBHQronA7TwioA7cO9Lgx

Score

10^/10

formbook f9r5 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

f9r5

Decoy

teknotimur.com

zuliboo.com

remmingtoncampbell.com

vehicletitleloansphoenix.com

sen-computer.com

98731.biz

shelikesblu.com

canis-totem.com

metaversemedianetwork.com

adsdu.com

vanishmediasystems.com

astewaykebede.com

wszhongxue.com

gacha-animator-free.com

papatyadekorasyon.com

mqc168.top

simplebrilliantsolutions.com

jubileehawkesprairie.com

ridflab.com

conboysfilm.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/864-69-0x000000000041F150-mapping.dmp	formbook
behavioral1/memory/864-68-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe

description	pid	process	target process
PID 1364 set thread context of 864	1364	SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe	SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1256 schtasks.exe

pid	process
1256	schtasks.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exepowershell.exeSecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe

pid	process
1364	SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe
1364	SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe
1364	SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe
1364	SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe
1364	SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe
1364	SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe
1364	SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe
1364	SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe
1364	SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe
576	powershell.exe
864	SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1364 SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe
Token: SeDebugPrivilege 576 powershell.exe

description	pid	process
Token: SeDebugPrivilege	1364	SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe
Token: SeDebugPrivilege	576	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe

description	pid	process	target process
PID 1364 wrote to memory of 576	1364	SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe	powershell.exe
PID 1364 wrote to memory of 576	1364	SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe	powershell.exe
PID 1364 wrote to memory of 576	1364	SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe	powershell.exe
PID 1364 wrote to memory of 576	1364	SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe	powershell.exe
PID 1364 wrote to memory of 1256	1364	SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe	schtasks.exe
PID 1364 wrote to memory of 1256	1364	SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe	schtasks.exe
PID 1364 wrote to memory of 1256	1364	SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe	schtasks.exe
PID 1364 wrote to memory of 1256	1364	SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe	schtasks.exe
PID 1364 wrote to memory of 864	1364	SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe	SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe
PID 1364 wrote to memory of 864	1364	SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe	SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe
PID 1364 wrote to memory of 864	1364	SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe	SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe
PID 1364 wrote to memory of 864	1364	SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe	SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe
PID 1364 wrote to memory of 864	1364	SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe	SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe
PID 1364 wrote to memory of 864	1364	SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe	SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe
PID 1364 wrote to memory of 864	1364	SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe	SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1364

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\JhJajGFqWxtP.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:576

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JhJajGFqWxtP" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9C50.tmp"
2⤵
- Creates scheduled task(s)
PID:1256

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:864

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp9C50.tmp
Filesize
1KB

MD5
7383c46e4528b8ffa8ac28455e7a3b2e

SHA1
f2db05c96661637c05242c0216ea1aa21bc4b8fe

SHA256
b943227526829690357cf6b02a7464bdac10df7c6f577f7d5b16fa63192a487c

SHA512
edb52b737145f68385fcb84f83b20745d1f3d3a4085c89c2474b166ed63e7b73e1211a82be367974350722bcaab1b66f23e91ba3fbaf54a0fb3785669a86de5e

Download Submit
memory/576-59-0x0000000000000000-mapping.dmp

Download
memory/576-71-0x000000006EE20000-0x000000006F3CB000-memory.dmp

Filesize
5.7MB

Download
memory/576-63-0x000000006EE20000-0x000000006F3CB000-memory.dmp

Filesize
5.7MB

Download
memory/864-69-0x000000000041F150-mapping.dmp

Download
memory/864-65-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/864-66-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/864-68-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/864-70-0x0000000000910000-0x0000000000C13000-memory.dmp

Filesize
3.0MB

Download
memory/1256-60-0x0000000000000000-mapping.dmp

Download
memory/1364-58-0x0000000004FE0000-0x0000000005050000-memory.dmp

Filesize
448KB

Download
memory/1364-57-0x0000000000700000-0x000000000070E000-memory.dmp

Filesize
56KB

Download
memory/1364-56-0x0000000000530000-0x0000000000552000-memory.dmp

Filesize
136KB

Download
memory/1364-64-0x0000000004C30000-0x0000000004C64000-memory.dmp

Filesize
208KB

Download
memory/1364-54-0x0000000001250000-0x0000000001342000-memory.dmp

Filesize
968KB

Download
memory/1364-55-0x0000000076651000-0x0000000076653000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads