formbook | ef5801704c64fb48c3bc3f96ba58f18ed4a320835d0f5d36732b3b5c2a2724ef

General

Target

tmp.exe
Size

885KB
MD5

9fb2fa6e06d3f2a46d78ddd454b2defd
SHA1

dcf1825c32d53f3fba95540e89d721d145e8d683
SHA256

ef5801704c64fb48c3bc3f96ba58f18ed4a320835d0f5d36732b3b5c2a2724ef
SHA512

71b49b4dd668755e2ec107dcf81483f392c8f49373319ac6bd97ef6e995e076cd5d0b52a19193a4494fbc82a7069e36a5bd1371eef83ef80e36c12bdaee2b708
SSDEEP

12288:Ssa/5u62iNZVDvoKzfq92bRQpQwhLMTyqSicZ7HyRW/eRAv4wF8DZI:fa/5u61vK8bRQpKrkVdGRAvg

Score

10^/10

formbook g2fg rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

g2fg

Decoy

snowcrash.website

pointman.us

newheartvalve.care

drandl.com

sandspringsramblers.com

programagubernamental.online

boja.us

mvrsnike.com

mentallyillmotherhood.com

facom.us

programagubernamental.store

izivente.com

roller-v.fr

amazonbioactives.com

metaverseapple.xyz

5gt-mobilevsverizon.com

gtwebsolutions.co

scottdunn.life

usdp.trade

pikmin.run

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/384-71-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/384-76-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1544-82-0x00000000000C0000-0x00000000000EF000-memory.dmp	formbook
behavioral1/memory/1544-84-0x00000000000C0000-0x00000000000EF000-memory.dmp	formbook

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

520 cmd.exe

pid	process
520	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

tmp.exetmp.exemstsc.exe

description	pid	process	target process
PID 2040 set thread context of 384	2040	tmp.exe	tmp.exe
PID 384 set thread context of 1244	384	tmp.exe	Explorer.EXE
PID 1544 set thread context of 1244	1544	mstsc.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

680 schtasks.exe

pid	process
680	schtasks.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

Processes:

tmp.exepowershell.exemstsc.exe

pid	process
384	tmp.exe
384	tmp.exe
1632	powershell.exe
1544	mstsc.exe
1544	mstsc.exe
1544	mstsc.exe
1544	mstsc.exe
1544	mstsc.exe
1544	mstsc.exe
1544	mstsc.exe
1544	mstsc.exe
1544	mstsc.exe
1544	mstsc.exe
1544	mstsc.exe
1544	mstsc.exe
1544	mstsc.exe
1544	mstsc.exe
1544	mstsc.exe
1544	mstsc.exe
1544	mstsc.exe
1544	mstsc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1244 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

tmp.exemstsc.exe

pid process

384 tmp.exe
384 tmp.exe
384 tmp.exe
1544 mstsc.exe
1544 mstsc.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

tmp.exepowershell.exemstsc.exe

description pid process

Token: SeDebugPrivilege 384 tmp.exe
Token: SeDebugPrivilege 1632 powershell.exe
Token: SeDebugPrivilege 1544 mstsc.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1244 Explorer.EXE
1244 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1244 Explorer.EXE
1244 Explorer.EXE

pid	process
1244	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	384	tmp.exe
Token: SeDebugPrivilege	1632	powershell.exe
Token: SeDebugPrivilege	1544	mstsc.exe

pid	process
1244	Explorer.EXE
1244	Explorer.EXE

pid	process
1244	Explorer.EXE
1244	Explorer.EXE

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

tmp.exeExplorer.EXEmstsc.exe

description	pid	process	target process
PID 2040 wrote to memory of 1632	2040	tmp.exe	powershell.exe
PID 2040 wrote to memory of 1632	2040	tmp.exe	powershell.exe
PID 2040 wrote to memory of 1632	2040	tmp.exe	powershell.exe
PID 2040 wrote to memory of 1632	2040	tmp.exe	powershell.exe
PID 2040 wrote to memory of 680	2040	tmp.exe	schtasks.exe
PID 2040 wrote to memory of 680	2040	tmp.exe	schtasks.exe
PID 2040 wrote to memory of 680	2040	tmp.exe	schtasks.exe
PID 2040 wrote to memory of 680	2040	tmp.exe	schtasks.exe
PID 2040 wrote to memory of 384	2040	tmp.exe	tmp.exe
PID 2040 wrote to memory of 384	2040	tmp.exe	tmp.exe
PID 2040 wrote to memory of 384	2040	tmp.exe	tmp.exe
PID 2040 wrote to memory of 384	2040	tmp.exe	tmp.exe
PID 2040 wrote to memory of 384	2040	tmp.exe	tmp.exe
PID 2040 wrote to memory of 384	2040	tmp.exe	tmp.exe
PID 2040 wrote to memory of 384	2040	tmp.exe	tmp.exe
PID 1244 wrote to memory of 1544	1244	Explorer.EXE	mstsc.exe
PID 1244 wrote to memory of 1544	1244	Explorer.EXE	mstsc.exe
PID 1244 wrote to memory of 1544	1244	Explorer.EXE	mstsc.exe
PID 1244 wrote to memory of 1544	1244	Explorer.EXE	mstsc.exe
PID 1544 wrote to memory of 520	1544	mstsc.exe	cmd.exe
PID 1544 wrote to memory of 520	1544	mstsc.exe	cmd.exe
PID 1544 wrote to memory of 520	1544	mstsc.exe	cmd.exe
PID 1544 wrote to memory of 520	1544	mstsc.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1244

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\UQaZOpBfTXPxe.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1632

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UQaZOpBfTXPxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB00E.tmp"
3⤵
- Creates scheduled task(s)
PID:680

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:384

C:\Windows\SysWOW64\mstsc.exe
"C:\Windows\SysWOW64\mstsc.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1544

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
3⤵
- Deletes itself
PID:520

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpB00E.tmp
Filesize
1KB

MD5
62fc14b1d2d1fec166007e8ea8a4b4ba

SHA1
499c31bfcadda4a04cb2d3d60e27ed7257a29981

SHA256
31185ed785006c006de7332ee0ee9a5f5368763fb506802fb2ee1d30b139c4ae

SHA512
db8a066d64b2084cbaeaa4136e7d398ccf71f91021fcf24ad0ea0109796e7e4c10be37e65292c3363581fb5275e4e6e807c9e597e82d73788c063d6fdcb6a357

Download Submit
memory/384-66-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/384-78-0x0000000000130000-0x0000000000144000-memory.dmp

Filesize
80KB

Download
memory/384-77-0x0000000000910000-0x0000000000C13000-memory.dmp

Filesize
3.0MB

Download
memory/384-76-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/384-71-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/384-70-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/384-69-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1244-87-0x0000000006800000-0x0000000006917000-memory.dmp

Filesize
1.1MB

Download
memory/1244-73-0x0000000000010000-0x0000000000020000-memory.dmp

Filesize
64KB

Download
memory/1244-88-0x0000000006800000-0x0000000006917000-memory.dmp

Filesize
1.1MB

Download
memory/1244-90-0x0000000006800000-0x0000000006917000-memory.dmp

Filesize
1.1MB

Download
memory/1244-79-0x0000000004C90000-0x0000000004E3B000-memory.dmp

Filesize
1.7MB

Download
memory/1544-83-0x0000000002250000-0x0000000002553000-memory.dmp

Filesize
3.0MB

Download
memory/1544-84-0x00000000000C0000-0x00000000000EF000-memory.dmp

Filesize
188KB

Download
memory/1544-80-0x0000000000D40000-0x0000000000E44000-memory.dmp

Filesize
1.0MB

Download
memory/1544-82-0x00000000000C0000-0x00000000000EF000-memory.dmp

Filesize
188KB

Download
memory/1544-81-0x0000000000D40000-0x0000000000E44000-memory.dmp

Filesize
1.0MB

Download
memory/1544-86-0x0000000000BB0000-0x0000000000C43000-memory.dmp

Filesize
588KB

Download
memory/1632-75-0x00000000025D0000-0x0000000002610000-memory.dmp

Filesize
256KB

Download
memory/1632-74-0x00000000025D0000-0x0000000002610000-memory.dmp

Filesize
256KB

Download
memory/2040-54-0x0000000001000000-0x00000000010E4000-memory.dmp

Filesize
912KB

Download
memory/2040-65-0x0000000004500000-0x0000000004538000-memory.dmp

Filesize
224KB

Download
memory/2040-59-0x0000000007EA0000-0x0000000007F50000-memory.dmp

Filesize
704KB

Download
memory/2040-58-0x0000000000440000-0x000000000044C000-memory.dmp

Filesize
48KB

Download
memory/2040-57-0x0000000000FC0000-0x0000000001000000-memory.dmp

Filesize
256KB

Download
memory/2040-56-0x0000000000420000-0x0000000000434000-memory.dmp

Filesize
80KB

Download
memory/2040-55-0x0000000000FC0000-0x0000000001000000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads