formbook | b289fe67b0185e1ba0177f583675ce399772bf03fd813d47835c45427f71fbf0

General

Target

Ordem de compra confirmada OC 215 Nortaluga Lda 08082023.exe
Size

806KB
MD5

5f41a9b656d58e1490e0689dfcbac025
SHA1

4f604324498d3b23c410f50cb20f4c7d0077115d
SHA256

b289fe67b0185e1ba0177f583675ce399772bf03fd813d47835c45427f71fbf0
SHA512

4246060c3885ce954b70252f68d7bd293672940c75a2a3a2fed7179320256239bd2bda1daaf89ecaf8b54be89f211ce799acd41d6fd2481c2e2e6a1b3fdc5e4a
SSDEEP

24576:Kik1oB0qnJjJuNXMJSCLAN548K7r26mgTlZ3:KikaBj7JYN548e26mi

Score

10^/10

formbook jr22 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

jr22

Decoy

941zhe.com

lunarportal.space

xn--osmaniyeiek-t9ab.online

trejoscar.com

nrnursery.com

quizcannot.cfd

seedstockersthailand.com

watsonwindow.com

wjfholdings.com

weziclondon.com

naruot.xyz

yeji.plus

classicmenstore.com

oharatravel.com

therapyplankits.com

keviegreshonpt.com

qdlyner.com

seithupaarungal.com

casinorates.online

8ug4as.icu

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2964-80-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/2964-92-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/2784-100-0x00000000000C0000-0x00000000000EF000-memory.dmp	formbook
behavioral1/memory/2784-102-0x00000000000C0000-0x00000000000EF000-memory.dmp	formbook

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2692 cmd.exe

pid	process
2692	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

Ordem de compra confirmada OC 215 Nortaluga Lda 08082023.exeOrdem de compra confirmada OC 215 Nortaluga Lda 08082023.execontrol.exe

description	pid	process	target process
PID 2616 set thread context of 2964	2616	Ordem de compra confirmada OC 215 Nortaluga Lda 08082023.exe	Ordem de compra confirmada OC 215 Nortaluga Lda 08082023.exe
PID 2964 set thread context of 1400	2964	Ordem de compra confirmada OC 215 Nortaluga Lda 08082023.exe	Explorer.EXE
PID 2784 set thread context of 1400	2784	control.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2332 schtasks.exe

pid	process
2332	schtasks.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

Processes:

powershell.exepowershell.exeOrdem de compra confirmada OC 215 Nortaluga Lda 08082023.execontrol.exe

pid	process
324	powershell.exe
2172	powershell.exe
2964	Ordem de compra confirmada OC 215 Nortaluga Lda 08082023.exe
2964	Ordem de compra confirmada OC 215 Nortaluga Lda 08082023.exe
2784	control.exe
2784	control.exe
2784	control.exe
2784	control.exe
2784	control.exe
2784	control.exe
2784	control.exe
2784	control.exe
2784	control.exe
2784	control.exe
2784	control.exe
2784	control.exe
2784	control.exe
2784	control.exe
2784	control.exe
2784	control.exe
2784	control.exe
2784	control.exe
2784	control.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1400 Explorer.EXE

pid	process
1400	Explorer.EXE

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

Ordem de compra confirmada OC 215 Nortaluga Lda 08082023.execontrol.exe

pid	process
2964	Ordem de compra confirmada OC 215 Nortaluga Lda 08082023.exe
2964	Ordem de compra confirmada OC 215 Nortaluga Lda 08082023.exe
2964	Ordem de compra confirmada OC 215 Nortaluga Lda 08082023.exe
2784	control.exe
2784	control.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.exepowershell.exeOrdem de compra confirmada OC 215 Nortaluga Lda 08082023.execontrol.exe

description	pid	process
Token: SeDebugPrivilege	324	powershell.exe
Token: SeDebugPrivilege	2172	powershell.exe
Token: SeDebugPrivilege	2964	Ordem de compra confirmada OC 215 Nortaluga Lda 08082023.exe
Token: SeDebugPrivilege	2784	control.exe

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

Ordem de compra confirmada OC 215 Nortaluga Lda 08082023.exeExplorer.EXEcontrol.exe

description	pid	process	target process
PID 2616 wrote to memory of 2172	2616	Ordem de compra confirmada OC 215 Nortaluga Lda 08082023.exe	powershell.exe
PID 2616 wrote to memory of 2172	2616	Ordem de compra confirmada OC 215 Nortaluga Lda 08082023.exe	powershell.exe
PID 2616 wrote to memory of 2172	2616	Ordem de compra confirmada OC 215 Nortaluga Lda 08082023.exe	powershell.exe
PID 2616 wrote to memory of 2172	2616	Ordem de compra confirmada OC 215 Nortaluga Lda 08082023.exe	powershell.exe
PID 2616 wrote to memory of 324	2616	Ordem de compra confirmada OC 215 Nortaluga Lda 08082023.exe	powershell.exe
PID 2616 wrote to memory of 324	2616	Ordem de compra confirmada OC 215 Nortaluga Lda 08082023.exe	powershell.exe
PID 2616 wrote to memory of 324	2616	Ordem de compra confirmada OC 215 Nortaluga Lda 08082023.exe	powershell.exe
PID 2616 wrote to memory of 324	2616	Ordem de compra confirmada OC 215 Nortaluga Lda 08082023.exe	powershell.exe
PID 2616 wrote to memory of 2332	2616	Ordem de compra confirmada OC 215 Nortaluga Lda 08082023.exe	schtasks.exe
PID 2616 wrote to memory of 2332	2616	Ordem de compra confirmada OC 215 Nortaluga Lda 08082023.exe	schtasks.exe
PID 2616 wrote to memory of 2332	2616	Ordem de compra confirmada OC 215 Nortaluga Lda 08082023.exe	schtasks.exe
PID 2616 wrote to memory of 2332	2616	Ordem de compra confirmada OC 215 Nortaluga Lda 08082023.exe	schtasks.exe
PID 2616 wrote to memory of 2964	2616	Ordem de compra confirmada OC 215 Nortaluga Lda 08082023.exe	Ordem de compra confirmada OC 215 Nortaluga Lda 08082023.exe
PID 2616 wrote to memory of 2964	2616	Ordem de compra confirmada OC 215 Nortaluga Lda 08082023.exe	Ordem de compra confirmada OC 215 Nortaluga Lda 08082023.exe
PID 2616 wrote to memory of 2964	2616	Ordem de compra confirmada OC 215 Nortaluga Lda 08082023.exe	Ordem de compra confirmada OC 215 Nortaluga Lda 08082023.exe
PID 2616 wrote to memory of 2964	2616	Ordem de compra confirmada OC 215 Nortaluga Lda 08082023.exe	Ordem de compra confirmada OC 215 Nortaluga Lda 08082023.exe
PID 2616 wrote to memory of 2964	2616	Ordem de compra confirmada OC 215 Nortaluga Lda 08082023.exe	Ordem de compra confirmada OC 215 Nortaluga Lda 08082023.exe
PID 2616 wrote to memory of 2964	2616	Ordem de compra confirmada OC 215 Nortaluga Lda 08082023.exe	Ordem de compra confirmada OC 215 Nortaluga Lda 08082023.exe
PID 2616 wrote to memory of 2964	2616	Ordem de compra confirmada OC 215 Nortaluga Lda 08082023.exe	Ordem de compra confirmada OC 215 Nortaluga Lda 08082023.exe
PID 1400 wrote to memory of 2784	1400	Explorer.EXE	control.exe
PID 1400 wrote to memory of 2784	1400	Explorer.EXE	control.exe
PID 1400 wrote to memory of 2784	1400	Explorer.EXE	control.exe
PID 1400 wrote to memory of 2784	1400	Explorer.EXE	control.exe
PID 2784 wrote to memory of 2692	2784	control.exe	cmd.exe
PID 2784 wrote to memory of 2692	2784	control.exe	cmd.exe
PID 2784 wrote to memory of 2692	2784	control.exe	cmd.exe
PID 2784 wrote to memory of 2692	2784	control.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1400

C:\Users\Admin\AppData\Local\Temp\Ordem de compra confirmada OC 215 Nortaluga Lda 08082023.exe
"C:\Users\Admin\AppData\Local\Temp\Ordem de compra confirmada OC 215 Nortaluga Lda 08082023.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2616

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Ordem de compra confirmada OC 215 Nortaluga Lda 08082023.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2172

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\lbAVIbuklDrX.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:324

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lbAVIbuklDrX" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7B77.tmp"
3⤵
- Creates scheduled task(s)
PID:2332

C:\Users\Admin\AppData\Local\Temp\Ordem de compra confirmada OC 215 Nortaluga Lda 08082023.exe
"C:\Users\Admin\AppData\Local\Temp\Ordem de compra confirmada OC 215 Nortaluga Lda 08082023.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2964

C:\Windows\SysWOW64\control.exe
"C:\Windows\SysWOW64\control.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2784

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\Ordem de compra confirmada OC 215 Nortaluga Lda 08082023.exe"
3⤵
- Deletes itself
PID:2692

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp7B77.tmp
Filesize
1KB

MD5
58d9dba5a9f418fede26ae55c8e7b30c

SHA1
bd0481d6a9ce0c2ae028591f3cd1fab915a41498

SHA256
aebd4920a7fd27b01267468298e27dcae0f34d98353f46e2294906e50ead2e01

SHA512
148b733ec0134ca5c20e61e1eb72844eee27adaf553d7cf0b6fa4e0e3af07eed5b4b60fa83d51bc4e1b16b9394447dac128ccfd30c0ec9103464d3df0611f8b9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\Z0P7C7U8E5RH5XL93IKZ.temp
Filesize
7KB

MD5
365c719831004ca99e791a83833ec420

SHA1
62e04cc31b09b0209e247d3e88225bedebab0303

SHA256
2c5e4728e7ef3dda51f54d78e0cf914ac9f3e1b96a448e99916613e0ad45189d

SHA512
19033b8f4d2b7dc4a14ebd9233be7126f668eca6aebd4c6adb43626c44bd01a79f4b191b49b49786eaa8e3875ed8ed73d06981c4c6e63a87aade08b4ccf8eef9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
365c719831004ca99e791a83833ec420

SHA1
62e04cc31b09b0209e247d3e88225bedebab0303

SHA256
2c5e4728e7ef3dda51f54d78e0cf914ac9f3e1b96a448e99916613e0ad45189d

SHA512
19033b8f4d2b7dc4a14ebd9233be7126f668eca6aebd4c6adb43626c44bd01a79f4b191b49b49786eaa8e3875ed8ed73d06981c4c6e63a87aade08b4ccf8eef9

Download Submit
memory/324-97-0x000000006F290000-0x000000006F83B000-memory.dmp

Filesize
5.7MB

Download
memory/324-87-0x0000000001E60000-0x0000000001EA0000-memory.dmp

Filesize
256KB

Download
memory/324-85-0x000000006F290000-0x000000006F83B000-memory.dmp

Filesize
5.7MB

Download
memory/324-83-0x0000000001E60000-0x0000000001EA0000-memory.dmp

Filesize
256KB

Download
memory/324-82-0x000000006F290000-0x000000006F83B000-memory.dmp

Filesize
5.7MB

Download
memory/1400-95-0x00000000069D0000-0x0000000006AD4000-memory.dmp

Filesize
1.0MB

Download
memory/1400-108-0x0000000006DF0000-0x0000000006F38000-memory.dmp

Filesize
1.3MB

Download
memory/1400-106-0x0000000006DF0000-0x0000000006F38000-memory.dmp

Filesize
1.3MB

Download
memory/1400-105-0x0000000006DF0000-0x0000000006F38000-memory.dmp

Filesize
1.3MB

Download
memory/2172-84-0x0000000002460000-0x00000000024A0000-memory.dmp

Filesize
256KB

Download
memory/2172-96-0x000000006F290000-0x000000006F83B000-memory.dmp

Filesize
5.7MB

Download
memory/2172-89-0x000000006F290000-0x000000006F83B000-memory.dmp

Filesize
5.7MB

Download
memory/2172-88-0x0000000002460000-0x00000000024A0000-memory.dmp

Filesize
256KB

Download
memory/2172-86-0x000000006F290000-0x000000006F83B000-memory.dmp

Filesize
5.7MB

Download
memory/2616-59-0x0000000004980000-0x00000000049C0000-memory.dmp

Filesize
256KB

Download
memory/2616-60-0x00000000003E0000-0x00000000003EE000-memory.dmp

Filesize
56KB

Download
memory/2616-57-0x00000000003B0000-0x00000000003C6000-memory.dmp

Filesize
88KB

Download
memory/2616-61-0x00000000058A0000-0x0000000005926000-memory.dmp

Filesize
536KB

Download
memory/2616-56-0x0000000004980000-0x00000000049C0000-memory.dmp

Filesize
256KB

Download
memory/2616-81-0x0000000074250000-0x000000007493E000-memory.dmp

Filesize
6.9MB

Download
memory/2616-58-0x0000000074250000-0x000000007493E000-memory.dmp

Filesize
6.9MB

Download
memory/2616-54-0x0000000000F80000-0x0000000001050000-memory.dmp

Filesize
832KB

Download
memory/2616-55-0x0000000074250000-0x000000007493E000-memory.dmp

Filesize
6.9MB

Download
memory/2784-102-0x00000000000C0000-0x00000000000EF000-memory.dmp

Filesize
188KB

Download
memory/2784-104-0x0000000001E70000-0x0000000001F03000-memory.dmp

Filesize
588KB

Download
memory/2784-101-0x00000000020A0000-0x00000000023A3000-memory.dmp

Filesize
3.0MB

Download
memory/2784-100-0x00000000000C0000-0x00000000000EF000-memory.dmp

Filesize
188KB

Download
memory/2784-98-0x0000000000260000-0x000000000027F000-memory.dmp

Filesize
124KB

Download
memory/2784-99-0x0000000000260000-0x000000000027F000-memory.dmp

Filesize
124KB

Download
memory/2964-80-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2964-78-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2964-93-0x00000000001C0000-0x00000000001D4000-memory.dmp

Filesize
80KB

Download
memory/2964-92-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2964-76-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2964-74-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2964-90-0x0000000000890000-0x0000000000B93000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads