formbook | 50fe8f68de11579bdf0d4703cc9e6a1f0f9817a5605b15977c229bf5c522338d

General

Target

50fe8f68de11579bdf0d4703cc9e6a1f0f9817a5605b15977c229bf5c522338d.exe
Size

349KB
MD5

ba645c8235d19c8407c81d62470eedf8
SHA1

9b78b515d6869753e2bb3e46d1307deccef79e57
SHA256

50fe8f68de11579bdf0d4703cc9e6a1f0f9817a5605b15977c229bf5c522338d
SHA512

7efa198fd976f2660fc033f708739c003210ae88e50938abec6ce919e85246ca4a6d4f3db0e105b16094b08a68ad1234b5986cfed43c90b239369a46e95a65de
SSDEEP

6144:jYa6a3R6bVzifniXpVKRNQfgwq+DMhfii10dqeH+QE:jY03RYV+Op8Ugwq+HiSg0PE

Score

10^/10

formbook ho62 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ho62

Decoy

aqawonky.com

ancachsroadsideassistance.com

artologycreatlive.com

olesinfo.africa

lovebreatheandsleep.com

friendsofdragonsprings.com

homecomingmums.wiki

hg222.bet

precision-spares.co.uk

generalhospitaleu.africa

touchstone4x4.africa

dynamator.com

dental-implants-52531.com

efefear.buzz

bentonapp.net

89luxu.com

bridgesonelm.com

acesaigon.online

instantapprovals.loans

evuniverso.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/808-65-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/808-69-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1500-75-0x0000000000090000-0x00000000000BF000-memory.dmp	formbook
behavioral1/memory/1500-77-0x0000000000090000-0x00000000000BF000-memory.dmp	formbook

Executes dropped EXE 2 IoCs

Processes:

evmxs.exeevmxs.exe

pid process

2000 evmxs.exe
808 evmxs.exe
Loads dropped DLL 2 IoCs

Processes:

50fe8f68de11579bdf0d4703cc9e6a1f0f9817a5605b15977c229bf5c522338d.exeevmxs.exe

pid process

1092 50fe8f68de11579bdf0d4703cc9e6a1f0f9817a5605b15977c229bf5c522338d.exe
2000 evmxs.exe

pid	process
2000	evmxs.exe
808	evmxs.exe

pid	process
1092	50fe8f68de11579bdf0d4703cc9e6a1f0f9817a5605b15977c229bf5c522338d.exe
2000	evmxs.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

evmxs.exeevmxs.exewuapp.exe

description	pid	process	target process
PID 2000 set thread context of 808	2000	evmxs.exe	evmxs.exe
PID 808 set thread context of 1204	808	evmxs.exe	Explorer.EXE
PID 1500 set thread context of 1204	1500	wuapp.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 28 IoCs

Processes:

evmxs.exewuapp.exe

pid	process
808	evmxs.exe
808	evmxs.exe
1500	wuapp.exe
1500	wuapp.exe
1500	wuapp.exe
1500	wuapp.exe
1500	wuapp.exe
1500	wuapp.exe
1500	wuapp.exe
1500	wuapp.exe
1500	wuapp.exe
1500	wuapp.exe
1500	wuapp.exe
1500	wuapp.exe
1500	wuapp.exe
1500	wuapp.exe
1500	wuapp.exe
1500	wuapp.exe
1500	wuapp.exe
1500	wuapp.exe
1500	wuapp.exe
1500	wuapp.exe
1500	wuapp.exe
1500	wuapp.exe
1500	wuapp.exe
1500	wuapp.exe
1500	wuapp.exe
1500	wuapp.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1204 Explorer.EXE
Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

evmxs.exeevmxs.exewuapp.exe

pid process

2000 evmxs.exe
808 evmxs.exe
808 evmxs.exe
808 evmxs.exe
1500 wuapp.exe
1500 wuapp.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

evmxs.exewuapp.exe

description pid process

Token: SeDebugPrivilege 808 evmxs.exe
Token: SeDebugPrivilege 1500 wuapp.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1204 Explorer.EXE
1204 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1204 Explorer.EXE
1204 Explorer.EXE

pid	process
1204	Explorer.EXE

pid	process
2000	evmxs.exe
808	evmxs.exe
808	evmxs.exe
808	evmxs.exe
1500	wuapp.exe
1500	wuapp.exe

description	pid	process
Token: SeDebugPrivilege	808	evmxs.exe
Token: SeDebugPrivilege	1500	wuapp.exe

pid	process
1204	Explorer.EXE
1204	Explorer.EXE

pid	process
1204	Explorer.EXE
1204	Explorer.EXE

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

50fe8f68de11579bdf0d4703cc9e6a1f0f9817a5605b15977c229bf5c522338d.exeevmxs.exeExplorer.EXEwuapp.exe

description	pid	process	target process
PID 1092 wrote to memory of 2000	1092	50fe8f68de11579bdf0d4703cc9e6a1f0f9817a5605b15977c229bf5c522338d.exe	evmxs.exe
PID 1092 wrote to memory of 2000	1092	50fe8f68de11579bdf0d4703cc9e6a1f0f9817a5605b15977c229bf5c522338d.exe	evmxs.exe
PID 1092 wrote to memory of 2000	1092	50fe8f68de11579bdf0d4703cc9e6a1f0f9817a5605b15977c229bf5c522338d.exe	evmxs.exe
PID 1092 wrote to memory of 2000	1092	50fe8f68de11579bdf0d4703cc9e6a1f0f9817a5605b15977c229bf5c522338d.exe	evmxs.exe
PID 2000 wrote to memory of 808	2000	evmxs.exe	evmxs.exe
PID 2000 wrote to memory of 808	2000	evmxs.exe	evmxs.exe
PID 2000 wrote to memory of 808	2000	evmxs.exe	evmxs.exe
PID 2000 wrote to memory of 808	2000	evmxs.exe	evmxs.exe
PID 2000 wrote to memory of 808	2000	evmxs.exe	evmxs.exe
PID 1204 wrote to memory of 1500	1204	Explorer.EXE	wuapp.exe
PID 1204 wrote to memory of 1500	1204	Explorer.EXE	wuapp.exe
PID 1204 wrote to memory of 1500	1204	Explorer.EXE	wuapp.exe
PID 1204 wrote to memory of 1500	1204	Explorer.EXE	wuapp.exe
PID 1204 wrote to memory of 1500	1204	Explorer.EXE	wuapp.exe
PID 1204 wrote to memory of 1500	1204	Explorer.EXE	wuapp.exe
PID 1204 wrote to memory of 1500	1204	Explorer.EXE	wuapp.exe
PID 1500 wrote to memory of 1324	1500	wuapp.exe	cmd.exe
PID 1500 wrote to memory of 1324	1500	wuapp.exe	cmd.exe
PID 1500 wrote to memory of 1324	1500	wuapp.exe	cmd.exe
PID 1500 wrote to memory of 1324	1500	wuapp.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1204

C:\Users\Admin\AppData\Local\Temp\50fe8f68de11579bdf0d4703cc9e6a1f0f9817a5605b15977c229bf5c522338d.exe
"C:\Users\Admin\AppData\Local\Temp\50fe8f68de11579bdf0d4703cc9e6a1f0f9817a5605b15977c229bf5c522338d.exe"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1092

C:\Users\Admin\AppData\Local\Temp\evmxs.exe
"C:\Users\Admin\AppData\Local\Temp\evmxs.exe" C:\Users\Admin\AppData\Local\Temp\qrteztqgww.lbc
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2000

C:\Users\Admin\AppData\Local\Temp\evmxs.exe
"C:\Users\Admin\AppData\Local\Temp\evmxs.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:808

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:772

C:\Windows\SysWOW64\wuapp.exe
"C:\Windows\SysWOW64\wuapp.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1500

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\evmxs.exe"
3⤵
PID:1324

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\evmxs.exe
Filesize
97KB

MD5
ea54c194d2a03380c618bcb23669b78d

SHA1
2aa690e0d3091c736b5557c6462b75f68f06cd90

SHA256
bf5a00f352d12e5bbaba6a84d3e9a65157fec23dabfc0c67d05ad4d8344b74f1

SHA512
11879c7c9b5a2f47c4cc07047bc1e6cef880238ebb65ffe59335f429f0a8bc2ce23cef97278147d32443cfd94b4c8a991661ec96eebdc9e83ba8712a4ea93305

Download Submit
C:\Users\Admin\AppData\Local\Temp\evmxs.exe
Filesize
97KB

MD5
ea54c194d2a03380c618bcb23669b78d

SHA1
2aa690e0d3091c736b5557c6462b75f68f06cd90

SHA256
bf5a00f352d12e5bbaba6a84d3e9a65157fec23dabfc0c67d05ad4d8344b74f1

SHA512
11879c7c9b5a2f47c4cc07047bc1e6cef880238ebb65ffe59335f429f0a8bc2ce23cef97278147d32443cfd94b4c8a991661ec96eebdc9e83ba8712a4ea93305

Download Submit
C:\Users\Admin\AppData\Local\Temp\evmxs.exe
Filesize
97KB

MD5
ea54c194d2a03380c618bcb23669b78d

SHA1
2aa690e0d3091c736b5557c6462b75f68f06cd90

SHA256
bf5a00f352d12e5bbaba6a84d3e9a65157fec23dabfc0c67d05ad4d8344b74f1

SHA512
11879c7c9b5a2f47c4cc07047bc1e6cef880238ebb65ffe59335f429f0a8bc2ce23cef97278147d32443cfd94b4c8a991661ec96eebdc9e83ba8712a4ea93305

Download Submit
C:\Users\Admin\AppData\Local\Temp\qrteztqgww.lbc
Filesize
6KB

MD5
ff107dc03a00167424fec76cde7e8f78

SHA1
481d9285d50accef703baa71f56ce21359839cac

SHA256
9845f5fdaf0d4ccb3994540839f7eb9159d2ef1c93a01349f54974ebc214d591

SHA512
46542520a849ba3ab34958f656498cd72505af13141f9b90f692ae24acc2e2670eb95a942f7d67c1c55878a110ed6a9cbbe50e1ddd31339228a46d651b112325

Download Submit
C:\Users\Admin\AppData\Local\Temp\rcngsrdjmk.x
Filesize
205KB

MD5
84da0b4d575e5b8f9fb6963ac4b5c1f8

SHA1
99662624073ee572fd5ca216c57ee216497ceb85

SHA256
82b34d99484accb13f617e6c4bce37a897f2713b3ad958e3518eb3ea04614af3

SHA512
296f66e1a7d177d4fe38e10c42a5085f6579e2fa1752189c6bd54905506ca01f5bfbfc697dbe11f9aebc809547cb39cd824b891f535925483da2e76a8c174474

Download Submit
\Users\Admin\AppData\Local\Temp\evmxs.exe
Filesize
97KB

MD5
ea54c194d2a03380c618bcb23669b78d

SHA1
2aa690e0d3091c736b5557c6462b75f68f06cd90

SHA256
bf5a00f352d12e5bbaba6a84d3e9a65157fec23dabfc0c67d05ad4d8344b74f1

SHA512
11879c7c9b5a2f47c4cc07047bc1e6cef880238ebb65ffe59335f429f0a8bc2ce23cef97278147d32443cfd94b4c8a991661ec96eebdc9e83ba8712a4ea93305

Download Submit
\Users\Admin\AppData\Local\Temp\evmxs.exe
Filesize
97KB

MD5
ea54c194d2a03380c618bcb23669b78d

SHA1
2aa690e0d3091c736b5557c6462b75f68f06cd90

SHA256
bf5a00f352d12e5bbaba6a84d3e9a65157fec23dabfc0c67d05ad4d8344b74f1

SHA512
11879c7c9b5a2f47c4cc07047bc1e6cef880238ebb65ffe59335f429f0a8bc2ce23cef97278147d32443cfd94b4c8a991661ec96eebdc9e83ba8712a4ea93305

Download Submit
memory/808-71-0x00000000002A0000-0x00000000002B5000-memory.dmp

Filesize
84KB

Download
memory/808-69-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/808-65-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/808-70-0x0000000000770000-0x0000000000A73000-memory.dmp

Filesize
3.0MB

Download
memory/1204-80-0x0000000006500000-0x00000000065F7000-memory.dmp

Filesize
988KB

Download
memory/1204-72-0x0000000004B70000-0x0000000004C25000-memory.dmp

Filesize
724KB

Download
memory/1204-83-0x0000000006500000-0x00000000065F7000-memory.dmp

Filesize
988KB

Download
memory/1204-81-0x0000000006500000-0x00000000065F7000-memory.dmp

Filesize
988KB

Download
memory/1500-75-0x0000000000090000-0x00000000000BF000-memory.dmp

Filesize
188KB

Download
memory/1500-77-0x0000000000090000-0x00000000000BF000-memory.dmp

Filesize
188KB

Download
memory/1500-79-0x0000000000940000-0x00000000009D4000-memory.dmp

Filesize
592KB

Download
memory/1500-76-0x0000000002030000-0x0000000002333000-memory.dmp

Filesize
3.0MB

Download
memory/1500-74-0x0000000000A90000-0x0000000000A9B000-memory.dmp

Filesize
44KB

Download
memory/1500-73-0x0000000000A90000-0x0000000000A9B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads