formbook | 21037d3de36ca089fdc638c7a3a09a00568d5d56e16aebdc2f30398e4eabffa6

General

Target

21037d3de36ca089fdc638c7a3a09a00568d5d56e16aebdc2f30398e4eabffa6.exe
Size

625KB
MD5

6ababfe9f98d833317f718c4d3d74145
SHA1

03e660fe8bd44ae1301ec24bd115ed9637d18ba8
SHA256

21037d3de36ca089fdc638c7a3a09a00568d5d56e16aebdc2f30398e4eabffa6
SHA512

e355768fd84b7f8ba9db72bc5d8c3514c826f5bd1f36f87094f7679665022f5095296216c951a2a68378f6ab5fd8be74f6fff4d566eb367397e16921be8cdc16
SSDEEP

12288:V0v9iQf9KqnAoDpcz/dJenAIQvNmpZiollSkz8+cZl5:VUNfbnHqz/+nAIDzl8NZl5

Score

10^/10

formbook m82 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

m82

Decoy

jamesdevereux.com

artificialturfminneapolis.com

hongmeiyan.com

lojaderoupasbr.com

yit.africa

austinrelocationexpert.com

saiva.page

exitsategy.com

chochonux.com

klosterbraeu-unterliezheim.com

byseymanur.com

sblwarwickshire.co.uk

brazimaid.com

ciogame.com

bronzesailing.com

dwkapl.xyz

022dyd.com

compassandpathwriting.com

alphabet1x.com

selfcleaninghairbrush.co.uk

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/524-68-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/524-70-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1768-76-0x0000000000080000-0x00000000000AF000-memory.dmp	formbook
behavioral1/memory/1768-78-0x0000000000080000-0x00000000000AF000-memory.dmp	formbook

Suspicious use of SetThreadContext 3 IoCs

Processes:

21037d3de36ca089fdc638c7a3a09a00568d5d56e16aebdc2f30398e4eabffa6.exeRegSvcs.exeraserver.exe

description	pid	process	target process
PID 1408 set thread context of 524	1408	21037d3de36ca089fdc638c7a3a09a00568d5d56e16aebdc2f30398e4eabffa6.exe	RegSvcs.exe
PID 524 set thread context of 1212	524	RegSvcs.exe	Explorer.EXE
PID 1768 set thread context of 1212	1768	raserver.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

908 schtasks.exe

pid	process
908	schtasks.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

Processes:

21037d3de36ca089fdc638c7a3a09a00568d5d56e16aebdc2f30398e4eabffa6.exeRegSvcs.exeraserver.exe

pid	process
1408	21037d3de36ca089fdc638c7a3a09a00568d5d56e16aebdc2f30398e4eabffa6.exe
524	RegSvcs.exe
524	RegSvcs.exe
1768	raserver.exe
1768	raserver.exe
1768	raserver.exe
1768	raserver.exe
1768	raserver.exe
1768	raserver.exe
1768	raserver.exe
1768	raserver.exe
1768	raserver.exe
1768	raserver.exe
1768	raserver.exe
1768	raserver.exe
1768	raserver.exe
1768	raserver.exe
1768	raserver.exe
1768	raserver.exe
1768	raserver.exe
1768	raserver.exe
1768	raserver.exe
1768	raserver.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1212 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

RegSvcs.exeraserver.exe

pid process

524 RegSvcs.exe
524 RegSvcs.exe
524 RegSvcs.exe
1768 raserver.exe
1768 raserver.exe

pid	process
1212	Explorer.EXE

pid	process
524	RegSvcs.exe
524	RegSvcs.exe
524	RegSvcs.exe
1768	raserver.exe
1768	raserver.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

21037d3de36ca089fdc638c7a3a09a00568d5d56e16aebdc2f30398e4eabffa6.exeRegSvcs.exeraserver.exe

description	pid	process
Token: SeDebugPrivilege	1408	21037d3de36ca089fdc638c7a3a09a00568d5d56e16aebdc2f30398e4eabffa6.exe
Token: SeDebugPrivilege	524	RegSvcs.exe
Token: SeDebugPrivilege	1768	raserver.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1212 Explorer.EXE
1212 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1212 Explorer.EXE
1212 Explorer.EXE

pid	process
1212	Explorer.EXE
1212	Explorer.EXE

pid	process
1212	Explorer.EXE
1212	Explorer.EXE

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

21037d3de36ca089fdc638c7a3a09a00568d5d56e16aebdc2f30398e4eabffa6.exeExplorer.EXEraserver.exe

description	pid	process	target process
PID 1408 wrote to memory of 908	1408	21037d3de36ca089fdc638c7a3a09a00568d5d56e16aebdc2f30398e4eabffa6.exe	schtasks.exe
PID 1408 wrote to memory of 908	1408	21037d3de36ca089fdc638c7a3a09a00568d5d56e16aebdc2f30398e4eabffa6.exe	schtasks.exe
PID 1408 wrote to memory of 908	1408	21037d3de36ca089fdc638c7a3a09a00568d5d56e16aebdc2f30398e4eabffa6.exe	schtasks.exe
PID 1408 wrote to memory of 908	1408	21037d3de36ca089fdc638c7a3a09a00568d5d56e16aebdc2f30398e4eabffa6.exe	schtasks.exe
PID 1408 wrote to memory of 524	1408	21037d3de36ca089fdc638c7a3a09a00568d5d56e16aebdc2f30398e4eabffa6.exe	RegSvcs.exe
PID 1408 wrote to memory of 524	1408	21037d3de36ca089fdc638c7a3a09a00568d5d56e16aebdc2f30398e4eabffa6.exe	RegSvcs.exe
PID 1408 wrote to memory of 524	1408	21037d3de36ca089fdc638c7a3a09a00568d5d56e16aebdc2f30398e4eabffa6.exe	RegSvcs.exe
PID 1408 wrote to memory of 524	1408	21037d3de36ca089fdc638c7a3a09a00568d5d56e16aebdc2f30398e4eabffa6.exe	RegSvcs.exe
PID 1408 wrote to memory of 524	1408	21037d3de36ca089fdc638c7a3a09a00568d5d56e16aebdc2f30398e4eabffa6.exe	RegSvcs.exe
PID 1408 wrote to memory of 524	1408	21037d3de36ca089fdc638c7a3a09a00568d5d56e16aebdc2f30398e4eabffa6.exe	RegSvcs.exe
PID 1408 wrote to memory of 524	1408	21037d3de36ca089fdc638c7a3a09a00568d5d56e16aebdc2f30398e4eabffa6.exe	RegSvcs.exe
PID 1408 wrote to memory of 524	1408	21037d3de36ca089fdc638c7a3a09a00568d5d56e16aebdc2f30398e4eabffa6.exe	RegSvcs.exe
PID 1408 wrote to memory of 524	1408	21037d3de36ca089fdc638c7a3a09a00568d5d56e16aebdc2f30398e4eabffa6.exe	RegSvcs.exe
PID 1408 wrote to memory of 524	1408	21037d3de36ca089fdc638c7a3a09a00568d5d56e16aebdc2f30398e4eabffa6.exe	RegSvcs.exe
PID 1212 wrote to memory of 1768	1212	Explorer.EXE	raserver.exe
PID 1212 wrote to memory of 1768	1212	Explorer.EXE	raserver.exe
PID 1212 wrote to memory of 1768	1212	Explorer.EXE	raserver.exe
PID 1212 wrote to memory of 1768	1212	Explorer.EXE	raserver.exe
PID 1768 wrote to memory of 1680	1768	raserver.exe	cmd.exe
PID 1768 wrote to memory of 1680	1768	raserver.exe	cmd.exe
PID 1768 wrote to memory of 1680	1768	raserver.exe	cmd.exe
PID 1768 wrote to memory of 1680	1768	raserver.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1212

C:\Users\Admin\AppData\Local\Temp\21037d3de36ca089fdc638c7a3a09a00568d5d56e16aebdc2f30398e4eabffa6.exe
"C:\Users\Admin\AppData\Local\Temp\21037d3de36ca089fdc638c7a3a09a00568d5d56e16aebdc2f30398e4eabffa6.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1408

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\KyNIdwQNqUYs" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7C90.tmp"
3⤵
- Creates scheduled task(s)
PID:908

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:524

C:\Windows\SysWOW64\raserver.exe
"C:\Windows\SysWOW64\raserver.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1768

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
3⤵
PID:1680

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp7C90.tmp
Filesize
1KB

MD5
82774511eb321735e61d6d93bc56b52a

SHA1
b063eed8a38135a6d3cbf9788e9acc9d57febc7f

SHA256
b190743f3b9348c601af1f0d1834a0dfdfb99adcb06dbee37e0b19bcc8894bf2

SHA512
c93b02e30ee6f8db8fdff477536551c2dd353a76fef084cd0be18fef431f098df703195c73ba2808d066cc6a4547f1bed7bf4c923572b5d49725ccfd8182ab24

Download Submit
memory/524-68-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/524-72-0x0000000000220000-0x0000000000235000-memory.dmp

Filesize
84KB

Download
memory/524-71-0x00000000009E0000-0x0000000000CE3000-memory.dmp

Filesize
3.0MB

Download
memory/524-70-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/524-65-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/524-66-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/524-67-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1212-84-0x00000000072D0000-0x000000000741C000-memory.dmp

Filesize
1.3MB

Download
memory/1212-82-0x00000000072D0000-0x000000000741C000-memory.dmp

Filesize
1.3MB

Download
memory/1212-81-0x00000000072D0000-0x000000000741C000-memory.dmp

Filesize
1.3MB

Download
memory/1212-73-0x0000000004920000-0x0000000004A5A000-memory.dmp

Filesize
1.2MB

Download
memory/1408-60-0x00000000050C0000-0x0000000005148000-memory.dmp

Filesize
544KB

Download
memory/1408-57-0x000000007EF40000-0x000000007EF50000-memory.dmp

Filesize
64KB

Download
memory/1408-54-0x0000000000340000-0x00000000003E2000-memory.dmp

Filesize
648KB

Download
memory/1408-59-0x000000007EF40000-0x000000007EF50000-memory.dmp

Filesize
64KB

Download
memory/1408-58-0x0000000004C60000-0x0000000004CA0000-memory.dmp

Filesize
256KB

Download
memory/1408-55-0x0000000004C60000-0x0000000004CA0000-memory.dmp

Filesize
256KB

Download
memory/1408-56-0x0000000000640000-0x000000000064C000-memory.dmp

Filesize
48KB

Download
memory/1408-61-0x0000000002030000-0x0000000002064000-memory.dmp

Filesize
208KB

Download
memory/1768-77-0x0000000000A10000-0x0000000000D13000-memory.dmp

Filesize
3.0MB

Download
memory/1768-78-0x0000000000080000-0x00000000000AF000-memory.dmp

Filesize
188KB

Download
memory/1768-76-0x0000000000080000-0x00000000000AF000-memory.dmp

Filesize
188KB

Download
memory/1768-80-0x00000000008F0000-0x0000000000984000-memory.dmp

Filesize
592KB

Download
memory/1768-75-0x0000000000F00000-0x0000000000F1C000-memory.dmp

Filesize
112KB

Download
memory/1768-74-0x0000000000F00000-0x0000000000F1C000-memory.dmp

Filesize
112KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads