formbook | 6ff54e94c6557ae213d67159c8c8bbdc84079801ba263631f9c7a798f660eaad

General

Target

PaymentCopy121922.exe
Size

733KB
MD5

05271d119938959aad2d32404ef0d9cf
SHA1

1409bf13515044a066e694493182b7405ea6efaa
SHA256

6ff54e94c6557ae213d67159c8c8bbdc84079801ba263631f9c7a798f660eaad
SHA512

e313a4313611c66104563cc3dde78dd9869a5b5070082b3d859bdb96b493fdc2fdbab4014baa3ecc7196b3d44c6842f2f1f5b943e119ac316872bbaed911ec15
SSDEEP

12288:5xx2cHss/S+PsN2/fFac/uL9eEhkAEZC4Gf3acHVNc42xtAq:rx2cHs6SqHdaOuBEZC4u37Vm42nAq

Score

10^/10

formbook snky rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

snky

Decoy

AiMFvkl6+A4HEgZ99q5x4naN7lGmvJo=

tvj/KUTKeKgxszIemQ==

DTrTokBrjB5leF4=

tPeTOuIjJPtH

taxtMdIygEdpskxzOQ2ZjoAEeA==

CxLuaKAFRrJyuIqQUPbhZw==

Tn4fapT5kPmk1H0gpXQ=

h5p8hDqGSiRzdSbV

i3lg8tbRNRU6jC9pQSOxzHYZgpbnOKBx

EwbfBo6m+UXU2qaVUPbhZw==

WpeenFSMquJ3xXD1/b43

niV5qTFu3tfmcgrI

fqyyyElbdxWswJ7A

Lh7o92ZOr4ghbwvK

Y2RYMDue4x+KszIemQ==

lN3Y3z5AS85eah1MDvfFQQA=

uq+Oqh8MNRxHOOkqA9lqYEZZhJU=

FEtGDeGnnRoSQEM=

TkMlruotvsmtpFwg6shr03LjwMWGow==

7PGx8hNMep8EMj5Q39dsq16IbbaIrA==

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

PaymentCopy121922.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	PaymentCopy121922.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

PaymentCopy121922.exePaymentCopy121922.exemsdt.exe

description	pid	process	target process
PID 4788 set thread context of 376	4788	PaymentCopy121922.exe	PaymentCopy121922.exe
PID 376 set thread context of 2640	376	PaymentCopy121922.exe	Explorer.EXE
PID 1888 set thread context of 2640	1888	msdt.exe	Explorer.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

msdt.exe

description	ioc	process
Key created	\Registry\User\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	msdt.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

Processes:

PaymentCopy121922.exePaymentCopy121922.exemsdt.exe

pid	process
4788	PaymentCopy121922.exe
4788	PaymentCopy121922.exe
376	PaymentCopy121922.exe
376	PaymentCopy121922.exe
376	PaymentCopy121922.exe
376	PaymentCopy121922.exe
376	PaymentCopy121922.exe
376	PaymentCopy121922.exe
376	PaymentCopy121922.exe
376	PaymentCopy121922.exe
1888	msdt.exe
1888	msdt.exe
1888	msdt.exe
1888	msdt.exe
1888	msdt.exe
1888	msdt.exe
1888	msdt.exe
1888	msdt.exe
1888	msdt.exe
1888	msdt.exe
1888	msdt.exe
1888	msdt.exe
1888	msdt.exe
1888	msdt.exe
1888	msdt.exe
1888	msdt.exe
1888	msdt.exe
1888	msdt.exe
1888	msdt.exe
1888	msdt.exe
1888	msdt.exe
1888	msdt.exe
1888	msdt.exe
1888	msdt.exe
1888	msdt.exe
1888	msdt.exe
1888	msdt.exe
1888	msdt.exe
1888	msdt.exe
1888	msdt.exe
1888	msdt.exe
1888	msdt.exe
1888	msdt.exe
1888	msdt.exe
1888	msdt.exe
1888	msdt.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

2640 Explorer.EXE
Suspicious behavior: MapViewOfSection 7 IoCs

Processes:

PaymentCopy121922.exemsdt.exe

pid process

376 PaymentCopy121922.exe
376 PaymentCopy121922.exe
376 PaymentCopy121922.exe
1888 msdt.exe
1888 msdt.exe
1888 msdt.exe
1888 msdt.exe

pid	process
2640	Explorer.EXE

pid	process
376	PaymentCopy121922.exe
376	PaymentCopy121922.exe
376	PaymentCopy121922.exe
1888	msdt.exe
1888	msdt.exe
1888	msdt.exe
1888	msdt.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

PaymentCopy121922.exePaymentCopy121922.exemsdt.exe

description	pid	process
Token: SeDebugPrivilege	4788	PaymentCopy121922.exe
Token: SeDebugPrivilege	376	PaymentCopy121922.exe
Token: SeDebugPrivilege	1888	msdt.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

PaymentCopy121922.exeExplorer.EXEmsdt.exe

description	pid	process	target process
PID 4788 wrote to memory of 3608	4788	PaymentCopy121922.exe	PaymentCopy121922.exe
PID 4788 wrote to memory of 3608	4788	PaymentCopy121922.exe	PaymentCopy121922.exe
PID 4788 wrote to memory of 3608	4788	PaymentCopy121922.exe	PaymentCopy121922.exe
PID 4788 wrote to memory of 376	4788	PaymentCopy121922.exe	PaymentCopy121922.exe
PID 4788 wrote to memory of 376	4788	PaymentCopy121922.exe	PaymentCopy121922.exe
PID 4788 wrote to memory of 376	4788	PaymentCopy121922.exe	PaymentCopy121922.exe
PID 4788 wrote to memory of 376	4788	PaymentCopy121922.exe	PaymentCopy121922.exe
PID 4788 wrote to memory of 376	4788	PaymentCopy121922.exe	PaymentCopy121922.exe
PID 4788 wrote to memory of 376	4788	PaymentCopy121922.exe	PaymentCopy121922.exe
PID 2640 wrote to memory of 1888	2640	Explorer.EXE	msdt.exe
PID 2640 wrote to memory of 1888	2640	Explorer.EXE	msdt.exe
PID 2640 wrote to memory of 1888	2640	Explorer.EXE	msdt.exe
PID 1888 wrote to memory of 4408	1888	msdt.exe	Firefox.exe
PID 1888 wrote to memory of 4408	1888	msdt.exe	Firefox.exe
PID 1888 wrote to memory of 4408	1888	msdt.exe	Firefox.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2640

C:\Users\Admin\AppData\Local\Temp\PaymentCopy121922.exe
"C:\Users\Admin\AppData\Local\Temp\PaymentCopy121922.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4788

C:\Users\Admin\AppData\Local\Temp\PaymentCopy121922.exe
"C:\Users\Admin\AppData\Local\Temp\PaymentCopy121922.exe"
3⤵
PID:3608

C:\Users\Admin\AppData\Local\Temp\PaymentCopy121922.exe
"C:\Users\Admin\AppData\Local\Temp\PaymentCopy121922.exe"
3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:376

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:2056

C:\Windows\SysWOW64\msdt.exe
"C:\Windows\SysWOW64\msdt.exe"
2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1888

C:\Program Files\Mozilla Firefox\Firefox.exe
"C:\Program Files\Mozilla Firefox\Firefox.exe"
3⤵
PID:4408

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/376-145-0x0000000000422000-0x0000000000424000-memory.dmp

Filesize
8KB

Download
memory/376-141-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/376-143-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/376-144-0x0000000001820000-0x0000000001B6A000-memory.dmp

Filesize
3.3MB

Download
memory/376-146-0x0000000001370000-0x0000000001380000-memory.dmp

Filesize
64KB

Download
memory/376-142-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/376-138-0x0000000000000000-mapping.dmp

Download
memory/376-139-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1888-150-0x0000000000E90000-0x0000000000EBD000-memory.dmp

Filesize
180KB

Download
memory/1888-151-0x0000000003000000-0x000000000334A000-memory.dmp

Filesize
3.3MB

Download
memory/1888-155-0x0000000000E90000-0x0000000000EBD000-memory.dmp

Filesize
180KB

Download
memory/1888-153-0x0000000002DE0000-0x0000000002E6F000-memory.dmp

Filesize
572KB

Download
memory/1888-149-0x0000000000B90000-0x0000000000BE7000-memory.dmp

Filesize
348KB

Download
memory/1888-148-0x0000000000000000-mapping.dmp

Download
memory/2640-147-0x0000000008680000-0x00000000087A4000-memory.dmp

Filesize
1.1MB

Download
memory/2640-152-0x0000000008680000-0x00000000087A4000-memory.dmp

Filesize
1.1MB

Download
memory/2640-154-0x0000000008D20000-0x0000000008E53000-memory.dmp

Filesize
1.2MB

Download
memory/2640-156-0x0000000008D20000-0x0000000008E53000-memory.dmp

Filesize
1.2MB

Download
memory/3608-137-0x0000000000000000-mapping.dmp

Download
memory/4788-132-0x00000000007F0000-0x00000000008AE000-memory.dmp

Filesize
760KB

Download
memory/4788-133-0x00000000058D0000-0x0000000005E74000-memory.dmp

Filesize
5.6MB

Download
memory/4788-136-0x0000000008E70000-0x0000000008F0C000-memory.dmp

Filesize
624KB

Download
memory/4788-135-0x00000000053D0000-0x00000000053DA000-memory.dmp

Filesize
40KB

Download
memory/4788-134-0x0000000005320000-0x00000000053B2000-memory.dmp

Filesize
584KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads