formbook | 08fc30191cdb3900aad985dd7203f002dd7ac1176acd1ae7861021cc641b6a40

General

Target

quotation orda.exe
Size

685KB
MD5

79ac7b7624cbab492eb2444876e0fc7a
SHA1

8f59ff54e030341dd66debe13ccf3a80c630201e
SHA256

08fc30191cdb3900aad985dd7203f002dd7ac1176acd1ae7861021cc641b6a40
SHA512

ae184f1feae78804ffa2eb427b1b744a951cfea63d8005b259f81cabe145e876aab3a78df5c8e583c6916ff920d8a827e10e7254c47b91241c57e777d3a07864
SSDEEP

12288:2qKqnAoLzp6iEZrm4RQMIUa6ijcswvP5IwZ7poXduuW:9n38M4a4Li/0GwuXY

Score

10^/10

formbook n13e rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

n13e

Decoy

cowiemarketing.com

uniqueliquidz.co.uk

755259.com

7bw95.com

luxbarstools.co.uk

baccaratda.com

berkayakpinar.xyz

gistus.africa

hjd387.com

leave-fly.com

golfclubdaddy.com

engineeringea.buzz

countryrevisited.com

decoracioneskalite.com

imaginationlirbary.com

moneytransfer.africa

brainwaveproject.com

3039sjbqf2022.com

184hotels.com

aromamiaro.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 5 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1216-68-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1216-73-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1216-80-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1640-82-0x00000000000C0000-0x00000000000EF000-memory.dmp	formbook
behavioral1/memory/1640-84-0x00000000000C0000-0x00000000000EF000-memory.dmp	formbook

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1248 cmd.exe

pid	process
1248	cmd.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

quotation orda.exequotation orda.exeipconfig.exe

description	pid	process	target process
PID 1916 set thread context of 1216	1916	quotation orda.exe	quotation orda.exe
PID 1216 set thread context of 1280	1216	quotation orda.exe	Explorer.EXE
PID 1216 set thread context of 1280	1216	quotation orda.exe	Explorer.EXE
PID 1640 set thread context of 1280	1640	ipconfig.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1780 schtasks.exe
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command-Line Interface
T1059

Processes:

ipconfig.exe

pid process

1640 ipconfig.exe

pid	process
1780	schtasks.exe

pid	process
1640	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

Processes:

quotation orda.exequotation orda.exeipconfig.exe

pid	process
1916	quotation orda.exe
1216	quotation orda.exe
1216	quotation orda.exe
1216	quotation orda.exe
1640	ipconfig.exe
1640	ipconfig.exe
1640	ipconfig.exe
1640	ipconfig.exe
1640	ipconfig.exe
1640	ipconfig.exe
1640	ipconfig.exe
1640	ipconfig.exe
1640	ipconfig.exe
1640	ipconfig.exe
1640	ipconfig.exe
1640	ipconfig.exe
1640	ipconfig.exe
1640	ipconfig.exe
1640	ipconfig.exe
1640	ipconfig.exe
1640	ipconfig.exe
1640	ipconfig.exe
1640	ipconfig.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1280 Explorer.EXE
Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

quotation orda.exeipconfig.exe

pid process

1216 quotation orda.exe
1216 quotation orda.exe
1216 quotation orda.exe
1216 quotation orda.exe
1640 ipconfig.exe
1640 ipconfig.exe

pid	process
1280	Explorer.EXE

pid	process
1216	quotation orda.exe
1216	quotation orda.exe
1216	quotation orda.exe
1216	quotation orda.exe
1640	ipconfig.exe
1640	ipconfig.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

quotation orda.exequotation orda.exeipconfig.exe

description	pid	process
Token: SeDebugPrivilege	1916	quotation orda.exe
Token: SeDebugPrivilege	1216	quotation orda.exe
Token: SeDebugPrivilege	1640	ipconfig.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1280 Explorer.EXE
1280 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1280 Explorer.EXE
1280 Explorer.EXE

pid	process
1280	Explorer.EXE
1280	Explorer.EXE

pid	process
1280	Explorer.EXE
1280	Explorer.EXE

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

quotation orda.exeExplorer.EXEipconfig.exe

description	pid	process	target process
PID 1916 wrote to memory of 1780	1916	quotation orda.exe	schtasks.exe
PID 1916 wrote to memory of 1780	1916	quotation orda.exe	schtasks.exe
PID 1916 wrote to memory of 1780	1916	quotation orda.exe	schtasks.exe
PID 1916 wrote to memory of 1780	1916	quotation orda.exe	schtasks.exe
PID 1916 wrote to memory of 1936	1916	quotation orda.exe	quotation orda.exe
PID 1916 wrote to memory of 1936	1916	quotation orda.exe	quotation orda.exe
PID 1916 wrote to memory of 1936	1916	quotation orda.exe	quotation orda.exe
PID 1916 wrote to memory of 1936	1916	quotation orda.exe	quotation orda.exe
PID 1916 wrote to memory of 1216	1916	quotation orda.exe	quotation orda.exe
PID 1916 wrote to memory of 1216	1916	quotation orda.exe	quotation orda.exe
PID 1916 wrote to memory of 1216	1916	quotation orda.exe	quotation orda.exe
PID 1916 wrote to memory of 1216	1916	quotation orda.exe	quotation orda.exe
PID 1916 wrote to memory of 1216	1916	quotation orda.exe	quotation orda.exe
PID 1916 wrote to memory of 1216	1916	quotation orda.exe	quotation orda.exe
PID 1916 wrote to memory of 1216	1916	quotation orda.exe	quotation orda.exe
PID 1280 wrote to memory of 1640	1280	Explorer.EXE	ipconfig.exe
PID 1280 wrote to memory of 1640	1280	Explorer.EXE	ipconfig.exe
PID 1280 wrote to memory of 1640	1280	Explorer.EXE	ipconfig.exe
PID 1280 wrote to memory of 1640	1280	Explorer.EXE	ipconfig.exe
PID 1640 wrote to memory of 1248	1640	ipconfig.exe	cmd.exe
PID 1640 wrote to memory of 1248	1640	ipconfig.exe	cmd.exe
PID 1640 wrote to memory of 1248	1640	ipconfig.exe	cmd.exe
PID 1640 wrote to memory of 1248	1640	ipconfig.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1280

C:\Users\Admin\AppData\Local\Temp\quotation orda.exe
"C:\Users\Admin\AppData\Local\Temp\quotation orda.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1916

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tQEuZJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC063.tmp"
3⤵
- Creates scheduled task(s)
PID:1780

C:\Users\Admin\AppData\Local\Temp\quotation orda.exe
"{path}"
3⤵
PID:1936

C:\Users\Admin\AppData\Local\Temp\quotation orda.exe
"{path}"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1216

C:\Windows\SysWOW64\ipconfig.exe
"C:\Windows\SysWOW64\ipconfig.exe"
2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1640

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\quotation orda.exe"
3⤵
- Deletes itself
PID:1248

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Command-Line Interface

1

T1059

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpC063.tmp
Filesize
1KB

MD5
90a704b4d9cf374087f60b40552c9092

SHA1
db1637e78828589c1a745236a68171267dddaa00

SHA256
54df21f81aa23c7be11c827da81c47545d7214a8911cec6481688870f2331534

SHA512
02ca75fd49d79bb843cfe33eb73faa0d6919a8d8d55c09c3c02d75e19f74d739ffd5127d7d1d9d41998863feaef4e85b283805fa8f96c311d399e17e29f27289

Download Submit
memory/1216-80-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1216-67-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1216-72-0x0000000000210000-0x0000000000224000-memory.dmp

Filesize
80KB

Download
memory/1216-73-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1216-71-0x0000000000A00000-0x0000000000D03000-memory.dmp

Filesize
3.0MB

Download
memory/1216-77-0x00000000002C0000-0x00000000002D4000-memory.dmp

Filesize
80KB

Download
memory/1216-66-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1216-65-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1216-68-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1280-74-0x00000000065C0000-0x0000000006702000-memory.dmp

Filesize
1.3MB

Download
memory/1280-90-0x00000000071E0000-0x000000000734F000-memory.dmp

Filesize
1.4MB

Download
memory/1280-88-0x00000000071E0000-0x000000000734F000-memory.dmp

Filesize
1.4MB

Download
memory/1280-70-0x0000000000660000-0x0000000000670000-memory.dmp

Filesize
64KB

Download
memory/1280-78-0x0000000006BC0000-0x0000000006D01000-memory.dmp

Filesize
1.3MB

Download
memory/1280-87-0x00000000071E0000-0x000000000734F000-memory.dmp

Filesize
1.4MB

Download
memory/1640-79-0x0000000000870000-0x000000000087A000-memory.dmp

Filesize
40KB

Download
memory/1640-81-0x0000000000870000-0x000000000087A000-memory.dmp

Filesize
40KB

Download
memory/1640-86-0x0000000001E10000-0x0000000001EA3000-memory.dmp

Filesize
588KB

Download
memory/1640-84-0x00000000000C0000-0x00000000000EF000-memory.dmp

Filesize
188KB

Download
memory/1640-82-0x00000000000C0000-0x00000000000EF000-memory.dmp

Filesize
188KB

Download
memory/1640-83-0x0000000001FA0000-0x00000000022A3000-memory.dmp

Filesize
3.0MB

Download
memory/1916-58-0x0000000000380000-0x00000000003C0000-memory.dmp

Filesize
256KB

Download
memory/1916-54-0x00000000000C0000-0x0000000000172000-memory.dmp

Filesize
712KB

Download
memory/1916-61-0x0000000000B60000-0x0000000000B94000-memory.dmp

Filesize
208KB

Download
memory/1916-59-0x000000007EF40000-0x000000007EF50000-memory.dmp

Filesize
64KB

Download
memory/1916-57-0x000000007EF40000-0x000000007EF50000-memory.dmp

Filesize
64KB

Download
memory/1916-60-0x0000000005D10000-0x0000000005D98000-memory.dmp

Filesize
544KB

Download
memory/1916-56-0x00000000005C0000-0x00000000005CC000-memory.dmp

Filesize
48KB

Download
memory/1916-55-0x0000000000380000-0x00000000003C0000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads