formbook | 44bf46793f182055af9af6112cfd1236073c6ab0c879d0cffb49154e5c1c85dd

General

Target

tmp.exe
Size

236KB
MD5

aabb09c3690d466afdfbbaeb791a8bc8
SHA1

128095dc05c3bdc4c00966f6c11ac79117f44833
SHA256

44bf46793f182055af9af6112cfd1236073c6ab0c879d0cffb49154e5c1c85dd
SHA512

b63268fa65e1346cfb31c0a0e2fc744c7f62a3b49bf287906562b4fb97f7190798132655ad7d2062c203d28d366cf5f273624b7abeb4446e150aae1f30dcdb65
SSDEEP

6144:FkwvQpUiezSv/iMQYDfyZepKpDLd8vG3be2x:EpReuiojyZTLd8Grfx

Score

10^/10

formbook 8rmt rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

8rmt

Decoy

3472cc.com

takecareyourhair.com

kontolajigasd21.xyz

daihaitrinh.net

syncmostlatestinfo-file.info

lovesolutionsastrologist.info

angelapryan.com

rio727casino.com

jjsgagets.com

devyatkina.online

thegoldenbeautyqatar.com

czytaj-unas24live.monster

timepoachers.com

gayxxxporn.site

72308.xyz

kristanolivo.com

hijrahfwd.com

bmfighters.com

alfamx.website

handfulofbabesbows.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2016-66-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1288-74-0x0000000000080000-0x00000000000AF000-memory.dmp	formbook
behavioral1/memory/1288-78-0x0000000000080000-0x00000000000AF000-memory.dmp	formbook

Executes dropped EXE 2 IoCs

Processes:

vjvzoxsg.exevjvzoxsg.exe

pid process

1388 vjvzoxsg.exe
2016 vjvzoxsg.exe
Loads dropped DLL 3 IoCs

Processes:

tmp.exevjvzoxsg.exe

pid process

704 tmp.exe
704 tmp.exe
1388 vjvzoxsg.exe

pid	process
1388	vjvzoxsg.exe
2016	vjvzoxsg.exe

pid	process
704	tmp.exe
704	tmp.exe
1388	vjvzoxsg.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

vjvzoxsg.exevjvzoxsg.execontrol.exe

description	pid	process	target process
PID 1388 set thread context of 2016	1388	vjvzoxsg.exe	vjvzoxsg.exe
PID 2016 set thread context of 1236	2016	vjvzoxsg.exe	Explorer.EXE
PID 1288 set thread context of 1236	1288	control.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 27 IoCs

Processes:

vjvzoxsg.execontrol.exe

pid	process
2016	vjvzoxsg.exe
2016	vjvzoxsg.exe
1288	control.exe
1288	control.exe
1288	control.exe
1288	control.exe
1288	control.exe
1288	control.exe
1288	control.exe
1288	control.exe
1288	control.exe
1288	control.exe
1288	control.exe
1288	control.exe
1288	control.exe
1288	control.exe
1288	control.exe
1288	control.exe
1288	control.exe
1288	control.exe
1288	control.exe
1288	control.exe
1288	control.exe
1288	control.exe
1288	control.exe
1288	control.exe
1288	control.exe

Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

vjvzoxsg.exevjvzoxsg.execontrol.exe

pid process

1388 vjvzoxsg.exe
2016 vjvzoxsg.exe
2016 vjvzoxsg.exe
2016 vjvzoxsg.exe
1288 control.exe
1288 control.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

vjvzoxsg.execontrol.exe

description pid process

Token: SeDebugPrivilege 2016 vjvzoxsg.exe
Token: SeDebugPrivilege 1288 control.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1236 Explorer.EXE
1236 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1236 Explorer.EXE
1236 Explorer.EXE

pid	process
1388	vjvzoxsg.exe
2016	vjvzoxsg.exe
2016	vjvzoxsg.exe
2016	vjvzoxsg.exe
1288	control.exe
1288	control.exe

description	pid	process
Token: SeDebugPrivilege	2016	vjvzoxsg.exe
Token: SeDebugPrivilege	1288	control.exe

pid	process
1236	Explorer.EXE
1236	Explorer.EXE

pid	process
1236	Explorer.EXE
1236	Explorer.EXE

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

tmp.exevjvzoxsg.exeExplorer.EXEcontrol.exe

description	pid	process	target process
PID 704 wrote to memory of 1388	704	tmp.exe	vjvzoxsg.exe
PID 704 wrote to memory of 1388	704	tmp.exe	vjvzoxsg.exe
PID 704 wrote to memory of 1388	704	tmp.exe	vjvzoxsg.exe
PID 704 wrote to memory of 1388	704	tmp.exe	vjvzoxsg.exe
PID 1388 wrote to memory of 2016	1388	vjvzoxsg.exe	vjvzoxsg.exe
PID 1388 wrote to memory of 2016	1388	vjvzoxsg.exe	vjvzoxsg.exe
PID 1388 wrote to memory of 2016	1388	vjvzoxsg.exe	vjvzoxsg.exe
PID 1388 wrote to memory of 2016	1388	vjvzoxsg.exe	vjvzoxsg.exe
PID 1388 wrote to memory of 2016	1388	vjvzoxsg.exe	vjvzoxsg.exe
PID 1236 wrote to memory of 1288	1236	Explorer.EXE	control.exe
PID 1236 wrote to memory of 1288	1236	Explorer.EXE	control.exe
PID 1236 wrote to memory of 1288	1236	Explorer.EXE	control.exe
PID 1236 wrote to memory of 1288	1236	Explorer.EXE	control.exe
PID 1288 wrote to memory of 848	1288	control.exe	cmd.exe
PID 1288 wrote to memory of 848	1288	control.exe	cmd.exe
PID 1288 wrote to memory of 848	1288	control.exe	cmd.exe
PID 1288 wrote to memory of 848	1288	control.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1236

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:704

C:\Users\Admin\AppData\Local\Temp\vjvzoxsg.exe
"C:\Users\Admin\AppData\Local\Temp\vjvzoxsg.exe" C:\Users\Admin\AppData\Local\Temp\ioqvjtots.c
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1388

C:\Users\Admin\AppData\Local\Temp\vjvzoxsg.exe
"C:\Users\Admin\AppData\Local\Temp\vjvzoxsg.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2016

C:\Windows\SysWOW64\control.exe
"C:\Windows\SysWOW64\control.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1288

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\vjvzoxsg.exe"
3⤵
PID:848

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ioqvjtots.c
Filesize
5KB

MD5
3612b09ae3c64e81b83ef5f6af3712e6

SHA1
80dc6d9b17366747cb67b26cb7af2b5a2d068e78

SHA256
e76185f142a0bd74bfc25375e7f75801ee034c869f25b76bd33c2ae26c742cde

SHA512
4027246362203082c0856b4b566faa59f27aca24f7194c11719742a2e966293fcebafe4a73fe20b59cf7edd4a06ec07285c9a1b1dfc12b301a7f3440ba58a28a

Download Submit
C:\Users\Admin\AppData\Local\Temp\ovsol.auj
Filesize
185KB

MD5
4bed31d67ac0b3e26b8955c8882cc6c4

SHA1
ae29b9efa1624441bf9f2ce39e42f9a718b4cfe1

SHA256
601c0322f0502262a56ff89baa34f10031a5633a36a516463c19f4ea7e329fc9

SHA512
7adde1571cd46c623181aaa184dc89e4cb6fc487452b7ff42e608af9fa43378fe7ce285841aec495664d1e9fe2cc0195ac80b2c1c0a286d193ba0f3d28a31ba9

Download Submit
C:\Users\Admin\AppData\Local\Temp\vjvzoxsg.exe
Filesize
65KB

MD5
b90829967c4bb4e9383db4bc97c700d7

SHA1
3a47c5fa95e23ba5dd019ce4f799e8c98c5f9202

SHA256
86103dfb9d1432ab1832858abccceab5fc11f54e7571e47ccd1ef1fc22fe003e

SHA512
70c6ca9bf7266dfe543e9be2cfb7157f06561f58838ab3a1bc9e965282613c2f5a91e1f5e1fbf4cf7b5d1a55d1b4bf91c455c89d69c471ed5b8c28c464a37fa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\vjvzoxsg.exe
Filesize
65KB

MD5
b90829967c4bb4e9383db4bc97c700d7

SHA1
3a47c5fa95e23ba5dd019ce4f799e8c98c5f9202

SHA256
86103dfb9d1432ab1832858abccceab5fc11f54e7571e47ccd1ef1fc22fe003e

SHA512
70c6ca9bf7266dfe543e9be2cfb7157f06561f58838ab3a1bc9e965282613c2f5a91e1f5e1fbf4cf7b5d1a55d1b4bf91c455c89d69c471ed5b8c28c464a37fa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\vjvzoxsg.exe
Filesize
65KB

MD5
b90829967c4bb4e9383db4bc97c700d7

SHA1
3a47c5fa95e23ba5dd019ce4f799e8c98c5f9202

SHA256
86103dfb9d1432ab1832858abccceab5fc11f54e7571e47ccd1ef1fc22fe003e

SHA512
70c6ca9bf7266dfe543e9be2cfb7157f06561f58838ab3a1bc9e965282613c2f5a91e1f5e1fbf4cf7b5d1a55d1b4bf91c455c89d69c471ed5b8c28c464a37fa5

Download Submit
\Users\Admin\AppData\Local\Temp\vjvzoxsg.exe
Filesize
65KB

MD5
b90829967c4bb4e9383db4bc97c700d7

SHA1
3a47c5fa95e23ba5dd019ce4f799e8c98c5f9202

SHA256
86103dfb9d1432ab1832858abccceab5fc11f54e7571e47ccd1ef1fc22fe003e

SHA512
70c6ca9bf7266dfe543e9be2cfb7157f06561f58838ab3a1bc9e965282613c2f5a91e1f5e1fbf4cf7b5d1a55d1b4bf91c455c89d69c471ed5b8c28c464a37fa5

Download Submit
\Users\Admin\AppData\Local\Temp\vjvzoxsg.exe
Filesize
65KB

MD5
b90829967c4bb4e9383db4bc97c700d7

SHA1
3a47c5fa95e23ba5dd019ce4f799e8c98c5f9202

SHA256
86103dfb9d1432ab1832858abccceab5fc11f54e7571e47ccd1ef1fc22fe003e

SHA512
70c6ca9bf7266dfe543e9be2cfb7157f06561f58838ab3a1bc9e965282613c2f5a91e1f5e1fbf4cf7b5d1a55d1b4bf91c455c89d69c471ed5b8c28c464a37fa5

Download Submit
\Users\Admin\AppData\Local\Temp\vjvzoxsg.exe
Filesize
65KB

MD5
b90829967c4bb4e9383db4bc97c700d7

SHA1
3a47c5fa95e23ba5dd019ce4f799e8c98c5f9202

SHA256
86103dfb9d1432ab1832858abccceab5fc11f54e7571e47ccd1ef1fc22fe003e

SHA512
70c6ca9bf7266dfe543e9be2cfb7157f06561f58838ab3a1bc9e965282613c2f5a91e1f5e1fbf4cf7b5d1a55d1b4bf91c455c89d69c471ed5b8c28c464a37fa5

Download Submit
memory/704-54-0x0000000074AD1000-0x0000000074AD3000-memory.dmp

Filesize
8KB

Download
memory/848-72-0x0000000000000000-mapping.dmp

Download
memory/1236-69-0x0000000004A10000-0x0000000004B74000-memory.dmp

Filesize
1.4MB

Download
memory/1236-79-0x0000000004C30000-0x0000000004D09000-memory.dmp

Filesize
868KB

Download
memory/1236-77-0x0000000004C30000-0x0000000004D09000-memory.dmp

Filesize
868KB

Download
memory/1288-74-0x0000000000080000-0x00000000000AF000-memory.dmp

Filesize
188KB

Download
memory/1288-70-0x0000000000000000-mapping.dmp

Download
memory/1288-73-0x00000000009B0000-0x00000000009CF000-memory.dmp

Filesize
124KB

Download
memory/1288-75-0x00000000020F0000-0x00000000023F3000-memory.dmp

Filesize
3.0MB

Download
memory/1288-76-0x0000000000510000-0x00000000005A4000-memory.dmp

Filesize
592KB

Download
memory/1288-78-0x0000000000080000-0x00000000000AF000-memory.dmp

Filesize
188KB

Download
memory/1388-57-0x0000000000000000-mapping.dmp

Download
memory/2016-68-0x00000000002B0000-0x00000000002C5000-memory.dmp

Filesize
84KB

Download
memory/2016-67-0x0000000000920000-0x0000000000C23000-memory.dmp

Filesize
3.0MB

Download
memory/2016-66-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2016-64-0x000000000041F080-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads