formbook | 2a43da13d635789edfb0cd6928427911e3295c06e921cebdaa3319c7c1f65b77

Analysis

max time kernel
149s
max time network
143s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
03/07/2023, 13:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tmp.exe
Size

661KB
MD5

bbd078b0a1887a7ee952c1b8689f3cc8
SHA1

41d194f5ad444d504b0df6753b2ee344477df966
SHA256

2a43da13d635789edfb0cd6928427911e3295c06e921cebdaa3319c7c1f65b77
SHA512

31454bf7baeea799465bf6adad68745d0f637f05acb5143e0a745ca8530acb2a1ffe75d9d0851ab85a447b5d56807e9388ffbda87746f45130eb1b5f90646d2d
SSDEEP

12288:R7m72iNQveOlVp2So0hOmAVVOFArlqm5okVPYVtO4JwKQrPvwDi:g1CeEVpBo0DAVnbPSrZJrDi

Score

10^/10

formbook fgh2 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

fgh2

Decoy

jmplanejamento.com

fredinformatica.store

ekinarslan.com

dymovoi.site

fantasywagon.store

aigpthome.net

magadonian.club

artmartco.com

chk7.com

saltybeachtravels.com

ffdreakfas514.com

70555.top

studioeminc.com

ei863.com

ky55.xyz

xn--12c1cc1b5dd4n.com

aimedicarecoverage.com

varsasenindir.com

intuityx.com

mainfocusmediacompany.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 5 IoCs

rat

resource	yara_rule
behavioral1/memory/1424-63-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1424-73-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1424-78-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/548-82-0x00000000000D0000-0x00000000000FF000-memory.dmp	formbook
behavioral1/memory/548-84-0x00000000000D0000-0x00000000000FF000-memory.dmp	formbook

Deletes itself 1 IoCs

pid	Process
828	cmd.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2028 set thread context of 1424	2028	tmp.exe	32
PID 1424 set thread context of 1320	1424	tmp.exe	14
PID 1424 set thread context of 1320	1424	tmp.exe	14
PID 548 set thread context of 1320	548	msiexec.exe	14

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
2028	tmp.exe
2028	tmp.exe
1420	powershell.exe
1424	tmp.exe
1424	tmp.exe
1424	tmp.exe
548	msiexec.exe
548	msiexec.exe
548	msiexec.exe
548	msiexec.exe
548	msiexec.exe
548	msiexec.exe
548	msiexec.exe
548	msiexec.exe
548	msiexec.exe
548	msiexec.exe
548	msiexec.exe
548	msiexec.exe
548	msiexec.exe
548	msiexec.exe
548	msiexec.exe
548	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1320	Explorer.EXE

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
1424	tmp.exe
1424	tmp.exe
1424	tmp.exe
1424	tmp.exe
548	msiexec.exe
548	msiexec.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2028	tmp.exe
Token: SeDebugPrivilege	1420	powershell.exe
Token: SeDebugPrivilege	1424	tmp.exe
Token: SeDebugPrivilege	548	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1320	Explorer.EXE
1320	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1320	Explorer.EXE
1320	Explorer.EXE

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 1420	2028	tmp.exe	28
PID 2028 wrote to memory of 1420	2028	tmp.exe	28
PID 2028 wrote to memory of 1420	2028	tmp.exe	28
PID 2028 wrote to memory of 1420	2028	tmp.exe	28
PID 2028 wrote to memory of 464	2028	tmp.exe	30
PID 2028 wrote to memory of 464	2028	tmp.exe	30
PID 2028 wrote to memory of 464	2028	tmp.exe	30
PID 2028 wrote to memory of 464	2028	tmp.exe	30
PID 2028 wrote to memory of 616	2028	tmp.exe	31
PID 2028 wrote to memory of 616	2028	tmp.exe	31
PID 2028 wrote to memory of 616	2028	tmp.exe	31
PID 2028 wrote to memory of 616	2028	tmp.exe	31
PID 2028 wrote to memory of 1424	2028	tmp.exe	32
PID 2028 wrote to memory of 1424	2028	tmp.exe	32
PID 2028 wrote to memory of 1424	2028	tmp.exe	32
PID 2028 wrote to memory of 1424	2028	tmp.exe	32
PID 2028 wrote to memory of 1424	2028	tmp.exe	32
PID 2028 wrote to memory of 1424	2028	tmp.exe	32
PID 2028 wrote to memory of 1424	2028	tmp.exe	32
PID 1424 wrote to memory of 548	1424	tmp.exe	33
PID 1424 wrote to memory of 548	1424	tmp.exe	33
PID 1424 wrote to memory of 548	1424	tmp.exe	33
PID 1424 wrote to memory of 548	1424	tmp.exe	33
PID 1424 wrote to memory of 548	1424	tmp.exe	33
PID 1424 wrote to memory of 548	1424	tmp.exe	33
PID 1424 wrote to memory of 548	1424	tmp.exe	33
PID 548 wrote to memory of 828	548	msiexec.exe	34
PID 548 wrote to memory of 828	548	msiexec.exe	34
PID 548 wrote to memory of 828	548	msiexec.exe	34
PID 548 wrote to memory of 828	548	msiexec.exe	34

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1320
- C:\Users\Admin\AppData\Local\Temp\tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2028
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1420
- - C:\Users\Admin\AppData\Local\Temp\tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
    3⤵
    PID:464
- - C:\Users\Admin\AppData\Local\Temp\tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
    3⤵
    PID:616
- - C:\Users\Admin\AppData\Local\Temp\tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1424
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\SysWOW64\msiexec.exe"
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:548
    - - C:\Windows\SysWOW64\cmd.exe
        
        /c del "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
        5⤵
        Deletes itself
        
        PID:828

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/548-77-0x0000000000470000-0x0000000000484000-memory.dmp

Filesize
80KB

Download
memory/548-86-0x0000000002020000-0x00000000020B3000-memory.dmp

Filesize
588KB

Download
memory/548-84-0x00000000000D0000-0x00000000000FF000-memory.dmp

Filesize
188KB

Download
memory/548-82-0x00000000000D0000-0x00000000000FF000-memory.dmp

Filesize
188KB

Download
memory/548-83-0x0000000002130000-0x0000000002433000-memory.dmp

Filesize
3.0MB

Download
memory/548-81-0x0000000000470000-0x0000000000484000-memory.dmp

Filesize
80KB

Download
memory/548-79-0x0000000000470000-0x0000000000484000-memory.dmp

Filesize
80KB

Download
memory/1320-72-0x0000000006820000-0x0000000006909000-memory.dmp

Filesize
932KB

Download
memory/1320-74-0x0000000000320000-0x0000000000420000-memory.dmp

Filesize
1024KB

Download
memory/1320-91-0x0000000004A60000-0x0000000004B01000-memory.dmp

Filesize
644KB

Download
memory/1320-89-0x0000000004A60000-0x0000000004B01000-memory.dmp

Filesize
644KB

Download
memory/1320-87-0x0000000004A60000-0x0000000004B01000-memory.dmp

Filesize
644KB

Download
memory/1320-85-0x0000000002C90000-0x0000000002D90000-memory.dmp

Filesize
1024KB

Download
memory/1320-76-0x0000000006A10000-0x0000000006B3F000-memory.dmp

Filesize
1.2MB

Download
memory/1420-66-0x0000000002170000-0x00000000021B0000-memory.dmp

Filesize
256KB

Download
memory/1420-67-0x0000000002170000-0x00000000021B0000-memory.dmp

Filesize
256KB

Download
memory/1424-71-0x0000000000190000-0x00000000001A4000-memory.dmp

Filesize
80KB

Download
memory/1424-62-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1424-73-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1424-61-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1424-78-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1424-60-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1424-63-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1424-75-0x00000000001D0000-0x00000000001E4000-memory.dmp

Filesize
80KB

Download
memory/1424-70-0x0000000000910000-0x0000000000C13000-memory.dmp

Filesize
3.0MB

Download
memory/2028-58-0x0000000000510000-0x000000000051C000-memory.dmp

Filesize
48KB

Download
memory/2028-54-0x0000000000DE0000-0x0000000000E8C000-memory.dmp

Filesize
688KB

Download
memory/2028-55-0x0000000004D00000-0x0000000004D40000-memory.dmp

Filesize
256KB

Download
memory/2028-56-0x00000000004B0000-0x00000000004BC000-memory.dmp

Filesize
48KB

Download
memory/2028-57-0x0000000004D00000-0x0000000004D40000-memory.dmp

Filesize
256KB

Download
memory/2028-59-0x0000000005450000-0x00000000054BE000-memory.dmp

Filesize
440KB

Download