formbook | c5963a1865a79e63cf6c451a27db54911fe38cfda287fbf537eb15878666db89

General

Target

elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe
Size

797KB
MD5

2803989c03d0d864c20efb1317b157af
SHA1

85899fc6132aeedba1eae771a3f74a641b741cf0
SHA256

c5963a1865a79e63cf6c451a27db54911fe38cfda287fbf537eb15878666db89
SHA512

706dbf3a3d984f929b131d987f2b83fed5719b5365a43aa82534f2e6ef63134f2170b3e40135df1870593a309b78c0be765754d4c8f6df7844f813761d1cf0c5
SSDEEP

12288:KnXTcAmWc6pl3i3fkuzxrB3VqJLPo6e1OrsxVRGyTWBwLN6aAsI++HVeRjLwbYW:goAE24jNBEkKsjIDDsM1Jc

Score

10^/10

formbook jr22 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

jr22

Decoy

941zhe.com

lunarportal.space

xn--osmaniyeiek-t9ab.online

trejoscar.com

nrnursery.com

quizcannot.cfd

seedstockersthailand.com

watsonwindow.com

wjfholdings.com

weziclondon.com

naruot.xyz

yeji.plus

classicmenstore.com

oharatravel.com

therapyplankits.com

keviegreshonpt.com

qdlyner.com

seithupaarungal.com

casinorates.online

8ug4as.icu

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/748-77-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/604-80-0x0000000002630000-0x0000000002670000-memory.dmp	formbook
behavioral1/memory/748-81-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1244-87-0x00000000000C0000-0x00000000000EF000-memory.dmp	formbook

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1644 cmd.exe

pid	process
1644	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exeelektronik odeme kaniti Swift mesaji_20230322_TL8755450.exemstsc.exe

description	pid	process	target process
PID 1376 set thread context of 748	1376	elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe	elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe
PID 748 set thread context of 1236	748	elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe	Explorer.EXE
PID 1244 set thread context of 1236	1244	mstsc.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

584 schtasks.exe

pid	process
584	schtasks.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

Processes:

powershell.exepowershell.exeelektronik odeme kaniti Swift mesaji_20230322_TL8755450.exemstsc.exe

pid	process
772	powershell.exe
604	powershell.exe
748	elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe
748	elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe
1244	mstsc.exe
1244	mstsc.exe
1244	mstsc.exe
1244	mstsc.exe
1244	mstsc.exe
1244	mstsc.exe
1244	mstsc.exe
1244	mstsc.exe
1244	mstsc.exe
1244	mstsc.exe
1244	mstsc.exe
1244	mstsc.exe
1244	mstsc.exe
1244	mstsc.exe
1244	mstsc.exe
1244	mstsc.exe
1244	mstsc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1236 Explorer.EXE

pid	process
1236	Explorer.EXE

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exemstsc.exe

pid	process
748	elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe
748	elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe
748	elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe
1244	mstsc.exe
1244	mstsc.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.exepowershell.exeelektronik odeme kaniti Swift mesaji_20230322_TL8755450.exemstsc.exe

description	pid	process
Token: SeDebugPrivilege	772	powershell.exe
Token: SeDebugPrivilege	604	powershell.exe
Token: SeDebugPrivilege	748	elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe
Token: SeDebugPrivilege	1244	mstsc.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1236 Explorer.EXE
1236 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1236 Explorer.EXE
1236 Explorer.EXE

pid	process
1236	Explorer.EXE
1236	Explorer.EXE

pid	process
1236	Explorer.EXE
1236	Explorer.EXE

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exeExplorer.EXEmstsc.exe

description	pid	process	target process
PID 1376 wrote to memory of 772	1376	elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe	powershell.exe
PID 1376 wrote to memory of 772	1376	elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe	powershell.exe
PID 1376 wrote to memory of 772	1376	elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe	powershell.exe
PID 1376 wrote to memory of 772	1376	elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe	powershell.exe
PID 1376 wrote to memory of 604	1376	elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe	powershell.exe
PID 1376 wrote to memory of 604	1376	elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe	powershell.exe
PID 1376 wrote to memory of 604	1376	elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe	powershell.exe
PID 1376 wrote to memory of 604	1376	elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe	powershell.exe
PID 1376 wrote to memory of 584	1376	elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe	schtasks.exe
PID 1376 wrote to memory of 584	1376	elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe	schtasks.exe
PID 1376 wrote to memory of 584	1376	elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe	schtasks.exe
PID 1376 wrote to memory of 584	1376	elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe	schtasks.exe
PID 1376 wrote to memory of 748	1376	elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe	elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe
PID 1376 wrote to memory of 748	1376	elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe	elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe
PID 1376 wrote to memory of 748	1376	elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe	elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe
PID 1376 wrote to memory of 748	1376	elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe	elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe
PID 1376 wrote to memory of 748	1376	elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe	elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe
PID 1376 wrote to memory of 748	1376	elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe	elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe
PID 1376 wrote to memory of 748	1376	elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe	elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe
PID 1236 wrote to memory of 1244	1236	Explorer.EXE	mstsc.exe
PID 1236 wrote to memory of 1244	1236	Explorer.EXE	mstsc.exe
PID 1236 wrote to memory of 1244	1236	Explorer.EXE	mstsc.exe
PID 1236 wrote to memory of 1244	1236	Explorer.EXE	mstsc.exe
PID 1244 wrote to memory of 1644	1244	mstsc.exe	cmd.exe
PID 1244 wrote to memory of 1644	1244	mstsc.exe	cmd.exe
PID 1244 wrote to memory of 1644	1244	mstsc.exe	cmd.exe
PID 1244 wrote to memory of 1644	1244	mstsc.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1236

C:\Users\Admin\AppData\Local\Temp\elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe
"C:\Users\Admin\AppData\Local\Temp\elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1376

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:772

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\PUZSBttVYU.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:604

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PUZSBttVYU" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD70E.tmp"
3⤵
- Creates scheduled task(s)
PID:584

C:\Users\Admin\AppData\Local\Temp\elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe
"C:\Users\Admin\AppData\Local\Temp\elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:748

C:\Windows\SysWOW64\mstsc.exe
"C:\Windows\SysWOW64\mstsc.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1244

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe"
3⤵
- Deletes itself
PID:1644

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpD70E.tmp
Filesize
1KB

MD5
c5ba03b68de5593416251179cddde34a

SHA1
b881daba3cb8ddd798dace515942c6cc4c09b684

SHA256
34a5fe45829cfaa2fd696ea47370118dbbf4258acf029a1141715be4644bf945

SHA512
47b449d686ce9e501e61129f4b291294998519f6d517b1a273b6255f3468576a6807afe30005319580123f136b17cbd51d7cc8c6e4f7544b68441c64c2ac9aed

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\UW8H465D2T7F7QS36CW7.temp
Filesize
7KB

MD5
37de5ed8dd3331fefa3d176e5e00a198

SHA1
ff1c36d0d782875170308900ac391f9e8864eae9

SHA256
5ad6bf7f73761bc818f1e04d0ce33d5885d9bb9ad1975d7baca900b22aa08373

SHA512
49eef64550452a1aebe778ceb6236fbebfeb6d5850525c0baed1cc10027ef490ba5a3924a77f358797a2b03e2a249dd1830a18da05b6fb2ef1ca4b62575e4dc4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
37de5ed8dd3331fefa3d176e5e00a198

SHA1
ff1c36d0d782875170308900ac391f9e8864eae9

SHA256
5ad6bf7f73761bc818f1e04d0ce33d5885d9bb9ad1975d7baca900b22aa08373

SHA512
49eef64550452a1aebe778ceb6236fbebfeb6d5850525c0baed1cc10027ef490ba5a3924a77f358797a2b03e2a249dd1830a18da05b6fb2ef1ca4b62575e4dc4

Download Submit
memory/604-78-0x0000000002630000-0x0000000002670000-memory.dmp

Filesize
256KB

Download
memory/604-80-0x0000000002630000-0x0000000002670000-memory.dmp

Filesize
256KB

Download
memory/748-73-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/748-81-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/748-82-0x0000000000920000-0x0000000000C23000-memory.dmp

Filesize
3.0MB

Download
memory/748-74-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/748-75-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/748-77-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/748-83-0x0000000000120000-0x0000000000134000-memory.dmp

Filesize
80KB

Download
memory/772-76-0x0000000002520000-0x0000000002560000-memory.dmp

Filesize
256KB

Download
memory/1236-96-0x0000000005EE0000-0x0000000005FAA000-memory.dmp

Filesize
808KB

Download
memory/1236-94-0x0000000005EE0000-0x0000000005FAA000-memory.dmp

Filesize
808KB

Download
memory/1236-84-0x0000000006B50000-0x0000000006CB5000-memory.dmp

Filesize
1.4MB

Download
memory/1236-93-0x0000000005EE0000-0x0000000005FAA000-memory.dmp

Filesize
808KB

Download
memory/1236-91-0x0000000000410000-0x0000000000510000-memory.dmp

Filesize
1024KB

Download
memory/1244-88-0x0000000002110000-0x0000000002413000-memory.dmp

Filesize
3.0MB

Download
memory/1244-85-0x0000000000370000-0x0000000000474000-memory.dmp

Filesize
1.0MB

Download
memory/1244-86-0x0000000000370000-0x0000000000474000-memory.dmp

Filesize
1.0MB

Download
memory/1244-87-0x00000000000C0000-0x00000000000EF000-memory.dmp

Filesize
188KB

Download
memory/1244-92-0x0000000002000000-0x0000000002093000-memory.dmp

Filesize
588KB

Download
memory/1376-72-0x0000000004D80000-0x0000000004DB8000-memory.dmp

Filesize
224KB

Download
memory/1376-56-0x00000000003E0000-0x00000000003FE000-memory.dmp

Filesize
120KB

Download
memory/1376-57-0x0000000002120000-0x0000000002160000-memory.dmp

Filesize
256KB

Download
memory/1376-59-0x00000000056A0000-0x0000000005750000-memory.dmp

Filesize
704KB

Download
memory/1376-54-0x0000000000850000-0x000000000091E000-memory.dmp

Filesize
824KB

Download
memory/1376-58-0x0000000000490000-0x000000000049C000-memory.dmp

Filesize
48KB

Download
memory/1376-55-0x0000000002120000-0x0000000002160000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads