formbook | 4d6aed04de942b7577c3accd91e7b2e822f3e9ae3f44bb2c62d3f8332e7bb9bf

General

Target

4d6aed04de942b7577c3accd91e7b2e822f3e9ae3f44bb2c62d3f8332e7bb9bf.exe
Size

851KB
MD5

0d40d12e558369cb5f5181e15578a1fe
SHA1

4672ae6d49334d3bb80f1fc45816648241ae6cd2
SHA256

4d6aed04de942b7577c3accd91e7b2e822f3e9ae3f44bb2c62d3f8332e7bb9bf
SHA512

db11dd7ead7d19455aae9af803815d48a7e2ffe405e185a93340ed4c1d3eb1fcbd8a76100ab63a96e27cf5bf2b6e15daa1dafa7ae455358ec4fb62167b83c551
SSDEEP

12288:NdX2iNju3x2cHss/S+PPaHENNxExSYdKyjRa19UY085aNmqq:Nx1Vu3x2cHs6Sq++czdRjo5Fk

Score

10^/10

formbook d0a7 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

d0a7

Decoy

ngpjqd.top

provider1.net

themetaverseloyalties.com

tylpp.com

pmjewels.com

87napxxgz8x86a.com

djolobal.com

fmbmaiamelo.com

naijabam.online

networkingbits.com

beesweet.live

sexarab.homes

promptcompete.com

midsouthradio.com

23mk.top

bnhkit.xyz

2ozp56.bond

vehiclesgroups.com

healthycommunitynow.com

cwzmesr.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 5 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/380-142-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/380-162-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/380-166-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/3824-169-0x0000000000F50000-0x0000000000F7F000-memory.dmp	formbook
behavioral2/memory/3824-173-0x0000000000F50000-0x0000000000F7F000-memory.dmp	formbook

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

4d6aed04de942b7577c3accd91e7b2e822f3e9ae3f44bb2c62d3f8332e7bb9bf.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	4d6aed04de942b7577c3accd91e7b2e822f3e9ae3f44bb2c62d3f8332e7bb9bf.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

4d6aed04de942b7577c3accd91e7b2e822f3e9ae3f44bb2c62d3f8332e7bb9bf.exeRegSvcs.exemsdt.exe

description	pid	process	target process
PID 764 set thread context of 380	764	4d6aed04de942b7577c3accd91e7b2e822f3e9ae3f44bb2c62d3f8332e7bb9bf.exe	RegSvcs.exe
PID 380 set thread context of 2432	380	RegSvcs.exe	Explorer.EXE
PID 380 set thread context of 2432	380	RegSvcs.exe	Explorer.EXE
PID 3824 set thread context of 2432	3824	msdt.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4648 schtasks.exe

pid	process
4648	schtasks.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

Processes:

powershell.exeRegSvcs.exemsdt.exe

pid	process
4228	powershell.exe
380	RegSvcs.exe
380	RegSvcs.exe
4228	powershell.exe
380	RegSvcs.exe
380	RegSvcs.exe
380	RegSvcs.exe
380	RegSvcs.exe
3824	msdt.exe
3824	msdt.exe
3824	msdt.exe
3824	msdt.exe
3824	msdt.exe
3824	msdt.exe
3824	msdt.exe
3824	msdt.exe
3824	msdt.exe
3824	msdt.exe
3824	msdt.exe
3824	msdt.exe
3824	msdt.exe
3824	msdt.exe
3824	msdt.exe
3824	msdt.exe
3824	msdt.exe
3824	msdt.exe
3824	msdt.exe
3824	msdt.exe
3824	msdt.exe
3824	msdt.exe
3824	msdt.exe
3824	msdt.exe
3824	msdt.exe
3824	msdt.exe
3824	msdt.exe
3824	msdt.exe
3824	msdt.exe
3824	msdt.exe
3824	msdt.exe
3824	msdt.exe
3824	msdt.exe
3824	msdt.exe
3824	msdt.exe
3824	msdt.exe
3824	msdt.exe
3824	msdt.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

2432 Explorer.EXE
Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

RegSvcs.exemsdt.exe

pid process

380 RegSvcs.exe
380 RegSvcs.exe
380 RegSvcs.exe
380 RegSvcs.exe
3824 msdt.exe
3824 msdt.exe

pid	process
2432	Explorer.EXE

pid	process
380	RegSvcs.exe
380	RegSvcs.exe
380	RegSvcs.exe
380	RegSvcs.exe
3824	msdt.exe
3824	msdt.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

powershell.exeRegSvcs.exeExplorer.EXEmsdt.exe

description	pid	process
Token: SeDebugPrivilege	4228	powershell.exe
Token: SeDebugPrivilege	380	RegSvcs.exe
Token: SeShutdownPrivilege	2432	Explorer.EXE
Token: SeCreatePagefilePrivilege	2432	Explorer.EXE
Token: SeDebugPrivilege	3824	msdt.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

4d6aed04de942b7577c3accd91e7b2e822f3e9ae3f44bb2c62d3f8332e7bb9bf.exeExplorer.EXEmsdt.exe

description	pid	process	target process
PID 764 wrote to memory of 4228	764	4d6aed04de942b7577c3accd91e7b2e822f3e9ae3f44bb2c62d3f8332e7bb9bf.exe	powershell.exe
PID 764 wrote to memory of 4228	764	4d6aed04de942b7577c3accd91e7b2e822f3e9ae3f44bb2c62d3f8332e7bb9bf.exe	powershell.exe
PID 764 wrote to memory of 4228	764	4d6aed04de942b7577c3accd91e7b2e822f3e9ae3f44bb2c62d3f8332e7bb9bf.exe	powershell.exe
PID 764 wrote to memory of 4648	764	4d6aed04de942b7577c3accd91e7b2e822f3e9ae3f44bb2c62d3f8332e7bb9bf.exe	schtasks.exe
PID 764 wrote to memory of 4648	764	4d6aed04de942b7577c3accd91e7b2e822f3e9ae3f44bb2c62d3f8332e7bb9bf.exe	schtasks.exe
PID 764 wrote to memory of 4648	764	4d6aed04de942b7577c3accd91e7b2e822f3e9ae3f44bb2c62d3f8332e7bb9bf.exe	schtasks.exe
PID 764 wrote to memory of 380	764	4d6aed04de942b7577c3accd91e7b2e822f3e9ae3f44bb2c62d3f8332e7bb9bf.exe	RegSvcs.exe
PID 764 wrote to memory of 380	764	4d6aed04de942b7577c3accd91e7b2e822f3e9ae3f44bb2c62d3f8332e7bb9bf.exe	RegSvcs.exe
PID 764 wrote to memory of 380	764	4d6aed04de942b7577c3accd91e7b2e822f3e9ae3f44bb2c62d3f8332e7bb9bf.exe	RegSvcs.exe
PID 764 wrote to memory of 380	764	4d6aed04de942b7577c3accd91e7b2e822f3e9ae3f44bb2c62d3f8332e7bb9bf.exe	RegSvcs.exe
PID 764 wrote to memory of 380	764	4d6aed04de942b7577c3accd91e7b2e822f3e9ae3f44bb2c62d3f8332e7bb9bf.exe	RegSvcs.exe
PID 764 wrote to memory of 380	764	4d6aed04de942b7577c3accd91e7b2e822f3e9ae3f44bb2c62d3f8332e7bb9bf.exe	RegSvcs.exe
PID 2432 wrote to memory of 3824	2432	Explorer.EXE	msdt.exe
PID 2432 wrote to memory of 3824	2432	Explorer.EXE	msdt.exe
PID 2432 wrote to memory of 3824	2432	Explorer.EXE	msdt.exe
PID 3824 wrote to memory of 2260	3824	msdt.exe	cmd.exe
PID 3824 wrote to memory of 2260	3824	msdt.exe	cmd.exe
PID 3824 wrote to memory of 2260	3824	msdt.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2432

C:\Users\Admin\AppData\Local\Temp\4d6aed04de942b7577c3accd91e7b2e822f3e9ae3f44bb2c62d3f8332e7bb9bf.exe
"C:\Users\Admin\AppData\Local\Temp\4d6aed04de942b7577c3accd91e7b2e822f3e9ae3f44bb2c62d3f8332e7bb9bf.exe"
2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:764

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\dHBJRZCI.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4228

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dHBJRZCI" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2FE9.tmp"
3⤵
- Creates scheduled task(s)
PID:4648

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:380

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:396

C:\Windows\SysWOW64\msdt.exe
"C:\Windows\SysWOW64\msdt.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3824

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
3⤵
PID:2260

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp2FE9.tmp
Filesize
1KB

MD5
d1b9975cfd98fa22680d11bbc00b5c65

SHA1
e4e168f5c84146b81d8ef4e9abd5c3f91a7e1147

SHA256
f1e14203964dd1aee71b0abc5bada00660bf666df435b8648970d85fea697632

SHA512
968c20fc549ed05dba8b66cc97f71a3db67f7c77145eeca88d9bdab1bc8c0cff0384fb3369a903abbde5a771e71f633a2f966e591239563cd9f3887134cf5fbb

Download Submit
memory/380-163-0x0000000001820000-0x0000000001835000-memory.dmp

Filesize
84KB

Download
memory/380-141-0x0000000000000000-mapping.dmp

Download
memory/380-150-0x00000000017C0000-0x00000000017D5000-memory.dmp

Filesize
84KB

Download
memory/380-149-0x0000000001920000-0x0000000001C6A000-memory.dmp

Filesize
3.3MB

Download
memory/380-162-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/380-142-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/380-166-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/764-133-0x00000000050A0000-0x0000000005644000-memory.dmp

Filesize
5.6MB

Download
memory/764-134-0x0000000004AF0000-0x0000000004B82000-memory.dmp

Filesize
584KB

Download
memory/764-132-0x0000000000050000-0x000000000012C000-memory.dmp

Filesize
880KB

Download
memory/764-136-0x00000000085D0000-0x000000000866C000-memory.dmp

Filesize
624KB

Download
memory/764-135-0x0000000004AC0000-0x0000000004ACA000-memory.dmp

Filesize
40KB

Download
memory/2260-167-0x0000000000000000-mapping.dmp

Download
memory/2432-164-0x00000000025E0000-0x00000000026A3000-memory.dmp

Filesize
780KB

Download
memory/2432-172-0x00000000076F0000-0x00000000077D0000-memory.dmp

Filesize
896KB

Download
memory/2432-151-0x00000000024D0000-0x000000000258A000-memory.dmp

Filesize
744KB

Download
memory/2432-174-0x00000000076F0000-0x00000000077D0000-memory.dmp

Filesize
896KB

Download
memory/3824-165-0x0000000000000000-mapping.dmp

Download
memory/3824-169-0x0000000000F50000-0x0000000000F7F000-memory.dmp

Filesize
188KB

Download
memory/3824-173-0x0000000000F50000-0x0000000000F7F000-memory.dmp

Filesize
188KB

Download
memory/3824-171-0x0000000002F40000-0x0000000002FD4000-memory.dmp

Filesize
592KB

Download
memory/3824-170-0x00000000032A0000-0x00000000035EA000-memory.dmp

Filesize
3.3MB

Download
memory/3824-168-0x0000000000110000-0x0000000000167000-memory.dmp

Filesize
348KB

Download
memory/4228-145-0x0000000005290000-0x00000000052F6000-memory.dmp

Filesize
408KB

Download
memory/4228-139-0x00000000020C0000-0x00000000020F6000-memory.dmp

Filesize
216KB

Download
memory/4228-159-0x0000000006EF0000-0x0000000006EFE000-memory.dmp

Filesize
56KB

Download
memory/4228-160-0x0000000007040000-0x000000000705A000-memory.dmp

Filesize
104KB

Download
memory/4228-161-0x0000000007020000-0x0000000007028000-memory.dmp

Filesize
32KB

Download
memory/4228-152-0x0000000005EF0000-0x0000000005F22000-memory.dmp

Filesize
200KB

Download
memory/4228-144-0x0000000004A40000-0x0000000004A62000-memory.dmp

Filesize
136KB

Download
memory/4228-143-0x0000000004B60000-0x0000000005188000-memory.dmp

Filesize
6.2MB

Download
memory/4228-155-0x0000000007310000-0x000000000798A000-memory.dmp

Filesize
6.5MB

Download
memory/4228-158-0x0000000006F00000-0x0000000006F96000-memory.dmp

Filesize
600KB

Download
memory/4228-156-0x0000000006C90000-0x0000000006CAA000-memory.dmp

Filesize
104KB

Download
memory/4228-157-0x0000000006CF0000-0x0000000006CFA000-memory.dmp

Filesize
40KB

Download
memory/4228-154-0x0000000005ED0000-0x0000000005EEE000-memory.dmp

Filesize
120KB

Download
memory/4228-146-0x00000000053B0000-0x0000000005416000-memory.dmp

Filesize
408KB

Download
memory/4228-148-0x0000000005A00000-0x0000000005A1E000-memory.dmp

Filesize
120KB

Download
memory/4228-137-0x0000000000000000-mapping.dmp

Download
memory/4228-153-0x0000000070EA0000-0x0000000070EEC000-memory.dmp

Filesize
304KB

Download
memory/4648-138-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads