formbook | e9ac57e43f65115bb0e5780178dae36d3a625cf21a21d6b9272d7a067c9c52a5

General

Target

comutation order.exe
Size

744KB
MD5

d24b6d72e85c9b51bd5b39b9fe6d1ab5
SHA1

b2c1c8c1988924942a231cf30dfc5222b031090e
SHA256

e9ac57e43f65115bb0e5780178dae36d3a625cf21a21d6b9272d7a067c9c52a5
SHA512

d37ff374ab0f381051e8e1c27d4b181a57e62fa3f8775616739421261b7032f94ec229b84c0f0a686bbbce95f69e7a2b2a0269239773c7dc76ff0f01ce8c9b6e
SSDEEP

12288:iQu6zWFuIRiPLFuJVygB1VrQ6GSItioHVnwlb1:iSIuIwZwAgrVr6NHFwlb

Score

10^/10

formbook n13e rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

n13e

Decoy

cowiemarketing.com

uniqueliquidz.co.uk

755259.com

7bw95.com

luxbarstools.co.uk

baccaratda.com

berkayakpinar.xyz

gistus.africa

hjd387.com

leave-fly.com

golfclubdaddy.com

engineeringea.buzz

countryrevisited.com

decoracioneskalite.com

imaginationlirbary.com

moneytransfer.africa

brainwaveproject.com

3039sjbqf2022.com

184hotels.com

aromamiaro.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1704-66-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1704-70-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1332-77-0x0000000000090000-0x00000000000BF000-memory.dmp	formbook
behavioral1/memory/1332-79-0x0000000000090000-0x00000000000BF000-memory.dmp	formbook

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1044 cmd.exe

pid	process
1044	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

comutation order.execomutation order.exemsiexec.exe

description	pid	process	target process
PID 1984 set thread context of 1704	1984	comutation order.exe	comutation order.exe
PID 1704 set thread context of 1344	1704	comutation order.exe	Explorer.EXE
PID 1332 set thread context of 1344	1332	msiexec.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1632 schtasks.exe

pid	process
1632	schtasks.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

Processes:

comutation order.exemsiexec.exe

pid	process
1704	comutation order.exe
1704	comutation order.exe
1332	msiexec.exe
1332	msiexec.exe
1332	msiexec.exe
1332	msiexec.exe
1332	msiexec.exe
1332	msiexec.exe
1332	msiexec.exe
1332	msiexec.exe
1332	msiexec.exe
1332	msiexec.exe
1332	msiexec.exe
1332	msiexec.exe
1332	msiexec.exe
1332	msiexec.exe
1332	msiexec.exe
1332	msiexec.exe
1332	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1344 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

comutation order.exemsiexec.exe

pid process

1704 comutation order.exe
1704 comutation order.exe
1704 comutation order.exe
1332 msiexec.exe
1332 msiexec.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

comutation order.exemsiexec.exe

description pid process

Token: SeDebugPrivilege 1704 comutation order.exe
Token: SeDebugPrivilege 1332 msiexec.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1344 Explorer.EXE
1344 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1344 Explorer.EXE
1344 Explorer.EXE

pid	process
1344	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	1704	comutation order.exe
Token: SeDebugPrivilege	1332	msiexec.exe

pid	process
1344	Explorer.EXE
1344	Explorer.EXE

pid	process
1344	Explorer.EXE
1344	Explorer.EXE

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

comutation order.exeExplorer.EXEmsiexec.exe

description	pid	process	target process
PID 1984 wrote to memory of 1632	1984	comutation order.exe	schtasks.exe
PID 1984 wrote to memory of 1632	1984	comutation order.exe	schtasks.exe
PID 1984 wrote to memory of 1632	1984	comutation order.exe	schtasks.exe
PID 1984 wrote to memory of 1632	1984	comutation order.exe	schtasks.exe
PID 1984 wrote to memory of 1704	1984	comutation order.exe	comutation order.exe
PID 1984 wrote to memory of 1704	1984	comutation order.exe	comutation order.exe
PID 1984 wrote to memory of 1704	1984	comutation order.exe	comutation order.exe
PID 1984 wrote to memory of 1704	1984	comutation order.exe	comutation order.exe
PID 1984 wrote to memory of 1704	1984	comutation order.exe	comutation order.exe
PID 1984 wrote to memory of 1704	1984	comutation order.exe	comutation order.exe
PID 1984 wrote to memory of 1704	1984	comutation order.exe	comutation order.exe
PID 1344 wrote to memory of 1332	1344	Explorer.EXE	msiexec.exe
PID 1344 wrote to memory of 1332	1344	Explorer.EXE	msiexec.exe
PID 1344 wrote to memory of 1332	1344	Explorer.EXE	msiexec.exe
PID 1344 wrote to memory of 1332	1344	Explorer.EXE	msiexec.exe
PID 1344 wrote to memory of 1332	1344	Explorer.EXE	msiexec.exe
PID 1344 wrote to memory of 1332	1344	Explorer.EXE	msiexec.exe
PID 1344 wrote to memory of 1332	1344	Explorer.EXE	msiexec.exe
PID 1332 wrote to memory of 1044	1332	msiexec.exe	cmd.exe
PID 1332 wrote to memory of 1044	1332	msiexec.exe	cmd.exe
PID 1332 wrote to memory of 1044	1332	msiexec.exe	cmd.exe
PID 1332 wrote to memory of 1044	1332	msiexec.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1344

C:\Users\Admin\AppData\Local\Temp\comutation order.exe
"C:\Users\Admin\AppData\Local\Temp\comutation order.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1984

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\urCbmGUnZ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE928.tmp"
3⤵
- Creates scheduled task(s)
PID:1632

C:\Users\Admin\AppData\Local\Temp\comutation order.exe
"{path}"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1704

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\SysWOW64\msiexec.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1332

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\comutation order.exe"
3⤵
- Deletes itself
PID:1044

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpE928.tmp
Filesize
1KB

MD5
d9514d9e4dc2cfc90e8d276890b9f62c

SHA1
a6a1e85d6dcda2ef498398a5e11f58aa0ab9c96b

SHA256
bafabff9c7b0197349fdbab81cb128f20316f7c3cdf26d3875550a68e3fddbf1

SHA512
f310fd8bfc2788a70816f51c612db13ebbcff9de7f9b6ac43408b7421a05b2185e7ccf501b27d96ae78ff3e02006dff1eac70a07cdd9f34fb8275e7fcb3d8c4d

Download Submit
memory/1332-76-0x0000000000B20000-0x0000000000B34000-memory.dmp

Filesize
80KB

Download
memory/1332-73-0x0000000000B20000-0x0000000000B34000-memory.dmp

Filesize
80KB

Download
memory/1332-81-0x0000000000A80000-0x0000000000B13000-memory.dmp

Filesize
588KB

Download
memory/1332-79-0x0000000000090000-0x00000000000BF000-memory.dmp

Filesize
188KB

Download
memory/1332-78-0x00000000020D0000-0x00000000023D3000-memory.dmp

Filesize
3.0MB

Download
memory/1332-77-0x0000000000090000-0x00000000000BF000-memory.dmp

Filesize
188KB

Download
memory/1332-74-0x0000000000B20000-0x0000000000B34000-memory.dmp

Filesize
80KB

Download
memory/1344-82-0x0000000004340000-0x00000000043EC000-memory.dmp

Filesize
688KB

Download
memory/1344-72-0x0000000006A90000-0x0000000006BE7000-memory.dmp

Filesize
1.3MB

Download
memory/1344-85-0x0000000004340000-0x00000000043EC000-memory.dmp

Filesize
688KB

Download
memory/1344-83-0x0000000004340000-0x00000000043EC000-memory.dmp

Filesize
688KB

Download
memory/1704-66-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1704-69-0x0000000000900000-0x0000000000C03000-memory.dmp

Filesize
3.0MB

Download
memory/1704-64-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1704-70-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1704-71-0x0000000000190000-0x00000000001A4000-memory.dmp

Filesize
80KB

Download
memory/1704-63-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1704-65-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1984-55-0x0000000000AF0000-0x0000000000B30000-memory.dmp

Filesize
256KB

Download
memory/1984-58-0x0000000005650000-0x00000000056D8000-memory.dmp

Filesize
544KB

Download
memory/1984-57-0x0000000000AF0000-0x0000000000B30000-memory.dmp

Filesize
256KB

Download
memory/1984-59-0x0000000000740000-0x0000000000774000-memory.dmp

Filesize
208KB

Download
memory/1984-54-0x00000000010F0000-0x00000000011B0000-memory.dmp

Filesize
768KB

Download
memory/1984-56-0x0000000000350000-0x000000000035C000-memory.dmp

Filesize
48KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads