formbook | 63ec01839919b7f832954e17b9259a74fe90e0217f178dbd5f7661454af4c91f

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
04-01-2023 07:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b561c766f16984cad7bd9303131d69da7cae866a.exe
Size

445KB
MD5

7f86f5c4f81ec48b4b6bfc92b29ec751
SHA1

b561c766f16984cad7bd9303131d69da7cae866a
SHA256

63ec01839919b7f832954e17b9259a74fe90e0217f178dbd5f7661454af4c91f
SHA512

d040eb130075902d49536dca8b1abe4bc49ff6421884a793da73f956bf614806949b89ce602168bdc5a55af111871ee4120654f136914e4e63d2170557806cb3
SSDEEP

12288:3Y7shrtvJ4uNMIL/TJF/DaYVgl5NVx1fFHD02SJZ:3Yu1KA1I/FXngPZ

Score

10^/10

formbook vr84 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

vr84

Decoy

intouchenergy.co.uk

lalumalkaliram.com

hillgreenholidays.co.uk

fluentliteracy.com

buildingworkerpower.com

by23577.com

gate-ch375019.online

jayess-decor.com

larkslife.com

swsnacks.co.uk

bigturtletiny.com

egggge.xyz

olastore.africa

lightshowsnewengland.com

daily-lox.com

empireoba.com

91302events.com

lawrencecountyfirechiefs.com

abrahamslibrary.com

cleaner365.online

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 4 IoCs

rat

resource	yara_rule
behavioral2/memory/1124-139-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/1124-144-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/4548-148-0x0000000000E40000-0x0000000000E6F000-memory.dmp	formbook
behavioral2/memory/4548-149-0x0000000000E40000-0x0000000000E6F000-memory.dmp	formbook

Executes dropped EXE 2 IoCs

pid	Process
4856	tbelmde.exe
1124	tbelmde.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4856 set thread context of 1124	4856	tbelmde.exe	82
PID 1124 set thread context of 3048	1124	tbelmde.exe	39
PID 4548 set thread context of 3048	4548	cmmon32.exe	39

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 60 IoCs

pid	Process
1124	tbelmde.exe
1124	tbelmde.exe
1124	tbelmde.exe
1124	tbelmde.exe
4548	cmmon32.exe
4548	cmmon32.exe
4548	cmmon32.exe
4548	cmmon32.exe
4548	cmmon32.exe
4548	cmmon32.exe
4548	cmmon32.exe
4548	cmmon32.exe
4548	cmmon32.exe
4548	cmmon32.exe
4548	cmmon32.exe
4548	cmmon32.exe
4548	cmmon32.exe
4548	cmmon32.exe
4548	cmmon32.exe
4548	cmmon32.exe
4548	cmmon32.exe
4548	cmmon32.exe
4548	cmmon32.exe
4548	cmmon32.exe
4548	cmmon32.exe
4548	cmmon32.exe
4548	cmmon32.exe
4548	cmmon32.exe
4548	cmmon32.exe
4548	cmmon32.exe
4548	cmmon32.exe
4548	cmmon32.exe
4548	cmmon32.exe
4548	cmmon32.exe
4548	cmmon32.exe
4548	cmmon32.exe
4548	cmmon32.exe
4548	cmmon32.exe
4548	cmmon32.exe
4548	cmmon32.exe
4548	cmmon32.exe
4548	cmmon32.exe
4548	cmmon32.exe
4548	cmmon32.exe
4548	cmmon32.exe
4548	cmmon32.exe
4548	cmmon32.exe
4548	cmmon32.exe
4548	cmmon32.exe
4548	cmmon32.exe
4548	cmmon32.exe
4548	cmmon32.exe
4548	cmmon32.exe
4548	cmmon32.exe
4548	cmmon32.exe
4548	cmmon32.exe
4548	cmmon32.exe
4548	cmmon32.exe
4548	cmmon32.exe
4548	cmmon32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3048	Explorer.EXE

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
4856	tbelmde.exe
1124	tbelmde.exe
1124	tbelmde.exe
1124	tbelmde.exe
4548	cmmon32.exe
4548	cmmon32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1124	tbelmde.exe
Token: SeDebugPrivilege	4548	cmmon32.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3564 wrote to memory of 4856	3564	b561c766f16984cad7bd9303131d69da7cae866a.exe	81
PID 3564 wrote to memory of 4856	3564	b561c766f16984cad7bd9303131d69da7cae866a.exe	81
PID 3564 wrote to memory of 4856	3564	b561c766f16984cad7bd9303131d69da7cae866a.exe	81
PID 4856 wrote to memory of 1124	4856	tbelmde.exe	82
PID 4856 wrote to memory of 1124	4856	tbelmde.exe	82
PID 4856 wrote to memory of 1124	4856	tbelmde.exe	82
PID 4856 wrote to memory of 1124	4856	tbelmde.exe	82
PID 3048 wrote to memory of 4548	3048	Explorer.EXE	83
PID 3048 wrote to memory of 4548	3048	Explorer.EXE	83
PID 3048 wrote to memory of 4548	3048	Explorer.EXE	83
PID 4548 wrote to memory of 4996	4548	cmmon32.exe	87
PID 4548 wrote to memory of 4996	4548	cmmon32.exe	87
PID 4548 wrote to memory of 4996	4548	cmmon32.exe	87

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Users\Admin\AppData\Local\Temp\b561c766f16984cad7bd9303131d69da7cae866a.exe
  "C:\Users\Admin\AppData\Local\Temp\b561c766f16984cad7bd9303131d69da7cae866a.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3564
- - C:\Users\Admin\AppData\Local\Temp\tbelmde.exe
    "C:\Users\Admin\AppData\Local\Temp\tbelmde.exe" C:\Users\Admin\AppData\Local\Temp\lxirk.jhb
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:4856
  - - C:\Users\Admin\AppData\Local\Temp\tbelmde.exe
      "C:\Users\Admin\AppData\Local\Temp\tbelmde.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:1124
- C:\Windows\SysWOW64\cmmon32.exe
  "C:\Windows\SysWOW64\cmmon32.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4548
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\tbelmde.exe"
    3⤵
    PID:4996

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\blqttgnqqaq.qo

Filesize
205KB

MD5
7e6daa507120f5d554a44c601bbfba58

SHA1
4018d5a2de62d2013a6c898828f8a74e814d5c1d

SHA256
ca29d66f49018a38a180092513e189a53577092219ff4c8d119b30055913cbe1

SHA512
896aaa9adaa33227e0abbac98aa43f4ae2c66d8efc41ba50d452ceea170508f6a049af6621e452eec3b215895cdb0e719c3c9afd34e257b77ff133e591aab1d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\lxirk.jhb

Filesize
5KB

MD5
7611d59c10c085fe2b6f33cb8bc797b9

SHA1
8e6a6c47f32c48d1892b664b734c324cd70e0fb0

SHA256
1391af011ebe5d6d3bbfd08ad339779d49b65f28260aef59bb4fb490b77c03ab

SHA512
2f59ffdc86c719e780b7f07102dd1f3ee53d20f9f1f5464c0ac94495a8da25ddefe94e97499ab7c0da1a5d6bcd71d549da2bfef3d4d85e5d132c6a38534dcf65

Download Submit
C:\Users\Admin\AppData\Local\Temp\tbelmde.exe

Filesize
12KB

MD5
2a653d1ff961008fca702200878c9bf1

SHA1
676dbca890fedf5e3fec6e8df688dbf0ef8436f2

SHA256
e1fc47c2cbfda644718c2e519fcc103b8cb43b11b878183648be966082485bba

SHA512
15b136b5561d3922113855a9caebe7b4b0813a4b7b28cc7cababa1f546bcb37217155273a7aa4d8ee0e4b54cf480383c4cd002dddf8f416de2e2a4b74ac697d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\tbelmde.exe

Filesize
12KB

MD5
2a653d1ff961008fca702200878c9bf1

SHA1
676dbca890fedf5e3fec6e8df688dbf0ef8436f2

SHA256
e1fc47c2cbfda644718c2e519fcc103b8cb43b11b878183648be966082485bba

SHA512
15b136b5561d3922113855a9caebe7b4b0813a4b7b28cc7cababa1f546bcb37217155273a7aa4d8ee0e4b54cf480383c4cd002dddf8f416de2e2a4b74ac697d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\tbelmde.exe

Filesize
12KB

MD5
2a653d1ff961008fca702200878c9bf1

SHA1
676dbca890fedf5e3fec6e8df688dbf0ef8436f2

SHA256
e1fc47c2cbfda644718c2e519fcc103b8cb43b11b878183648be966082485bba

SHA512
15b136b5561d3922113855a9caebe7b4b0813a4b7b28cc7cababa1f546bcb37217155273a7aa4d8ee0e4b54cf480383c4cd002dddf8f416de2e2a4b74ac697d8

Download Submit
memory/1124-144-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1124-139-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1124-140-0x0000000001130000-0x000000000147A000-memory.dmp

Filesize
3.3MB

Download
memory/1124-141-0x0000000000AE0000-0x0000000000AF5000-memory.dmp

Filesize
84KB

Download
memory/3048-142-0x00000000031D0000-0x00000000032DE000-memory.dmp

Filesize
1.1MB

Download
memory/3048-151-0x00000000084D0000-0x0000000008659000-memory.dmp

Filesize
1.5MB

Download
memory/3048-152-0x00000000084D0000-0x0000000008659000-memory.dmp

Filesize
1.5MB

Download
memory/4548-146-0x0000000000E30000-0x0000000000E3C000-memory.dmp

Filesize
48KB

Download
memory/4548-147-0x0000000003040000-0x000000000338A000-memory.dmp

Filesize
3.3MB

Download
memory/4548-148-0x0000000000E40000-0x0000000000E6F000-memory.dmp

Filesize
188KB

Download
memory/4548-149-0x0000000000E40000-0x0000000000E6F000-memory.dmp

Filesize
188KB

Download
memory/4548-150-0x0000000002D70000-0x0000000002E04000-memory.dmp

Filesize
592KB

Download