formbook | 2dac9bdaba5c690cfd8294096757b5a80607321dc364080337a0237fa8388f17

General

Target

new.exe
Size

601KB
MD5

867122eba50577eccdc2baadb512178e
SHA1

8eaef52def03a02d820a40de9d489db953b60853
SHA256

2dac9bdaba5c690cfd8294096757b5a80607321dc364080337a0237fa8388f17
SHA512

611c8dc9bfa0fbcc655e268fd18f1978667bbfd16fa7840c539ec58a5ccb6d969218334f9dfa6827d696cfd9dd23a6e27c0d7578a9ace444160e4634ccbb8bfc
SSDEEP

12288:nc/FuT/euHB93Z5xeOwIqFPkkfd1R1PsSMWDEt:YuLNh1rxiHPLL7h0

Score

10^/10

formbook m82 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

m82

Decoy

jamesdevereux.com

artificialturfminneapolis.com

hongmeiyan.com

lojaderoupasbr.com

yit.africa

austinrelocationexpert.com

saiva.page

exitsategy.com

chochonux.com

klosterbraeu-unterliezheim.com

byseymanur.com

sblwarwickshire.co.uk

brazimaid.com

ciogame.com

bronzesailing.com

dwkapl.xyz

022dyd.com

compassandpathwriting.com

alphabet1x.com

selfcleaninghairbrush.co.uk

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 5 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1800-15-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/1800-20-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/1800-24-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/4752-30-0x00000000008B0000-0x00000000008DF000-memory.dmp	formbook
behavioral2/memory/4752-32-0x00000000008B0000-0x00000000008DF000-memory.dmp	formbook

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

new.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-3028534956-1709433221-1313273668-1000\Control Panel\International\Geo\Nation new.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3028534956-1709433221-1313273668-1000\Control Panel\International\Geo\Nation	new.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

new.exeRegSvcs.exeexplorer.exe

description	pid	process	target process
PID 4552 set thread context of 1800	4552	new.exe	RegSvcs.exe
PID 1800 set thread context of 3264	1800	RegSvcs.exe	Explorer.EXE
PID 1800 set thread context of 3264	1800	RegSvcs.exe	Explorer.EXE
PID 4752 set thread context of 3264	4752	explorer.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

5052 schtasks.exe

pid	process
5052	schtasks.exe

Suspicious behavior: EnumeratesProcesses 39 IoCs

Processes:

new.exeRegSvcs.exeexplorer.exe

pid	process
4552	new.exe
1800	RegSvcs.exe
1800	RegSvcs.exe
1800	RegSvcs.exe
1800	RegSvcs.exe
1800	RegSvcs.exe
1800	RegSvcs.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe

Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

RegSvcs.exeexplorer.exe

pid process

1800 RegSvcs.exe
1800 RegSvcs.exe
1800 RegSvcs.exe
1800 RegSvcs.exe
4752 explorer.exe
4752 explorer.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

new.exeRegSvcs.exeexplorer.exe

description pid process

Token: SeDebugPrivilege 4552 new.exe
Token: SeDebugPrivilege 1800 RegSvcs.exe
Token: SeDebugPrivilege 4752 explorer.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

3264 Explorer.EXE

pid	process
1800	RegSvcs.exe
1800	RegSvcs.exe
1800	RegSvcs.exe
1800	RegSvcs.exe
4752	explorer.exe
4752	explorer.exe

description	pid	process
Token: SeDebugPrivilege	4552	new.exe
Token: SeDebugPrivilege	1800	RegSvcs.exe
Token: SeDebugPrivilege	4752	explorer.exe

pid	process
3264	Explorer.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

new.exeRegSvcs.exeexplorer.exe

description	pid	process	target process
PID 4552 wrote to memory of 5052	4552	new.exe	schtasks.exe
PID 4552 wrote to memory of 5052	4552	new.exe	schtasks.exe
PID 4552 wrote to memory of 5052	4552	new.exe	schtasks.exe
PID 4552 wrote to memory of 1800	4552	new.exe	RegSvcs.exe
PID 4552 wrote to memory of 1800	4552	new.exe	RegSvcs.exe
PID 4552 wrote to memory of 1800	4552	new.exe	RegSvcs.exe
PID 4552 wrote to memory of 1800	4552	new.exe	RegSvcs.exe
PID 4552 wrote to memory of 1800	4552	new.exe	RegSvcs.exe
PID 4552 wrote to memory of 1800	4552	new.exe	RegSvcs.exe
PID 1800 wrote to memory of 4752	1800	RegSvcs.exe	explorer.exe
PID 1800 wrote to memory of 4752	1800	RegSvcs.exe	explorer.exe
PID 1800 wrote to memory of 4752	1800	RegSvcs.exe	explorer.exe
PID 4752 wrote to memory of 4468	4752	explorer.exe	cmd.exe
PID 4752 wrote to memory of 4468	4752	explorer.exe	cmd.exe
PID 4752 wrote to memory of 4468	4752	explorer.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of UnmapMainImage
PID:3264

C:\Users\Admin\AppData\Local\Temp\new.exe
"C:\Users\Admin\AppData\Local\Temp\new.exe"
2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4552

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sSADkvVYcfbx" /XML "C:\Users\Admin\AppData\Local\Temp\tmp52B.tmp"
3⤵
- Creates scheduled task(s)
PID:5052

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1800

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\SysWOW64\explorer.exe"
4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4752

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
5⤵
PID:4468

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:456

C:\Windows\SysWOW64\autochk.exe
"C:\Windows\SysWOW64\autochk.exe"
2⤵
PID:1684

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp52B.tmp
Filesize
1KB

MD5
0507707b560d6e8bd38855a4104a3ba5

SHA1
9a1032846e64a33ccc3b42d222ab60f0026f6b6c

SHA256
d77b2b6591d446a5e5195ed03860625d5c8e53c06552e16cc9819c016f2fef0b

SHA512
de2865a383a29851c5eb917706b80c2651b4f242802600a071b8b06c1cfbf01959da09e400367531dbd78599ec1797f80617d2ec57cfd5c04a4707e749bdd0d2

Download Submit
memory/1800-25-0x0000000001410000-0x0000000001425000-memory.dmp

Filesize
84KB

Download
memory/1800-15-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1800-20-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1800-21-0x0000000001390000-0x00000000013A5000-memory.dmp

Filesize
84KB

Download
memory/1800-24-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1800-18-0x00000000014F0000-0x000000000183A000-memory.dmp

Filesize
3.3MB

Download
memory/3264-26-0x0000000008660000-0x000000000878E000-memory.dmp

Filesize
1.2MB

Download
memory/3264-33-0x00000000081B0000-0x000000000833A000-memory.dmp

Filesize
1.5MB

Download
memory/3264-22-0x00000000081B0000-0x000000000833A000-memory.dmp

Filesize
1.5MB

Download
memory/3264-36-0x0000000008660000-0x000000000878E000-memory.dmp

Filesize
1.2MB

Download
memory/3264-38-0x0000000008790000-0x00000000088FC000-memory.dmp

Filesize
1.4MB

Download
memory/3264-39-0x0000000008790000-0x00000000088FC000-memory.dmp

Filesize
1.4MB

Download
memory/3264-42-0x0000000008790000-0x00000000088FC000-memory.dmp

Filesize
1.4MB

Download
memory/4552-8-0x0000000074D30000-0x00000000754E0000-memory.dmp

Filesize
7.7MB

Download
memory/4552-5-0x00000000051C0000-0x00000000051D0000-memory.dmp

Filesize
64KB

Download
memory/4552-11-0x00000000064D0000-0x0000000006504000-memory.dmp

Filesize
208KB

Download
memory/4552-10-0x0000000006450000-0x00000000064D4000-memory.dmp

Filesize
528KB

Download
memory/4552-9-0x00000000051C0000-0x00000000051D0000-memory.dmp

Filesize
64KB

Download
memory/4552-0-0x0000000074D30000-0x00000000754E0000-memory.dmp

Filesize
7.7MB

Download
memory/4552-7-0x00000000050F0000-0x00000000050FC000-memory.dmp

Filesize
48KB

Download
memory/4552-6-0x0000000004EF0000-0x0000000004EFA000-memory.dmp

Filesize
40KB

Download
memory/4552-1-0x0000000000470000-0x000000000050C000-memory.dmp

Filesize
624KB

Download
memory/4552-2-0x00000000054E0000-0x0000000005A84000-memory.dmp

Filesize
5.6MB

Download
memory/4552-3-0x0000000004F30000-0x0000000004FC2000-memory.dmp

Filesize
584KB

Download
memory/4552-4-0x0000000004FD0000-0x000000000506C000-memory.dmp

Filesize
624KB

Download
memory/4552-17-0x0000000074D30000-0x00000000754E0000-memory.dmp

Filesize
7.7MB

Download
memory/4752-32-0x00000000008B0000-0x00000000008DF000-memory.dmp

Filesize
188KB

Download
memory/4752-34-0x0000000002A90000-0x0000000002B24000-memory.dmp

Filesize
592KB

Download
memory/4752-31-0x0000000002C60000-0x0000000002FAA000-memory.dmp

Filesize
3.3MB

Download
memory/4752-30-0x00000000008B0000-0x00000000008DF000-memory.dmp

Filesize
188KB

Download
memory/4752-29-0x0000000000BC0000-0x0000000000FF3000-memory.dmp

Filesize
4.2MB

Download
memory/4752-27-0x0000000000BC0000-0x0000000000FF3000-memory.dmp

Filesize
4.2MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads