formbook | f6bb03b4bffe8e0ab71cd8e26a65b3baa5f870cee4e974851dce6d8140316c84

General

Target

Inv_7623980.exe
Size

640KB
MD5

9d90ecb4164286708135b600d3efaf72
SHA1

881823fcf811fe3d4e8af866fb4516058f2ee9ad
SHA256

f6bb03b4bffe8e0ab71cd8e26a65b3baa5f870cee4e974851dce6d8140316c84
SHA512

49d8640827783fbfcb6f3f4f801e0763f17472db731254aac69ab7cb4c9cd9737e0653c18ad138cf77497bf1d6192f03d2e1541da4317f32b1be9f2c66bca748
SSDEEP

12288:Oc3A815DMksz/YS1SqvT59spvRAinT4k3JJFw:Oc32/YmpFcA4l3J

Score

10^/10

formbook m82 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

m82

Decoy

jamesdevereux.com

artificialturfminneapolis.com

hongmeiyan.com

lojaderoupasbr.com

yit.africa

austinrelocationexpert.com

saiva.page

exitsategy.com

chochonux.com

klosterbraeu-unterliezheim.com

byseymanur.com

sblwarwickshire.co.uk

brazimaid.com

ciogame.com

bronzesailing.com

dwkapl.xyz

022dyd.com

compassandpathwriting.com

alphabet1x.com

selfcleaninghairbrush.co.uk

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 5 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1696-71-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1696-75-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1696-85-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1280-87-0x0000000000080000-0x00000000000AF000-memory.dmp	formbook
behavioral1/memory/1280-89-0x0000000000080000-0x00000000000AF000-memory.dmp	formbook

Suspicious use of SetThreadContext 4 IoCs

Processes:

Inv_7623980.exeRegSvcs.exehelp.exe

description	pid	process	target process
PID 2028 set thread context of 1696	2028	Inv_7623980.exe	RegSvcs.exe
PID 1696 set thread context of 1244	1696	RegSvcs.exe	Explorer.EXE
PID 1696 set thread context of 1244	1696	RegSvcs.exe	Explorer.EXE
PID 1280 set thread context of 1244	1280	help.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

296 schtasks.exe

pid	process
296	schtasks.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

Processes:

Inv_7623980.exeRegSvcs.exepowershell.exehelp.exe

pid	process
2028	Inv_7623980.exe
2028	Inv_7623980.exe
1696	RegSvcs.exe
1696	RegSvcs.exe
664	powershell.exe
1696	RegSvcs.exe
1280	help.exe
1280	help.exe
1280	help.exe
1280	help.exe
1280	help.exe
1280	help.exe
1280	help.exe
1280	help.exe
1280	help.exe
1280	help.exe
1280	help.exe
1280	help.exe
1280	help.exe
1280	help.exe
1280	help.exe
1280	help.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1244 Explorer.EXE
Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

RegSvcs.exehelp.exe

pid process

1696 RegSvcs.exe
1696 RegSvcs.exe
1696 RegSvcs.exe
1696 RegSvcs.exe
1280 help.exe
1280 help.exe

pid	process
1244	Explorer.EXE

pid	process
1696	RegSvcs.exe
1696	RegSvcs.exe
1696	RegSvcs.exe
1696	RegSvcs.exe
1280	help.exe
1280	help.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

Inv_7623980.exeRegSvcs.exepowershell.exehelp.exe

description	pid	process
Token: SeDebugPrivilege	2028	Inv_7623980.exe
Token: SeDebugPrivilege	1696	RegSvcs.exe
Token: SeDebugPrivilege	664	powershell.exe
Token: SeDebugPrivilege	1280	help.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1244 Explorer.EXE
1244 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1244 Explorer.EXE
1244 Explorer.EXE

pid	process
1244	Explorer.EXE
1244	Explorer.EXE

pid	process
1244	Explorer.EXE
1244	Explorer.EXE

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

Inv_7623980.exeRegSvcs.exehelp.exe

description	pid	process	target process
PID 2028 wrote to memory of 664	2028	Inv_7623980.exe	powershell.exe
PID 2028 wrote to memory of 664	2028	Inv_7623980.exe	powershell.exe
PID 2028 wrote to memory of 664	2028	Inv_7623980.exe	powershell.exe
PID 2028 wrote to memory of 664	2028	Inv_7623980.exe	powershell.exe
PID 2028 wrote to memory of 296	2028	Inv_7623980.exe	schtasks.exe
PID 2028 wrote to memory of 296	2028	Inv_7623980.exe	schtasks.exe
PID 2028 wrote to memory of 296	2028	Inv_7623980.exe	schtasks.exe
PID 2028 wrote to memory of 296	2028	Inv_7623980.exe	schtasks.exe
PID 2028 wrote to memory of 1696	2028	Inv_7623980.exe	RegSvcs.exe
PID 2028 wrote to memory of 1696	2028	Inv_7623980.exe	RegSvcs.exe
PID 2028 wrote to memory of 1696	2028	Inv_7623980.exe	RegSvcs.exe
PID 2028 wrote to memory of 1696	2028	Inv_7623980.exe	RegSvcs.exe
PID 2028 wrote to memory of 1696	2028	Inv_7623980.exe	RegSvcs.exe
PID 2028 wrote to memory of 1696	2028	Inv_7623980.exe	RegSvcs.exe
PID 2028 wrote to memory of 1696	2028	Inv_7623980.exe	RegSvcs.exe
PID 2028 wrote to memory of 1696	2028	Inv_7623980.exe	RegSvcs.exe
PID 2028 wrote to memory of 1696	2028	Inv_7623980.exe	RegSvcs.exe
PID 2028 wrote to memory of 1696	2028	Inv_7623980.exe	RegSvcs.exe
PID 1696 wrote to memory of 1280	1696	RegSvcs.exe	help.exe
PID 1696 wrote to memory of 1280	1696	RegSvcs.exe	help.exe
PID 1696 wrote to memory of 1280	1696	RegSvcs.exe	help.exe
PID 1696 wrote to memory of 1280	1696	RegSvcs.exe	help.exe
PID 1280 wrote to memory of 1744	1280	help.exe	cmd.exe
PID 1280 wrote to memory of 1744	1280	help.exe	cmd.exe
PID 1280 wrote to memory of 1744	1280	help.exe	cmd.exe
PID 1280 wrote to memory of 1744	1280	help.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1244

C:\Users\Admin\AppData\Local\Temp\Inv_7623980.exe
"C:\Users\Admin\AppData\Local\Temp\Inv_7623980.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2028

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\HEjcPXgwxnIz.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:664

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HEjcPXgwxnIz" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB240.tmp"
3⤵
- Creates scheduled task(s)
PID:296

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1696

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
4⤵
PID:624

C:\Windows\SysWOW64\help.exe
"C:\Windows\SysWOW64\help.exe"
4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1280

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
5⤵
PID:1744

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpB240.tmp
Filesize
1KB

MD5
7aca1954cd2c76ccbf985871ec67cd4e

SHA1
7fa98d6af830f00f5c71c5e40cda88643010651e

SHA256
015713ea6f068be1b6e2ea52e5d01e206f42d6a28175d96b5bf78e5e9d555148

SHA512
506864e2c8784900c52996a973bde4981418160075e3153d6856df1fa85057ecbebfd6040aea3daab82c882ff0220215b945095a0ea9d8a146649c5a9122594c

Download Submit
memory/664-78-0x00000000026B0000-0x00000000026F0000-memory.dmp

Filesize
256KB

Download
memory/664-77-0x00000000026B0000-0x00000000026F0000-memory.dmp

Filesize
256KB

Download
memory/664-74-0x00000000026B0000-0x00000000026F0000-memory.dmp

Filesize
256KB

Download
memory/1244-73-0x0000000003860000-0x0000000003960000-memory.dmp

Filesize
1024KB

Download
memory/1244-96-0x0000000004C50000-0x0000000004D13000-memory.dmp

Filesize
780KB

Download
memory/1244-94-0x0000000004C50000-0x0000000004D13000-memory.dmp

Filesize
780KB

Download
memory/1244-92-0x0000000004C50000-0x0000000004D13000-memory.dmp

Filesize
780KB

Download
memory/1244-90-0x0000000006F90000-0x00000000070EB000-memory.dmp

Filesize
1.4MB

Download
memory/1244-83-0x0000000006F90000-0x00000000070EB000-memory.dmp

Filesize
1.4MB

Download
memory/1244-80-0x00000000048A0000-0x0000000004952000-memory.dmp

Filesize
712KB

Download
memory/1280-84-0x0000000000AC0000-0x0000000000AC6000-memory.dmp

Filesize
24KB

Download
memory/1280-86-0x0000000000AC0000-0x0000000000AC6000-memory.dmp

Filesize
24KB

Download
memory/1280-91-0x0000000000630000-0x00000000006C4000-memory.dmp

Filesize
592KB

Download
memory/1280-89-0x0000000000080000-0x00000000000AF000-memory.dmp

Filesize
188KB

Download
memory/1280-88-0x0000000000AD0000-0x0000000000DD3000-memory.dmp

Filesize
3.0MB

Download
memory/1280-87-0x0000000000080000-0x00000000000AF000-memory.dmp

Filesize
188KB

Download
memory/1696-68-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1696-76-0x0000000000770000-0x0000000000A73000-memory.dmp

Filesize
3.0MB

Download
memory/1696-70-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1696-82-0x00000000004A0000-0x00000000004B5000-memory.dmp

Filesize
84KB

Download
memory/1696-79-0x00000000001A0000-0x00000000001B5000-memory.dmp

Filesize
84KB

Download
memory/1696-85-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1696-71-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1696-75-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1696-69-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2028-59-0x0000000005650000-0x00000000056C0000-memory.dmp

Filesize
448KB

Download
memory/2028-54-0x0000000000A80000-0x0000000000B26000-memory.dmp

Filesize
664KB

Download
memory/2028-58-0x00000000003B0000-0x00000000003BA000-memory.dmp

Filesize
40KB

Download
memory/2028-65-0x0000000004C30000-0x0000000004C68000-memory.dmp

Filesize
224KB

Download
memory/2028-57-0x0000000000490000-0x00000000004D0000-memory.dmp

Filesize
256KB

Download
memory/2028-56-0x0000000000350000-0x000000000035C000-memory.dmp

Filesize
48KB

Download
memory/2028-55-0x0000000000490000-0x00000000004D0000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads