formbook | 21037d3de36ca089fdc638c7a3a09a00568d5d56e16aebdc2f30398e4eabffa6

General

Target

21037d3de36ca089fdc638c7a3a09a00568d5d56e16aebdc2f30398e4eabffa6.exe
Size

625KB
MD5

6ababfe9f98d833317f718c4d3d74145
SHA1

03e660fe8bd44ae1301ec24bd115ed9637d18ba8
SHA256

21037d3de36ca089fdc638c7a3a09a00568d5d56e16aebdc2f30398e4eabffa6
SHA512

e355768fd84b7f8ba9db72bc5d8c3514c826f5bd1f36f87094f7679665022f5095296216c951a2a68378f6ab5fd8be74f6fff4d566eb367397e16921be8cdc16
SSDEEP

12288:V0v9iQf9KqnAoDpcz/dJenAIQvNmpZiollSkz8+cZl5:VUNfbnHqz/+nAIDzl8NZl5

Score

10^/10

formbook m82 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

m82

Decoy

jamesdevereux.com

artificialturfminneapolis.com

hongmeiyan.com

lojaderoupasbr.com

yit.africa

austinrelocationexpert.com

saiva.page

exitsategy.com

chochonux.com

klosterbraeu-unterliezheim.com

byseymanur.com

sblwarwickshire.co.uk

brazimaid.com

ciogame.com

bronzesailing.com

dwkapl.xyz

022dyd.com

compassandpathwriting.com

alphabet1x.com

selfcleaninghairbrush.co.uk

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3508-146-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/3508-152-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/3260-156-0x0000000000A50000-0x0000000000A7F000-memory.dmp	formbook
behavioral2/memory/3260-158-0x0000000000A50000-0x0000000000A7F000-memory.dmp	formbook

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

21037d3de36ca089fdc638c7a3a09a00568d5d56e16aebdc2f30398e4eabffa6.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	21037d3de36ca089fdc638c7a3a09a00568d5d56e16aebdc2f30398e4eabffa6.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

21037d3de36ca089fdc638c7a3a09a00568d5d56e16aebdc2f30398e4eabffa6.exeRegSvcs.exerundll32.exe

description	pid	process	target process
PID 4232 set thread context of 3508	4232	21037d3de36ca089fdc638c7a3a09a00568d5d56e16aebdc2f30398e4eabffa6.exe	RegSvcs.exe
PID 3508 set thread context of 3116	3508	RegSvcs.exe	Explorer.EXE
PID 3260 set thread context of 3116	3260	rundll32.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1844 schtasks.exe

pid	process
1844	schtasks.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

Processes:

RegSvcs.exerundll32.exe

pid	process
3508	RegSvcs.exe
3508	RegSvcs.exe
3508	RegSvcs.exe
3508	RegSvcs.exe
3260	rundll32.exe
3260	rundll32.exe
3260	rundll32.exe
3260	rundll32.exe
3260	rundll32.exe
3260	rundll32.exe
3260	rundll32.exe
3260	rundll32.exe
3260	rundll32.exe
3260	rundll32.exe
3260	rundll32.exe
3260	rundll32.exe
3260	rundll32.exe
3260	rundll32.exe
3260	rundll32.exe
3260	rundll32.exe
3260	rundll32.exe
3260	rundll32.exe
3260	rundll32.exe
3260	rundll32.exe
3260	rundll32.exe
3260	rundll32.exe
3260	rundll32.exe
3260	rundll32.exe
3260	rundll32.exe
3260	rundll32.exe
3260	rundll32.exe
3260	rundll32.exe
3260	rundll32.exe
3260	rundll32.exe
3260	rundll32.exe
3260	rundll32.exe
3260	rundll32.exe
3260	rundll32.exe
3260	rundll32.exe
3260	rundll32.exe
3260	rundll32.exe
3260	rundll32.exe
3260	rundll32.exe
3260	rundll32.exe
3260	rundll32.exe
3260	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

3116 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

RegSvcs.exerundll32.exe

pid process

3508 RegSvcs.exe
3508 RegSvcs.exe
3508 RegSvcs.exe
3260 rundll32.exe
3260 rundll32.exe

pid	process
3116	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

RegSvcs.exeExplorer.EXErundll32.exe

description	pid	process
Token: SeDebugPrivilege	3508	RegSvcs.exe
Token: SeShutdownPrivilege	3116	Explorer.EXE
Token: SeCreatePagefilePrivilege	3116	Explorer.EXE
Token: SeShutdownPrivilege	3116	Explorer.EXE
Token: SeCreatePagefilePrivilege	3116	Explorer.EXE
Token: SeDebugPrivilege	3260	rundll32.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

21037d3de36ca089fdc638c7a3a09a00568d5d56e16aebdc2f30398e4eabffa6.exeExplorer.EXErundll32.exe

description	pid	process	target process
PID 4232 wrote to memory of 1844	4232	21037d3de36ca089fdc638c7a3a09a00568d5d56e16aebdc2f30398e4eabffa6.exe	schtasks.exe
PID 4232 wrote to memory of 1844	4232	21037d3de36ca089fdc638c7a3a09a00568d5d56e16aebdc2f30398e4eabffa6.exe	schtasks.exe
PID 4232 wrote to memory of 1844	4232	21037d3de36ca089fdc638c7a3a09a00568d5d56e16aebdc2f30398e4eabffa6.exe	schtasks.exe
PID 4232 wrote to memory of 3508	4232	21037d3de36ca089fdc638c7a3a09a00568d5d56e16aebdc2f30398e4eabffa6.exe	RegSvcs.exe
PID 4232 wrote to memory of 3508	4232	21037d3de36ca089fdc638c7a3a09a00568d5d56e16aebdc2f30398e4eabffa6.exe	RegSvcs.exe
PID 4232 wrote to memory of 3508	4232	21037d3de36ca089fdc638c7a3a09a00568d5d56e16aebdc2f30398e4eabffa6.exe	RegSvcs.exe
PID 4232 wrote to memory of 3508	4232	21037d3de36ca089fdc638c7a3a09a00568d5d56e16aebdc2f30398e4eabffa6.exe	RegSvcs.exe
PID 4232 wrote to memory of 3508	4232	21037d3de36ca089fdc638c7a3a09a00568d5d56e16aebdc2f30398e4eabffa6.exe	RegSvcs.exe
PID 4232 wrote to memory of 3508	4232	21037d3de36ca089fdc638c7a3a09a00568d5d56e16aebdc2f30398e4eabffa6.exe	RegSvcs.exe
PID 3116 wrote to memory of 3260	3116	Explorer.EXE	rundll32.exe
PID 3116 wrote to memory of 3260	3116	Explorer.EXE	rundll32.exe
PID 3116 wrote to memory of 3260	3116	Explorer.EXE	rundll32.exe
PID 3260 wrote to memory of 4548	3260	rundll32.exe	cmd.exe
PID 3260 wrote to memory of 4548	3260	rundll32.exe	cmd.exe
PID 3260 wrote to memory of 4548	3260	rundll32.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3116

C:\Users\Admin\AppData\Local\Temp\21037d3de36ca089fdc638c7a3a09a00568d5d56e16aebdc2f30398e4eabffa6.exe
"C:\Users\Admin\AppData\Local\Temp\21037d3de36ca089fdc638c7a3a09a00568d5d56e16aebdc2f30398e4eabffa6.exe"
2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4232

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\KyNIdwQNqUYs" /XML "C:\Users\Admin\AppData\Local\Temp\tmp50EF.tmp"
3⤵
- Creates scheduled task(s)
PID:1844

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3508

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\SysWOW64\rundll32.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3260

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
3⤵
PID:4548

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp50EF.tmp
Filesize
1KB

MD5
022002b623822fc562c606509a4cd359

SHA1
e97a452dcc5a28bbc6dd5c88e4d77b931f44392a

SHA256
9e8a9eabd79c05f2460f812416c54d8b1b6f058c1e5f908624eac6b026db7615

SHA512
0ac14475ee90c2e3a49817daf47f9bfbd9c81019217919ae6ae7aaa1d4dc9a84eff498831fb0333d397268af28cb448c1d129a0b605387b53ddc29f2644d35cf

Download Submit
memory/3116-151-0x00000000082A0000-0x000000000842C000-memory.dmp

Filesize
1.5MB

Download
memory/3116-164-0x0000000002C20000-0x0000000002D0F000-memory.dmp

Filesize
956KB

Download
memory/3116-162-0x0000000002C20000-0x0000000002D0F000-memory.dmp

Filesize
956KB

Download
memory/3116-161-0x0000000002C20000-0x0000000002D0F000-memory.dmp

Filesize
956KB

Download
memory/3260-160-0x00000000027E0000-0x0000000002874000-memory.dmp

Filesize
592KB

Download
memory/3260-158-0x0000000000A50000-0x0000000000A7F000-memory.dmp

Filesize
188KB

Download
memory/3260-157-0x0000000002A40000-0x0000000002D8A000-memory.dmp

Filesize
3.3MB

Download
memory/3260-156-0x0000000000A50000-0x0000000000A7F000-memory.dmp

Filesize
188KB

Download
memory/3260-155-0x0000000000DF0000-0x0000000000E04000-memory.dmp

Filesize
80KB

Download
memory/3260-153-0x0000000000DF0000-0x0000000000E04000-memory.dmp

Filesize
80KB

Download
memory/3508-149-0x00000000015E0000-0x000000000192A000-memory.dmp

Filesize
3.3MB

Download
memory/3508-152-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3508-150-0x0000000001500000-0x0000000001515000-memory.dmp

Filesize
84KB

Download
memory/3508-146-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4232-140-0x000000007F6E0000-0x000000007F6F0000-memory.dmp

Filesize
64KB

Download
memory/4232-142-0x000000007F6E0000-0x000000007F6F0000-memory.dmp

Filesize
64KB

Download
memory/4232-141-0x0000000004D60000-0x0000000004D70000-memory.dmp

Filesize
64KB

Download
memory/4232-133-0x0000000000370000-0x0000000000412000-memory.dmp

Filesize
648KB

Download
memory/4232-139-0x0000000004D60000-0x0000000004D70000-memory.dmp

Filesize
64KB

Download
memory/4232-138-0x00000000050D0000-0x0000000005126000-memory.dmp

Filesize
344KB

Download
memory/4232-137-0x0000000004E80000-0x0000000004E8A000-memory.dmp

Filesize
40KB

Download
memory/4232-136-0x0000000004EE0000-0x0000000004F72000-memory.dmp

Filesize
584KB

Download
memory/4232-135-0x00000000053F0000-0x0000000005994000-memory.dmp

Filesize
5.6MB

Download
memory/4232-134-0x0000000004DA0000-0x0000000004E3C000-memory.dmp

Filesize
624KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads