formbook | eeb9ebbaf564800d692de3de873fafbfb9ed9f47459e83bc4a2ffdc1503a1799

Resubmissions

28/04/2024, 12:29

240428-pnzvesfg66

29/01/2024, 15:20

240129-sqq7vaebej10

Analysis

max time kernel
148s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/01/2024, 15:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
нова поръчкаi pdf.exe
Size 676KB
Sample240129-sqq7vaebej
SHA256 eeb9ebbaf564800d692de3de873fafbfb9ed9f47459e83bc4a2ffdc1503a1799
MD5 9df143c9f9671c6f88b5d1d2aa0c8232
SHA1 c01cb1db4983207dc9395b86cf2bcbfba3a4d050
SHA512 d53c8f0ca6c94704dac279cb95a5a337e2af20f4592933dca844e2e4fb9cd40e474975f34ef2d573f2aaee2382ff48b58f3a425e5a4210aa49625024fea13634
SSDEEP 12288:5uAoIFFHgeg/cKWCT+pIET2znEglXFD7V0YVODak93GlNUD8sNG1qJ:5uAXFxvQxEsnEglXFD7ZVODacqMS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook g22y rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

g22y

Decoy

refashioned.biz
nzhorrorfan.com
warm-service.com
clickuppdemo.com
r7gkzfvyf.sbs
negativezeros.net
lepsirepy.online
xiatw6yxu.sbs
kingdom898.net
vnshh.com
saguaroconnectorpipeline.com
landscapingsmyrna.com
a2024.club
luisaenazul.com
kxwiz.online
99keji.com
kdawkmedia.com
livejunelake.xyz
ilfracombeproperty.com
dtfprintertransfers.com
phantomss.xyz
nschr1ql2.sbs
allu.fitness
helalalshamsi.com
j1mxn3o0d.sbs
justfetchit.com
semglutengourmet.com
quanshukan.com
nextgres.online
lincolnlegacyadvisors.com
81u0i0lh0ojxb8.xyz
juraganasik2.pro
peroduakajang.com
freedomhopper.com
uitmsems.online
aratstail.com
tvdewa.autos
evokeinteriorspace.com
83yg.xyz
i1kek8eeu.sbs
h95kt252fkd.shop
surfsidemsp.com
511tacticalgear.life
ranchpools.com
ticoag.fun
basisbottom.best
childcareassistant1.xyz
thetruthvet.com
48uoc.shop
aide-sante.info
rackrevival.net
morsedesigncompany.com
beeautyhealth.com
0oxk0tir.shop
phillipsnazro.com
cachat.men
admlorenzo.com
dlbatts.com
voteno14.com
upvendas24online.com
suzukimadiunjatim.com
vansshoesindonesia.com
sendmeyourlink.com
borilearredamenti.com
acerola-anma.xyz

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 4 IoCs

rat

resource	yara_rule
behavioral1/memory/2552-26-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/2552-30-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1824-37-0x0000000000070000-0x000000000009F000-memory.dmp	formbook
behavioral1/memory/1824-39-0x0000000000070000-0x000000000009F000-memory.dmp	formbook

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1628 set thread context of 2552	1628	нова поръчкаi pdf.exe	33
PID 2552 set thread context of 1284	2552	RegSvcs.exe	15
PID 1824 set thread context of 1284	1824	wscript.exe	15

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2564	schtasks.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
1628	нова поръчкаi pdf.exe
1628	нова поръчкаi pdf.exe
1628	нова поръчкаi pdf.exe
1628	нова поръчкаi pdf.exe
2664	powershell.exe
2552	RegSvcs.exe
2552	RegSvcs.exe
1824	wscript.exe
1824	wscript.exe
1824	wscript.exe
1824	wscript.exe
1824	wscript.exe
1824	wscript.exe
1824	wscript.exe
1824	wscript.exe
1824	wscript.exe
1824	wscript.exe
1824	wscript.exe
1824	wscript.exe
1824	wscript.exe
1824	wscript.exe
1824	wscript.exe
1824	wscript.exe
1824	wscript.exe
1824	wscript.exe
1824	wscript.exe
1824	wscript.exe
1824	wscript.exe
1824	wscript.exe
1824	wscript.exe
1824	wscript.exe
1824	wscript.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
2552	RegSvcs.exe
2552	RegSvcs.exe
2552	RegSvcs.exe
1824	wscript.exe
1824	wscript.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1628	нова поръчкаi pdf.exe
Token: SeDebugPrivilege	2664	powershell.exe
Token: SeDebugPrivilege	2552	RegSvcs.exe
Token: SeDebugPrivilege	1824	wscript.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 2664	1628	нова поръчкаi pdf.exe	28
PID 1628 wrote to memory of 2664	1628	нова поръчкаi pdf.exe	28
PID 1628 wrote to memory of 2664	1628	нова поръчкаi pdf.exe	28
PID 1628 wrote to memory of 2664	1628	нова поръчкаi pdf.exe	28
PID 1628 wrote to memory of 2564	1628	нова поръчкаi pdf.exe	30
PID 1628 wrote to memory of 2564	1628	нова поръчкаi pdf.exe	30
PID 1628 wrote to memory of 2564	1628	нова поръчкаi pdf.exe	30
PID 1628 wrote to memory of 2564	1628	нова поръчкаi pdf.exe	30
PID 1628 wrote to memory of 2176	1628	нова поръчкаi pdf.exe	32
PID 1628 wrote to memory of 2176	1628	нова поръчкаi pdf.exe	32
PID 1628 wrote to memory of 2176	1628	нова поръчкаi pdf.exe	32
PID 1628 wrote to memory of 2176	1628	нова поръчкаi pdf.exe	32
PID 1628 wrote to memory of 2176	1628	нова поръчкаi pdf.exe	32
PID 1628 wrote to memory of 2176	1628	нова поръчкаi pdf.exe	32
PID 1628 wrote to memory of 2176	1628	нова поръчкаi pdf.exe	32
PID 1628 wrote to memory of 2552	1628	нова поръчкаi pdf.exe	33
PID 1628 wrote to memory of 2552	1628	нова поръчкаi pdf.exe	33
PID 1628 wrote to memory of 2552	1628	нова поръчкаi pdf.exe	33
PID 1628 wrote to memory of 2552	1628	нова поръчкаi pdf.exe	33
PID 1628 wrote to memory of 2552	1628	нова поръчкаi pdf.exe	33
PID 1628 wrote to memory of 2552	1628	нова поръчкаi pdf.exe	33
PID 1628 wrote to memory of 2552	1628	нова поръчкаi pdf.exe	33
PID 1628 wrote to memory of 2552	1628	нова поръчкаi pdf.exe	33
PID 1628 wrote to memory of 2552	1628	нова поръчкаi pdf.exe	33
PID 1628 wrote to memory of 2552	1628	нова поръчкаi pdf.exe	33
PID 1284 wrote to memory of 1824	1284	Explorer.EXE	34
PID 1284 wrote to memory of 1824	1284	Explorer.EXE	34
PID 1284 wrote to memory of 1824	1284	Explorer.EXE	34
PID 1284 wrote to memory of 1824	1284	Explorer.EXE	34
PID 1824 wrote to memory of 2876	1824	wscript.exe	35
PID 1824 wrote to memory of 2876	1824	wscript.exe	35
PID 1824 wrote to memory of 2876	1824	wscript.exe	35
PID 1824 wrote to memory of 2876	1824	wscript.exe	35

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Users\Admin\AppData\Local\Temp\нова поръчкаi pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\нова поръчкаi pdf.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1628
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\bmyGuzzbyh.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2664
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bmyGuzzbyh" /XML "C:\Users\Admin\AppData\Local\Temp\tmp933B.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:2564
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    PID:2176
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:2552
- C:\Windows\SysWOW64\wscript.exe
  "C:\Windows\SysWOW64\wscript.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1824
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    PID:2876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp933B.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp933B.tmp
Size 1KB
SHA256 df5d1c17ccb55c04e6bdd6c95fcc344b505bbbb8dd3cbfc9cebbe94277e86aba
MD5 db1ddf597a27c672dc950eac8ecae2c8
SHA1 9ff2001792adec1e2c59738572db1d20768cd544
SHA512 3811c1ca1a89a7def5598a1930b7919716d7ed144a037ea5c75798cabc95f4e42b93959ca7fb73fa85eccdd2f50e5109b58df447566ec13081b5c05aeb672b27
MD5 SHA1 SHA512

Submit Download

memory/1284-31-0x0000000000320000-0x0000000000420000-memory.dmp

Download

memory/1284-33-0x0000000003CF0000-0x0000000003DA7000-memory.dmp

Download

memory/1284-42-0x0000000003CF0000-0x0000000003DA7000-memory.dmp

Download

memory/1628-27-0x0000000074A10000-0x00000000750FE000-memory.dmp

Download

memory/1628-21-0x00000000048E0000-0x0000000004920000-memory.dmp

Download

memory/1628-4-0x0000000000560000-0x0000000000574000-memory.dmp

Download

memory/1628-13-0x0000000074A10000-0x00000000750FE000-memory.dmp

Download

memory/1628-3-0x0000000000540000-0x000000000055C000-memory.dmp

Download

memory/1628-1-0x0000000074A10000-0x00000000750FE000-memory.dmp

Download

memory/1628-0-0x0000000001060000-0x0000000001110000-memory.dmp

Download

memory/1628-2-0x00000000048E0000-0x0000000004920000-memory.dmp

Download

memory/1628-5-0x00000000052D0000-0x0000000005346000-memory.dmp

Download

memory/1824-39-0x0000000000070000-0x000000000009F000-memory.dmp

Download

memory/1824-38-0x0000000002250000-0x0000000002553000-memory.dmp

Download

memory/1824-37-0x0000000000070000-0x000000000009F000-memory.dmp

Download

memory/1824-40-0x0000000000380000-0x0000000000413000-memory.dmp

Download

memory/1824-35-0x0000000000350000-0x0000000000376000-memory.dmp

Download

memory/1824-36-0x0000000000350000-0x0000000000376000-memory.dmp

Download

memory/2552-24-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2552-30-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2552-28-0x0000000000830000-0x0000000000B33000-memory.dmp

Download

memory/2552-26-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2552-32-0x00000000001D0000-0x00000000001E4000-memory.dmp

Download

memory/2552-20-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2552-15-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2664-23-0x0000000002700000-0x0000000002740000-memory.dmp

Download

memory/2664-34-0x000000006EDE0000-0x000000006F38B000-memory.dmp

Download

memory/2664-19-0x0000000002700000-0x0000000002740000-memory.dmp

Download

memory/2664-18-0x0000000002700000-0x0000000002740000-memory.dmp

Download

memory/2664-16-0x000000006EDE0000-0x000000006F38B000-memory.dmp

Download

memory/2664-14-0x000000006EDE0000-0x000000006F38B000-memory.dmp

Download