formbook | 7a0e92402659c86d9da6faf33be3817996718051ea564e34aa43a41606df7be6

General

Target

6bd52c8274a35c39740da9b52b4c7ef0.exe
Size

321KB
MD5

6bd52c8274a35c39740da9b52b4c7ef0
SHA1

0754724c922472de6048b5c5595f520f2b93e46e
SHA256

7a0e92402659c86d9da6faf33be3817996718051ea564e34aa43a41606df7be6
SHA512

24e3e05f7db606d1305fab3ab2cb8619cbec90afb81b1a2fafd528581fa04a04c9c3279f0cf6955f8a2e0114acfc70e29be1d10e426b1804c2b4bcb5123c52c7
SSDEEP

6144:9kwv4ysH1jEdoS3dMxsCfld0k1STCESE6pkOgyIuSqYXAHrHa2fI+CUO:jslEliffld0PUkOguSBAHu2W

Score

10^/10

formbook lt63 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

lt63

Decoy

fortrantelecom.africa

ffafa.buzz

bullybrain.com

ekeisolutions.com

lamiamira.com

noahsark.xyz

beautyby-eve.com

cloudfatory.com

12443.football

hataykultur.online

donqu3.sexy

breakthroughaustralia.com

havengpe.com

cpxlocatup.info

corefourpartners.com

amonefintech.com

thithombo.africa

bassmaty.store

fdshdsr.top

lifesoapsimple.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3172-139-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/3172-144-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/4908-147-0x0000000000950000-0x000000000097F000-memory.dmp	formbook
behavioral2/memory/4908-151-0x0000000000950000-0x000000000097F000-memory.dmp	formbook

Executes dropped EXE 2 IoCs

Processes:

ovwid.exeovwid.exe

pid process

1720 ovwid.exe
3172 ovwid.exe

pid	process
1720	ovwid.exe
3172	ovwid.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

ovwid.exeovwid.exeipconfig.exe

description	pid	process	target process
PID 1720 set thread context of 3172	1720	ovwid.exe	ovwid.exe
PID 3172 set thread context of 2684	3172	ovwid.exe	Explorer.EXE
PID 4908 set thread context of 2684	4908	ipconfig.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command-Line Interface
T1059

Processes:

ipconfig.exe

pid process

4908 ipconfig.exe

pid	process
4908	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 60 IoCs

Processes:

ovwid.exeipconfig.exe

pid	process
3172	ovwid.exe
3172	ovwid.exe
3172	ovwid.exe
3172	ovwid.exe
4908	ipconfig.exe
4908	ipconfig.exe
4908	ipconfig.exe
4908	ipconfig.exe
4908	ipconfig.exe
4908	ipconfig.exe
4908	ipconfig.exe
4908	ipconfig.exe
4908	ipconfig.exe
4908	ipconfig.exe
4908	ipconfig.exe
4908	ipconfig.exe
4908	ipconfig.exe
4908	ipconfig.exe
4908	ipconfig.exe
4908	ipconfig.exe
4908	ipconfig.exe
4908	ipconfig.exe
4908	ipconfig.exe
4908	ipconfig.exe
4908	ipconfig.exe
4908	ipconfig.exe
4908	ipconfig.exe
4908	ipconfig.exe
4908	ipconfig.exe
4908	ipconfig.exe
4908	ipconfig.exe
4908	ipconfig.exe
4908	ipconfig.exe
4908	ipconfig.exe
4908	ipconfig.exe
4908	ipconfig.exe
4908	ipconfig.exe
4908	ipconfig.exe
4908	ipconfig.exe
4908	ipconfig.exe
4908	ipconfig.exe
4908	ipconfig.exe
4908	ipconfig.exe
4908	ipconfig.exe
4908	ipconfig.exe
4908	ipconfig.exe
4908	ipconfig.exe
4908	ipconfig.exe
4908	ipconfig.exe
4908	ipconfig.exe
4908	ipconfig.exe
4908	ipconfig.exe
4908	ipconfig.exe
4908	ipconfig.exe
4908	ipconfig.exe
4908	ipconfig.exe
4908	ipconfig.exe
4908	ipconfig.exe
4908	ipconfig.exe
4908	ipconfig.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

2684 Explorer.EXE
Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

ovwid.exeovwid.exeipconfig.exe

pid process

1720 ovwid.exe
3172 ovwid.exe
3172 ovwid.exe
3172 ovwid.exe
4908 ipconfig.exe
4908 ipconfig.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

ovwid.exeipconfig.exe

description pid process

Token: SeDebugPrivilege 3172 ovwid.exe
Token: SeDebugPrivilege 4908 ipconfig.exe

pid	process
2684	Explorer.EXE

pid	process
1720	ovwid.exe
3172	ovwid.exe
3172	ovwid.exe
3172	ovwid.exe
4908	ipconfig.exe
4908	ipconfig.exe

description	pid	process
Token: SeDebugPrivilege	3172	ovwid.exe
Token: SeDebugPrivilege	4908	ipconfig.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

6bd52c8274a35c39740da9b52b4c7ef0.exeovwid.exeExplorer.EXEipconfig.exe

description	pid	process	target process
PID 4072 wrote to memory of 1720	4072	6bd52c8274a35c39740da9b52b4c7ef0.exe	ovwid.exe
PID 4072 wrote to memory of 1720	4072	6bd52c8274a35c39740da9b52b4c7ef0.exe	ovwid.exe
PID 4072 wrote to memory of 1720	4072	6bd52c8274a35c39740da9b52b4c7ef0.exe	ovwid.exe
PID 1720 wrote to memory of 3172	1720	ovwid.exe	ovwid.exe
PID 1720 wrote to memory of 3172	1720	ovwid.exe	ovwid.exe
PID 1720 wrote to memory of 3172	1720	ovwid.exe	ovwid.exe
PID 1720 wrote to memory of 3172	1720	ovwid.exe	ovwid.exe
PID 2684 wrote to memory of 4908	2684	Explorer.EXE	ipconfig.exe
PID 2684 wrote to memory of 4908	2684	Explorer.EXE	ipconfig.exe
PID 2684 wrote to memory of 4908	2684	Explorer.EXE	ipconfig.exe
PID 4908 wrote to memory of 4160	4908	ipconfig.exe	cmd.exe
PID 4908 wrote to memory of 4160	4908	ipconfig.exe	cmd.exe
PID 4908 wrote to memory of 4160	4908	ipconfig.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2684

C:\Users\Admin\AppData\Local\Temp\6bd52c8274a35c39740da9b52b4c7ef0.exe
"C:\Users\Admin\AppData\Local\Temp\6bd52c8274a35c39740da9b52b4c7ef0.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:4072

C:\Users\Admin\AppData\Local\Temp\ovwid.exe
"C:\Users\Admin\AppData\Local\Temp\ovwid.exe" C:\Users\Admin\AppData\Local\Temp\rrsopjtftd.p
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1720

C:\Users\Admin\AppData\Local\Temp\ovwid.exe
"C:\Users\Admin\AppData\Local\Temp\ovwid.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3172

C:\Windows\SysWOW64\ipconfig.exe
"C:\Windows\SysWOW64\ipconfig.exe"
2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4908

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\ovwid.exe"
3⤵
PID:4160

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cqdkrcshwhw.w
Filesize
185KB

MD5
7e02dcac3d442f6e3a36de2b65661c8a

SHA1
5057ac4eff50e36d8c1a767b8f35accf7db4a5ee

SHA256
846b04da46b952747476b98c2cb6071faedc8d5ef0ca7f7a320b92fa299248fd

SHA512
f6976c1060780888f7f1dfb31edba6f89d8096134cd693ef9fb1ebb97fb06d42fd5a437d4da6d7bddb354d17f72e661f8140310dd8837468bdf59a648a81f32c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ovwid.exe
Filesize
276KB

MD5
a5cc35863cadeb24f827d9daa513c424

SHA1
0584250d8f5b06a11afbd3071547c6719adf02a4

SHA256
46590fb8724e192cff8f18ccf4188f9cb2bd8661cbc1141cc15623775ad46a5c

SHA512
32761ac38ab4c9b9f99bd767476b35fdecff67af8dcd678b6c449a4cebfe0c1bb040b5b8d31ba046566d2a612865709088494d90d4825ec7e8353e37ac0a7098

Download Submit
C:\Users\Admin\AppData\Local\Temp\ovwid.exe
Filesize
276KB

MD5
a5cc35863cadeb24f827d9daa513c424

SHA1
0584250d8f5b06a11afbd3071547c6719adf02a4

SHA256
46590fb8724e192cff8f18ccf4188f9cb2bd8661cbc1141cc15623775ad46a5c

SHA512
32761ac38ab4c9b9f99bd767476b35fdecff67af8dcd678b6c449a4cebfe0c1bb040b5b8d31ba046566d2a612865709088494d90d4825ec7e8353e37ac0a7098

Download Submit
C:\Users\Admin\AppData\Local\Temp\ovwid.exe
Filesize
276KB

MD5
a5cc35863cadeb24f827d9daa513c424

SHA1
0584250d8f5b06a11afbd3071547c6719adf02a4

SHA256
46590fb8724e192cff8f18ccf4188f9cb2bd8661cbc1141cc15623775ad46a5c

SHA512
32761ac38ab4c9b9f99bd767476b35fdecff67af8dcd678b6c449a4cebfe0c1bb040b5b8d31ba046566d2a612865709088494d90d4825ec7e8353e37ac0a7098

Download Submit
C:\Users\Admin\AppData\Local\Temp\rrsopjtftd.p
Filesize
5KB

MD5
56286c4878d09104d3b70a79a461c288

SHA1
0454937ba6a485ef7893e0a37cb576e3b31c55e6

SHA256
2f34ec04e1cefc4bb24065ebaacf3e607c86a9f65976d098356735b546b7c029

SHA512
61944319fb9f54f948bf5e27dc3db5dfa50319a2e5ce4061490370e78b8e07796f02f153ca8ef6a72b43bef6fdcfb77940b7c175d068f2705619f29c8fd74ec1

Download Submit
memory/1720-132-0x0000000000000000-mapping.dmp

Download
memory/2684-142-0x0000000002510000-0x00000000025EB000-memory.dmp

Filesize
876KB

Download
memory/2684-152-0x00000000077C0000-0x00000000078ED000-memory.dmp

Filesize
1.2MB

Download
memory/2684-150-0x00000000077C0000-0x00000000078ED000-memory.dmp

Filesize
1.2MB

Download
memory/3172-137-0x0000000000000000-mapping.dmp

Download
memory/3172-141-0x00000000005D0000-0x00000000005E4000-memory.dmp

Filesize
80KB

Download
memory/3172-144-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3172-140-0x0000000000B30000-0x0000000000E7A000-memory.dmp

Filesize
3.3MB

Download
memory/3172-139-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4160-145-0x0000000000000000-mapping.dmp

Download
memory/4908-143-0x0000000000000000-mapping.dmp

Download
memory/4908-146-0x00000000009C0000-0x00000000009CB000-memory.dmp

Filesize
44KB

Download
memory/4908-147-0x0000000000950000-0x000000000097F000-memory.dmp

Filesize
188KB

Download
memory/4908-148-0x00000000013A0000-0x00000000016EA000-memory.dmp

Filesize
3.3MB

Download
memory/4908-149-0x00000000010D0000-0x0000000001163000-memory.dmp

Filesize
588KB

Download
memory/4908-151-0x0000000000950000-0x000000000097F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads