formbook | ece8d55b66fdd470a1037290b30a2e6e66d0ff38fa366ec37a2b0a330364093e

General

Target

invoice.exe
Size

753KB
MD5

4de9d309e114114fa821c9b7bb72d0d4
SHA1

010b0e52bf6fc756f22b04c6dea24b0db9b31ff3
SHA256

ece8d55b66fdd470a1037290b30a2e6e66d0ff38fa366ec37a2b0a330364093e
SHA512

a8e52c3815237474e7832e4478e14aeb386cd1c18e05938b580958e8814b3a0f62967927cb260f386e25473c4ebd4fdc999cf04a6dee123eff139b855428263d
SSDEEP

12288:336M4DvcLt3zO0JSeo2113s9tr4CNNF06+DkJV5c+uh09HgCTrHBz:6M4qqapo213s5NNFu4JV52KH/r

Score

10^/10

formbook m82 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

m82

Decoy

jamesdevereux.com

artificialturfminneapolis.com

hongmeiyan.com

lojaderoupasbr.com

yit.africa

austinrelocationexpert.com

saiva.page

exitsategy.com

chochonux.com

klosterbraeu-unterliezheim.com

byseymanur.com

sblwarwickshire.co.uk

brazimaid.com

ciogame.com

bronzesailing.com

dwkapl.xyz

022dyd.com

compassandpathwriting.com

alphabet1x.com

selfcleaninghairbrush.co.uk

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 5 IoCs

rat

resource	yara_rule
behavioral1/memory/1744-71-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/308-74-0x0000000000220000-0x0000000000260000-memory.dmp	formbook
behavioral1/memory/1744-79-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1612-81-0x00000000000F0000-0x000000000011F000-memory.dmp	formbook
behavioral1/memory/1612-83-0x00000000000F0000-0x000000000011F000-memory.dmp	formbook

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1680 set thread context of 1744	1680	invoice.exe	32
PID 1744 set thread context of 1200	1744	RegSvcs.exe	14
PID 1612 set thread context of 1200	1612	NAPSTAT.EXE	14

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1332	schtasks.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
1680	invoice.exe
1680	invoice.exe
1744	RegSvcs.exe
1744	RegSvcs.exe
308	powershell.exe
1612	NAPSTAT.EXE
1612	NAPSTAT.EXE
1612	NAPSTAT.EXE
1612	NAPSTAT.EXE
1612	NAPSTAT.EXE
1612	NAPSTAT.EXE
1612	NAPSTAT.EXE
1612	NAPSTAT.EXE
1612	NAPSTAT.EXE
1612	NAPSTAT.EXE
1612	NAPSTAT.EXE
1612	NAPSTAT.EXE
1612	NAPSTAT.EXE
1612	NAPSTAT.EXE
1612	NAPSTAT.EXE
1612	NAPSTAT.EXE
1612	NAPSTAT.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1200	Explorer.EXE

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
1744	RegSvcs.exe
1744	RegSvcs.exe
1744	RegSvcs.exe
1612	NAPSTAT.EXE
1612	NAPSTAT.EXE

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1680	invoice.exe
Token: SeDebugPrivilege	1744	RegSvcs.exe
Token: SeDebugPrivilege	308	powershell.exe
Token: SeDebugPrivilege	1612	NAPSTAT.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1200	Explorer.EXE
1200	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1200	Explorer.EXE
1200	Explorer.EXE

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 308	1680	invoice.exe	28
PID 1680 wrote to memory of 308	1680	invoice.exe	28
PID 1680 wrote to memory of 308	1680	invoice.exe	28
PID 1680 wrote to memory of 308	1680	invoice.exe	28
PID 1680 wrote to memory of 1332	1680	invoice.exe	30
PID 1680 wrote to memory of 1332	1680	invoice.exe	30
PID 1680 wrote to memory of 1332	1680	invoice.exe	30
PID 1680 wrote to memory of 1332	1680	invoice.exe	30
PID 1680 wrote to memory of 1744	1680	invoice.exe	32
PID 1680 wrote to memory of 1744	1680	invoice.exe	32
PID 1680 wrote to memory of 1744	1680	invoice.exe	32
PID 1680 wrote to memory of 1744	1680	invoice.exe	32
PID 1680 wrote to memory of 1744	1680	invoice.exe	32
PID 1680 wrote to memory of 1744	1680	invoice.exe	32
PID 1680 wrote to memory of 1744	1680	invoice.exe	32
PID 1680 wrote to memory of 1744	1680	invoice.exe	32
PID 1680 wrote to memory of 1744	1680	invoice.exe	32
PID 1680 wrote to memory of 1744	1680	invoice.exe	32
PID 1200 wrote to memory of 1612	1200	Explorer.EXE	33
PID 1200 wrote to memory of 1612	1200	Explorer.EXE	33
PID 1200 wrote to memory of 1612	1200	Explorer.EXE	33
PID 1200 wrote to memory of 1612	1200	Explorer.EXE	33
PID 1612 wrote to memory of 2028	1612	NAPSTAT.EXE	34
PID 1612 wrote to memory of 2028	1612	NAPSTAT.EXE	34
PID 1612 wrote to memory of 2028	1612	NAPSTAT.EXE	34
PID 1612 wrote to memory of 2028	1612	NAPSTAT.EXE	34

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Users\Admin\AppData\Local\Temp\invoice.exe
  "C:\Users\Admin\AppData\Local\Temp\invoice.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1680
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\NipStPDCKYxH.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:308
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NipStPDCKYxH" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC87E.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:1332
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:1744
- C:\Windows\SysWOW64\NAPSTAT.EXE
  "C:\Windows\SysWOW64\NAPSTAT.EXE"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1612
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    PID:2028

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpC87E.tmp

Filesize
1KB

MD5
50d7e419153b42646c41d560559fea04

SHA1
873ff833e6a17c7b640c69a557c7cb928cd9dba5

SHA256
a49eaa2e4ffbe9eb88d8a5daa3ff6ea611621801f4563e0b7bb3e56edff508ef

SHA512
c065df79a6383e81d57fa054216c6fb14d6fe458301ae7d2d817f52df7f7b2e7d2803ff0a432cac8ba44aa0e5e67c9a6d8d160c3be156cf98bcc3717e081bc30

Download Submit
memory/308-72-0x0000000000220000-0x0000000000260000-memory.dmp

Filesize
256KB

Download
memory/308-74-0x0000000000220000-0x0000000000260000-memory.dmp

Filesize
256KB

Download
memory/1200-90-0x0000000006150000-0x0000000006291000-memory.dmp

Filesize
1.3MB

Download
memory/1200-88-0x0000000006150000-0x0000000006291000-memory.dmp

Filesize
1.3MB

Download
memory/1200-87-0x0000000006150000-0x0000000006291000-memory.dmp

Filesize
1.3MB

Download
memory/1200-77-0x00000000049C0000-0x0000000004A88000-memory.dmp

Filesize
800KB

Download
memory/1612-86-0x0000000001CF0000-0x0000000001D84000-memory.dmp

Filesize
592KB

Download
memory/1612-83-0x00000000000F0000-0x000000000011F000-memory.dmp

Filesize
188KB

Download
memory/1612-81-0x00000000000F0000-0x000000000011F000-memory.dmp

Filesize
188KB

Download
memory/1612-82-0x0000000001EB0000-0x00000000021B3000-memory.dmp

Filesize
3.0MB

Download
memory/1612-80-0x00000000000A0000-0x00000000000E6000-memory.dmp

Filesize
280KB

Download
memory/1612-78-0x00000000000A0000-0x00000000000E6000-memory.dmp

Filesize
280KB

Download
memory/1680-57-0x0000000004A40000-0x0000000004A80000-memory.dmp

Filesize
256KB

Download
memory/1680-65-0x0000000005F30000-0x0000000005F80000-memory.dmp

Filesize
320KB

Download
memory/1680-58-0x00000000006E0000-0x00000000006EC000-memory.dmp

Filesize
48KB

Download
memory/1680-54-0x0000000000250000-0x0000000000312000-memory.dmp

Filesize
776KB

Download
memory/1680-56-0x00000000004A0000-0x00000000004B2000-memory.dmp

Filesize
72KB

Download
memory/1680-59-0x0000000007FA0000-0x0000000008028000-memory.dmp

Filesize
544KB

Download
memory/1680-55-0x0000000004A40000-0x0000000004A80000-memory.dmp

Filesize
256KB

Download
memory/1744-71-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1744-68-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1744-69-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1744-79-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1744-70-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1744-76-0x00000000003E0000-0x00000000003F5000-memory.dmp

Filesize
84KB

Download
memory/1744-75-0x0000000000730000-0x0000000000A33000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads