formbook | 1c9b6b93ad7226b05cbb54ac2be814395269877ed8d48e2d22fd06318d0139fc

Analysis

max time kernel
152s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
08-03-2023 10:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9123b739b8d3d1c2f5a3dabf8c358c77175422d0e83f5edadc7584bd50eb484c.exe
Size

264KB
MD5

c1a8c992aac5a10c6ca89cedb772d567
SHA1

99ad74abf2717a297260df450e105e8a40cd16fc
SHA256

9123b739b8d3d1c2f5a3dabf8c358c77175422d0e83f5edadc7584bd50eb484c
SHA512

cb3f735fa6f68fca72e596a658db049141ce2319b718df578f755efc9d2f302c1b3407e1a6190d3dee1c4c67f7a33e2440dc117f4cfef16301f2e1c303fed450
SSDEEP

6144:gYa6+YxKBm16Bj9lWAbkKXVa9S02ZVh2Qs/cEpeXzhdGZbghHrOSh:gYI7maj9tk9Svu/cW0zhsKhFh

Score

10^/10

formbook bn26 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

bn26

Decoy

juweipai.com

assurance-mon-espace-sante.com

robqq.com

ablindear.com

socialmonkeys.co.uk

learningworldtech.com

imprese-it.com

themoodcollectives.africa

lutonmethodists.org.uk

castawaycovebnb.com

caronthemove.com

carolinacastro.uk

dcfashionweekintl.com

branchbasicsa.com

drpatrickakinsanya.africa

inventourownfuture.com

applege.top

whatamitiredof.com

daphan.pics

gardenstatevinyl.net

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 4 IoCs

rat

resource	yara_rule
behavioral2/memory/4220-142-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/4220-150-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/336-153-0x0000000000A00000-0x0000000000A2F000-memory.dmp	formbook
behavioral2/memory/336-155-0x0000000000A00000-0x0000000000A2F000-memory.dmp	formbook

Executes dropped EXE 2 IoCs

pid	Process
1220	ovyvcwwn.exe
4220	ovyvcwwn.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1220 set thread context of 4220	1220	ovyvcwwn.exe	85
PID 4220 set thread context of 3204	4220	ovyvcwwn.exe	19
PID 336 set thread context of 3204	336	netsh.exe	19

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 60 IoCs

pid	Process
4220	ovyvcwwn.exe
4220	ovyvcwwn.exe
4220	ovyvcwwn.exe
4220	ovyvcwwn.exe
336	netsh.exe
336	netsh.exe
336	netsh.exe
336	netsh.exe
336	netsh.exe
336	netsh.exe
336	netsh.exe
336	netsh.exe
336	netsh.exe
336	netsh.exe
336	netsh.exe
336	netsh.exe
336	netsh.exe
336	netsh.exe
336	netsh.exe
336	netsh.exe
336	netsh.exe
336	netsh.exe
336	netsh.exe
336	netsh.exe
336	netsh.exe
336	netsh.exe
336	netsh.exe
336	netsh.exe
336	netsh.exe
336	netsh.exe
336	netsh.exe
336	netsh.exe
336	netsh.exe
336	netsh.exe
336	netsh.exe
336	netsh.exe
336	netsh.exe
336	netsh.exe
336	netsh.exe
336	netsh.exe
336	netsh.exe
336	netsh.exe
336	netsh.exe
336	netsh.exe
336	netsh.exe
336	netsh.exe
336	netsh.exe
336	netsh.exe
336	netsh.exe
336	netsh.exe
336	netsh.exe
336	netsh.exe
336	netsh.exe
336	netsh.exe
336	netsh.exe
336	netsh.exe
336	netsh.exe
336	netsh.exe
336	netsh.exe
336	netsh.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3204	Explorer.EXE

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
1220	ovyvcwwn.exe
4220	ovyvcwwn.exe
4220	ovyvcwwn.exe
4220	ovyvcwwn.exe
336	netsh.exe
336	netsh.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	4220	ovyvcwwn.exe
Token: SeDebugPrivilege	336	netsh.exe
Token: SeShutdownPrivilege	3204	Explorer.EXE
Token: SeCreatePagefilePrivilege	3204	Explorer.EXE
Token: SeShutdownPrivilege	3204	Explorer.EXE
Token: SeCreatePagefilePrivilege	3204	Explorer.EXE
Token: SeShutdownPrivilege	3204	Explorer.EXE
Token: SeCreatePagefilePrivilege	3204	Explorer.EXE
Token: SeShutdownPrivilege	3204	Explorer.EXE
Token: SeCreatePagefilePrivilege	3204	Explorer.EXE
Token: SeShutdownPrivilege	3204	Explorer.EXE
Token: SeCreatePagefilePrivilege	3204	Explorer.EXE
Token: SeShutdownPrivilege	3204	Explorer.EXE
Token: SeCreatePagefilePrivilege	3204	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3204	Explorer.EXE
3204	Explorer.EXE

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4452 wrote to memory of 1220	4452	9123b739b8d3d1c2f5a3dabf8c358c77175422d0e83f5edadc7584bd50eb484c.exe	84
PID 4452 wrote to memory of 1220	4452	9123b739b8d3d1c2f5a3dabf8c358c77175422d0e83f5edadc7584bd50eb484c.exe	84
PID 4452 wrote to memory of 1220	4452	9123b739b8d3d1c2f5a3dabf8c358c77175422d0e83f5edadc7584bd50eb484c.exe	84
PID 1220 wrote to memory of 4220	1220	ovyvcwwn.exe	85
PID 1220 wrote to memory of 4220	1220	ovyvcwwn.exe	85
PID 1220 wrote to memory of 4220	1220	ovyvcwwn.exe	85
PID 1220 wrote to memory of 4220	1220	ovyvcwwn.exe	85
PID 3204 wrote to memory of 336	3204	Explorer.EXE	86
PID 3204 wrote to memory of 336	3204	Explorer.EXE	86
PID 3204 wrote to memory of 336	3204	Explorer.EXE	86
PID 336 wrote to memory of 1876	336	netsh.exe	87
PID 336 wrote to memory of 1876	336	netsh.exe	87
PID 336 wrote to memory of 1876	336	netsh.exe	87

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3204
- C:\Users\Admin\AppData\Local\Temp\9123b739b8d3d1c2f5a3dabf8c358c77175422d0e83f5edadc7584bd50eb484c.exe
  "C:\Users\Admin\AppData\Local\Temp\9123b739b8d3d1c2f5a3dabf8c358c77175422d0e83f5edadc7584bd50eb484c.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4452
- - C:\Users\Admin\AppData\Local\Temp\ovyvcwwn.exe
    "C:\Users\Admin\AppData\Local\Temp\ovyvcwwn.exe" C:\Users\Admin\AppData\Local\Temp\qjiixipuri.re
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:1220
  - - C:\Users\Admin\AppData\Local\Temp\ovyvcwwn.exe
      "C:\Users\Admin\AppData\Local\Temp\ovyvcwwn.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:4220
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\SysWOW64\netsh.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:336
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\ovyvcwwn.exe"
    3⤵
    PID:1876

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ovyvcwwn.exe

Filesize
6KB

MD5
06732507c8b0860440725eaba06eb440

SHA1
d529c223cb33c5586fe34203c97eaf07a964ce9a

SHA256
3aedbd25541f571cfbe801e124a93f78f31f43048891862ed7c93bb5281f7192

SHA512
d65af28d6d01edd3f55fabdc6742f7ab6f011cef7f6ba615f8ab0c9e1bb38b375a31e5a06cd29df615a377ff9c051c411a908d98d2fbcf3369250c5898103d85

Download Submit
C:\Users\Admin\AppData\Local\Temp\ovyvcwwn.exe

Filesize
6KB

MD5
06732507c8b0860440725eaba06eb440

SHA1
d529c223cb33c5586fe34203c97eaf07a964ce9a

SHA256
3aedbd25541f571cfbe801e124a93f78f31f43048891862ed7c93bb5281f7192

SHA512
d65af28d6d01edd3f55fabdc6742f7ab6f011cef7f6ba615f8ab0c9e1bb38b375a31e5a06cd29df615a377ff9c051c411a908d98d2fbcf3369250c5898103d85

Download Submit
C:\Users\Admin\AppData\Local\Temp\ovyvcwwn.exe

Filesize
6KB

MD5
06732507c8b0860440725eaba06eb440

SHA1
d529c223cb33c5586fe34203c97eaf07a964ce9a

SHA256
3aedbd25541f571cfbe801e124a93f78f31f43048891862ed7c93bb5281f7192

SHA512
d65af28d6d01edd3f55fabdc6742f7ab6f011cef7f6ba615f8ab0c9e1bb38b375a31e5a06cd29df615a377ff9c051c411a908d98d2fbcf3369250c5898103d85

Download Submit
C:\Users\Admin\AppData\Local\Temp\qjiixipuri.re

Filesize
5KB

MD5
f149e350e181be4cf2c638f2bdfcc587

SHA1
03c3de809de0612b1efd0bcdfd4bb32def023c86

SHA256
ea29e25950d73a7e92b759e59643a2988dcb0972c3405fedd530c402e786bca3

SHA512
a96da28136d0cfc10884a1f4aa0ca621bba0f1bedb9ede4946de9bb34aadedd0ce99e642a9fd8bd1f85ba2c00bd8cb0012f7b6cae73d15cc9756e7af14056744

Download Submit
C:\Users\Admin\AppData\Local\Temp\udaibslayym.nnq

Filesize
205KB

MD5
b4acf2ff536265e3d417db161855c925

SHA1
9871b0a7218133cd34f9ab346990030fbda91cf8

SHA256
9910edbcea80e2b839e99a143d3870c27eea211a248692e95e76c51ec9c91b27

SHA512
64a84f6e641badd29c20df4af97a95436cc4a1095d0d04b7dfc7e83c58e8a2a73da86f30f655150488be7405f6c95bc2998e89d6658bcf91a3b8663b84762914

Download Submit
memory/336-152-0x0000000000B30000-0x0000000000B4E000-memory.dmp

Filesize
120KB

Download
memory/336-157-0x00000000010F0000-0x0000000001184000-memory.dmp

Filesize
592KB

Download
memory/336-155-0x0000000000A00000-0x0000000000A2F000-memory.dmp

Filesize
188KB

Download
memory/336-154-0x00000000012B0000-0x00000000015FA000-memory.dmp

Filesize
3.3MB

Download
memory/336-149-0x0000000000B30000-0x0000000000B4E000-memory.dmp

Filesize
120KB

Download
memory/336-153-0x0000000000A00000-0x0000000000A2F000-memory.dmp

Filesize
188KB

Download
memory/3204-148-0x0000000008A50000-0x0000000008B6E000-memory.dmp

Filesize
1.1MB

Download
memory/3204-158-0x0000000003290000-0x0000000003389000-memory.dmp

Filesize
996KB

Download
memory/3204-159-0x0000000003290000-0x0000000003389000-memory.dmp

Filesize
996KB

Download
memory/3204-161-0x0000000003290000-0x0000000003389000-memory.dmp

Filesize
996KB

Download
memory/4220-150-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4220-147-0x0000000001410000-0x0000000001425000-memory.dmp

Filesize
84KB

Download
memory/4220-146-0x00000000019A0000-0x0000000001CEA000-memory.dmp

Filesize
3.3MB

Download
memory/4220-142-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download