formbook | 7ceddb9d23c536b2d5d9c4d57cc24aa764944db16f62b8db871db41f34e22be6

General

Target

77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe
Size

762KB
MD5

d0c1e2d3400adbc801fb564688620041
SHA1

499c664b4170c484c661286d02135186ae5e77f8
SHA256

77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6
SHA512

28a8dde829add33a2550e668461e2b1899982ae49c9733dc29118a2ce8bcff8903924049fcb964e6b6faee41b303c49decda52de9c08b6349d2dcc16c08a9c74
SSDEEP

12288:ZCvwk/wjZBHYBcLnCdP9+V7ywfxxM+fd6BVvhazSUQxHIugLrxhS/ESBoYXJGRTw:ZCvwIkBaf+RTG+fdifRFgLjS/7nJT

Score

10^/10

formbook h3sc rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

h3sc

Decoy

seemessage.com

bitlab.website

cheesestuff.ru

bhartiyafitness.com

bardapps.com

l7a4.com

chiara-samatanga.com

lesrollintioup.com

dropwc.com

mackey242.com

rackksfresheggs.com

thinkvlog.com

aidmedicalassist.com

firehousepickleball.net

sifreyonetici.com

teka-mart.com

ddttzone.xyz

macfeeupdate.com

ivocastillo.com

serjayparks.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4924-147-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe

description	pid	process	target process
PID 2012 set thread context of 4924	2012	77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe	77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4236 schtasks.exe

pid	process
4236	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exepowershell.exe77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe

pid	process
2012	77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe
2012	77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe
2012	77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe
2012	77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe
2012	77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe
2012	77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe
224	powershell.exe
4924	77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe
4924	77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe
224	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2012	77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe
Token: SeDebugPrivilege	224	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe

C:\Users\Admin\AppData\Local\Temp\77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe
"C:\Users\Admin\AppData\Local\Temp\77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2012

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\UdaCiZJIbbVG.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:224

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UdaCiZJIbbVG" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2C11.tmp"
2⤵
- Creates scheduled task(s)
PID:4236

C:\Users\Admin\AppData\Local\Temp\77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe
"C:\Users\Admin\AppData\Local\Temp\77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe"
2⤵
PID:788

C:\Users\Admin\AppData\Local\Temp\77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe
"C:\Users\Admin\AppData\Local\Temp\77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4924

C:\Users\Admin\AppData\Local\Temp\77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe
"C:\Users\Admin\AppData\Local\Temp\77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe"
2⤵
PID:1656

C:\Users\Admin\AppData\Local\Temp\77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe
"C:\Users\Admin\AppData\Local\Temp\77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe"
2⤵
PID:3852

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_h3x2bkyu.dhm.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2C11.tmp
Filesize
1KB

MD5
8f09f82c3fcdd09739cf2265e2c100b3

SHA1
13899491c9d4c28ee31c26f61b7f58f7ac770401

SHA256
92165ef5527438b908fb00cb8854a56faa80145437b6b9e8ed360c5197d55728

SHA512
71e4d5c08a5485ac3e8b6771f41d4d9f0b2b251c88070f8c1a7b375c3a3d549b30f2c763d39e6a1773cb565fe5ba86579e1cc68e9de89263077d84cc10c802b9

Download Submit
memory/224-152-0x00000000057E0000-0x0000000005846000-memory.dmp

Filesize
408KB

Download
memory/224-149-0x00000000055C0000-0x00000000055E2000-memory.dmp

Filesize
136KB

Download
memory/224-151-0x0000000005250000-0x0000000005260000-memory.dmp

Filesize
64KB

Download
memory/224-185-0x0000000007CB0000-0x0000000007CB8000-memory.dmp

Filesize
32KB

Download
memory/224-184-0x0000000007CD0000-0x0000000007CEA000-memory.dmp

Filesize
104KB

Download
memory/224-144-0x0000000002D90000-0x0000000002DC6000-memory.dmp

Filesize
216KB

Download
memory/224-183-0x0000000007BC0000-0x0000000007BCE000-memory.dmp

Filesize
56KB

Download
memory/224-146-0x0000000005890000-0x0000000005EB8000-memory.dmp

Filesize
6.2MB

Download
memory/224-182-0x0000000007C10000-0x0000000007CA6000-memory.dmp

Filesize
600KB

Download
memory/224-177-0x0000000007FE0000-0x000000000865A000-memory.dmp

Filesize
6.5MB

Download
memory/224-150-0x0000000005770000-0x00000000057D6000-memory.dmp

Filesize
408KB

Download
memory/224-164-0x0000000006690000-0x00000000066AE000-memory.dmp

Filesize
120KB

Download
memory/224-181-0x0000000007A00000-0x0000000007A0A000-memory.dmp

Filesize
40KB

Download
memory/224-180-0x000000007F0A0000-0x000000007F0B0000-memory.dmp

Filesize
64KB

Download
memory/224-178-0x0000000005250000-0x0000000005260000-memory.dmp

Filesize
64KB

Download
memory/224-179-0x0000000007990000-0x00000000079AA000-memory.dmp

Filesize
104KB

Download
memory/224-153-0x0000000005250000-0x0000000005260000-memory.dmp

Filesize
64KB

Download
memory/224-165-0x0000000006C70000-0x0000000006CA2000-memory.dmp

Filesize
200KB

Download
memory/224-166-0x0000000071090000-0x00000000710DC000-memory.dmp

Filesize
304KB

Download
memory/224-176-0x0000000006C30000-0x0000000006C4E000-memory.dmp

Filesize
120KB

Download
memory/2012-139-0x00000000072D0000-0x000000000736C000-memory.dmp

Filesize
624KB

Download
memory/2012-136-0x0000000005C60000-0x0000000005C70000-memory.dmp

Filesize
64KB

Download
memory/2012-137-0x00000000059E0000-0x00000000059EA000-memory.dmp

Filesize
40KB

Download
memory/2012-134-0x0000000005F00000-0x00000000064A4000-memory.dmp

Filesize
5.6MB

Download
memory/2012-133-0x0000000000F50000-0x0000000001014000-memory.dmp

Filesize
784KB

Download
memory/2012-135-0x00000000059F0000-0x0000000005A82000-memory.dmp

Filesize
584KB

Download
memory/2012-138-0x0000000005C60000-0x0000000005C70000-memory.dmp

Filesize
64KB

Download
memory/4924-147-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4924-163-0x0000000001720000-0x0000000001A6A000-memory.dmp

Filesize
3.3MB

Download

description	pid	process	target process
PID 2012 wrote to memory of 224	2012	77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe	powershell.exe
PID 2012 wrote to memory of 224	2012	77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe	powershell.exe
PID 2012 wrote to memory of 224	2012	77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe	powershell.exe
PID 2012 wrote to memory of 4236	2012	77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe	schtasks.exe
PID 2012 wrote to memory of 4236	2012	77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe	schtasks.exe
PID 2012 wrote to memory of 4236	2012	77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe	schtasks.exe
PID 2012 wrote to memory of 788	2012	77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe	77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe
PID 2012 wrote to memory of 788	2012	77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe	77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe
PID 2012 wrote to memory of 788	2012	77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe	77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe
PID 2012 wrote to memory of 3852	2012	77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe	77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe
PID 2012 wrote to memory of 3852	2012	77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe	77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe
PID 2012 wrote to memory of 3852	2012	77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe	77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe
PID 2012 wrote to memory of 1656	2012	77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe	77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe
PID 2012 wrote to memory of 1656	2012	77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe	77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe
PID 2012 wrote to memory of 1656	2012	77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe	77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe
PID 2012 wrote to memory of 4924	2012	77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe	77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe
PID 2012 wrote to memory of 4924	2012	77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe	77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe
PID 2012 wrote to memory of 4924	2012	77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe	77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe
PID 2012 wrote to memory of 4924	2012	77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe	77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe
PID 2012 wrote to memory of 4924	2012	77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe	77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe
PID 2012 wrote to memory of 4924	2012	77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe	77ed29ab8aa9da3669874c3f49e81c581105a981e8537a78382dc69e043943a6.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads