formbook | 0cf03f46e827627fc7cf3683f21e1da0f18d5a6e22e46f7aa4867aef4012b8e4

General

Target

0cf03f46e827627fc7cf3683f21e1da0f18d5a6e22e46f7aa4867aef4012b8e4.exe
Size

1.0MB
MD5

ba79f26ac9099e86e4ee3b045c484909
SHA1

3b991533e9a9fb044015e13265dc61028fd19d5f
SHA256

0cf03f46e827627fc7cf3683f21e1da0f18d5a6e22e46f7aa4867aef4012b8e4
SHA512

614f898159e4b29f89c142400a2dcffc8e044e0094055f9d36a9569d431b4a2306cbe69742c5b99dce19494f175b806ba03dab39cea55031d073a75dcb516caa
SSDEEP

24576:B4w4yZ1sQDNaCz9HFB6VBf2q+3y6BJQEcXNrYE:GUPaiuVBfm7Q1eE

Score

10^/10

formbook g2fg rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

g2fg

Decoy

snowcrash.website

pointman.us

newheartvalve.care

drandl.com

sandspringsramblers.com

programagubernamental.online

boja.us

mvrsnike.com

mentallyillmotherhood.com

facom.us

programagubernamental.store

izivente.com

roller-v.fr

amazonbioactives.com

metaverseapple.xyz

5gt-mobilevsverizon.com

gtwebsolutions.co

scottdunn.life

usdp.trade

pikmin.run

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3224-147-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

0cf03f46e827627fc7cf3683f21e1da0f18d5a6e22e46f7aa4867aef4012b8e4.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	0cf03f46e827627fc7cf3683f21e1da0f18d5a6e22e46f7aa4867aef4012b8e4.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

0cf03f46e827627fc7cf3683f21e1da0f18d5a6e22e46f7aa4867aef4012b8e4.exe

description	pid	process	target process
PID 2840 set thread context of 3224	2840	0cf03f46e827627fc7cf3683f21e1da0f18d5a6e22e46f7aa4867aef4012b8e4.exe	0cf03f46e827627fc7cf3683f21e1da0f18d5a6e22e46f7aa4867aef4012b8e4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4872 schtasks.exe

pid	process
4872	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exe0cf03f46e827627fc7cf3683f21e1da0f18d5a6e22e46f7aa4867aef4012b8e4.exe

pid	process
916	powershell.exe
3224	0cf03f46e827627fc7cf3683f21e1da0f18d5a6e22e46f7aa4867aef4012b8e4.exe
3224	0cf03f46e827627fc7cf3683f21e1da0f18d5a6e22e46f7aa4867aef4012b8e4.exe
916	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 916 powershell.exe

description	pid	process
Token: SeDebugPrivilege	916	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

0cf03f46e827627fc7cf3683f21e1da0f18d5a6e22e46f7aa4867aef4012b8e4.exe

description	pid	process	target process
PID 2840 wrote to memory of 916	2840	0cf03f46e827627fc7cf3683f21e1da0f18d5a6e22e46f7aa4867aef4012b8e4.exe	powershell.exe
PID 2840 wrote to memory of 916	2840	0cf03f46e827627fc7cf3683f21e1da0f18d5a6e22e46f7aa4867aef4012b8e4.exe	powershell.exe
PID 2840 wrote to memory of 916	2840	0cf03f46e827627fc7cf3683f21e1da0f18d5a6e22e46f7aa4867aef4012b8e4.exe	powershell.exe
PID 2840 wrote to memory of 4872	2840	0cf03f46e827627fc7cf3683f21e1da0f18d5a6e22e46f7aa4867aef4012b8e4.exe	schtasks.exe
PID 2840 wrote to memory of 4872	2840	0cf03f46e827627fc7cf3683f21e1da0f18d5a6e22e46f7aa4867aef4012b8e4.exe	schtasks.exe
PID 2840 wrote to memory of 4872	2840	0cf03f46e827627fc7cf3683f21e1da0f18d5a6e22e46f7aa4867aef4012b8e4.exe	schtasks.exe
PID 2840 wrote to memory of 3224	2840	0cf03f46e827627fc7cf3683f21e1da0f18d5a6e22e46f7aa4867aef4012b8e4.exe	0cf03f46e827627fc7cf3683f21e1da0f18d5a6e22e46f7aa4867aef4012b8e4.exe
PID 2840 wrote to memory of 3224	2840	0cf03f46e827627fc7cf3683f21e1da0f18d5a6e22e46f7aa4867aef4012b8e4.exe	0cf03f46e827627fc7cf3683f21e1da0f18d5a6e22e46f7aa4867aef4012b8e4.exe
PID 2840 wrote to memory of 3224	2840	0cf03f46e827627fc7cf3683f21e1da0f18d5a6e22e46f7aa4867aef4012b8e4.exe	0cf03f46e827627fc7cf3683f21e1da0f18d5a6e22e46f7aa4867aef4012b8e4.exe
PID 2840 wrote to memory of 3224	2840	0cf03f46e827627fc7cf3683f21e1da0f18d5a6e22e46f7aa4867aef4012b8e4.exe	0cf03f46e827627fc7cf3683f21e1da0f18d5a6e22e46f7aa4867aef4012b8e4.exe
PID 2840 wrote to memory of 3224	2840	0cf03f46e827627fc7cf3683f21e1da0f18d5a6e22e46f7aa4867aef4012b8e4.exe	0cf03f46e827627fc7cf3683f21e1da0f18d5a6e22e46f7aa4867aef4012b8e4.exe
PID 2840 wrote to memory of 3224	2840	0cf03f46e827627fc7cf3683f21e1da0f18d5a6e22e46f7aa4867aef4012b8e4.exe	0cf03f46e827627fc7cf3683f21e1da0f18d5a6e22e46f7aa4867aef4012b8e4.exe

C:\Users\Admin\AppData\Local\Temp\0cf03f46e827627fc7cf3683f21e1da0f18d5a6e22e46f7aa4867aef4012b8e4.exe
"C:\Users\Admin\AppData\Local\Temp\0cf03f46e827627fc7cf3683f21e1da0f18d5a6e22e46f7aa4867aef4012b8e4.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2840

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\rPGwXmLDdzTgJ.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:916

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rPGwXmLDdzTgJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEA60.tmp"
2⤵
- Creates scheduled task(s)
PID:4872

C:\Users\Admin\AppData\Local\Temp\0cf03f46e827627fc7cf3683f21e1da0f18d5a6e22e46f7aa4867aef4012b8e4.exe
"C:\Users\Admin\AppData\Local\Temp\0cf03f46e827627fc7cf3683f21e1da0f18d5a6e22e46f7aa4867aef4012b8e4.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3224

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fcf5dduj.thy.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpEA60.tmp
Filesize
1KB

MD5
3c9a1074767130677aaf3b82c99d7e81

SHA1
1d1aaa294e7a2bc2dd675df94f4a3f37ad092ce3

SHA256
a010ffccd2e01fba73c60009868a2a6a6784900f73f17b0a0c958c57485b0bc0

SHA512
bc5363bb8745cf889fd668d512ec6bd40388fe90f85bc1109b44e6376ee9e42ed79f9d060230c92640f3ed0beaa906cef2186124486853688e03cf59da3189ac

Download Submit
memory/916-151-0x0000000006100000-0x0000000006166000-memory.dmp

Filesize
408KB

Download
memory/916-149-0x0000000005750000-0x0000000005772000-memory.dmp

Filesize
136KB

Download
memory/916-162-0x0000000002DC0000-0x0000000002DD0000-memory.dmp

Filesize
64KB

Download
memory/916-185-0x0000000007D40000-0x0000000007D48000-memory.dmp

Filesize
32KB

Download
memory/916-184-0x0000000007D60000-0x0000000007D7A000-memory.dmp

Filesize
104KB

Download
memory/916-144-0x0000000002E60000-0x0000000002E96000-memory.dmp

Filesize
216KB

Download
memory/916-183-0x0000000007C50000-0x0000000007C5E000-memory.dmp

Filesize
56KB

Download
memory/916-146-0x0000000005980000-0x0000000005FA8000-memory.dmp

Filesize
6.2MB

Download
memory/916-182-0x0000000007CA0000-0x0000000007D36000-memory.dmp

Filesize
600KB

Download
memory/916-177-0x0000000006D30000-0x0000000006D4E000-memory.dmp

Filesize
120KB

Download
memory/916-150-0x0000000006020000-0x0000000006086000-memory.dmp

Filesize
408KB

Download
memory/916-164-0x0000000006700000-0x000000000671E000-memory.dmp

Filesize
120KB

Download
memory/916-181-0x0000000007A90000-0x0000000007A9A000-memory.dmp

Filesize
40KB

Download
memory/916-161-0x0000000002DC0000-0x0000000002DD0000-memory.dmp

Filesize
64KB

Download
memory/916-180-0x000000007F270000-0x000000007F280000-memory.dmp

Filesize
64KB

Download
memory/916-179-0x0000000007A20000-0x0000000007A3A000-memory.dmp

Filesize
104KB

Download
memory/916-178-0x0000000008070000-0x00000000086EA000-memory.dmp

Filesize
6.5MB

Download
memory/916-165-0x0000000002DC0000-0x0000000002DD0000-memory.dmp

Filesize
64KB

Download
memory/916-166-0x0000000006CD0000-0x0000000006D02000-memory.dmp

Filesize
200KB

Download
memory/916-167-0x0000000070DA0000-0x0000000070DEC000-memory.dmp

Filesize
304KB

Download
memory/2840-139-0x00000000080F0000-0x000000000818C000-memory.dmp

Filesize
624KB

Download
memory/2840-134-0x0000000005220000-0x00000000057C4000-memory.dmp

Filesize
5.6MB

Download
memory/2840-136-0x0000000004D40000-0x0000000004D4A000-memory.dmp

Filesize
40KB

Download
memory/2840-137-0x0000000004ED0000-0x0000000004EE0000-memory.dmp

Filesize
64KB

Download
memory/2840-133-0x0000000000280000-0x000000000038A000-memory.dmp

Filesize
1.0MB

Download
memory/2840-135-0x0000000004D50000-0x0000000004DE2000-memory.dmp

Filesize
584KB

Download
memory/2840-138-0x0000000004ED0000-0x0000000004EE0000-memory.dmp

Filesize
64KB

Download
memory/3224-147-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3224-163-0x0000000001460000-0x00000000017AA000-memory.dmp

Filesize
3.3MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads