formbook | dae7c8ae10158c7be9ae7a115ea9b8fd40b6d3f85cace0cc10feb9ae8d8539a0

Analysis

max time kernel
149s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
05/02/2024, 08:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
REQUERIMIENTO DE COTIZACION.exe
Size 652KB
Sample240205-kap1vabdh5
SHA256 dae7c8ae10158c7be9ae7a115ea9b8fd40b6d3f85cace0cc10feb9ae8d8539a0
MD5 86cc523dc15e1863e3afdc66d64262d1
SHA1 9d5b31adef80a7c4bfb84b0b07717fb1786a4552
SHA512 10217da2a9ed513486b49e82c10524add67a98d9f99a583598802ef52dd7d66e412883fe61787b1e5e4c75c903015319d286d4a31a36667d02fb2bd0c53c191c
SSDEEP 12288:9Nd53rD22qXLGzsvYisr3CtK5rb+gh9GDdTzuNwp0CdnVC7nJb:/rDkyIv0rF3pkDJ0m+nJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook gy14 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

gy14

Decoy

mavbam.com
theanhedonia.com
budgetnurseries.com
buflitr.com
alqamarhotel.com
2660348.top
123bu6.shop
v72999.com
yzyz841.xyz
247fracing.com
naples.beauty
twinklethrive.com
loscaseros.com
creditspisatylegko.site
sgyy3ej2dgwesb5.com
ufocafe.net
techn9nehollywoodundead.com
truedatalab.com
alterdpxlmarketing.com
harborspringsfire.com
soulheroes.online
tryscriptify.com
collline.com
tulisanemas.com
thelectricandsolar.com
jokergiftcard.buzz
sciencemediainstitute.com
loading-231412.info
ampsportss.com
dianetion.com
169cc.xyz
zezfhys.com
smnyg.com
elenorbet327.com
whatsapp1.autos
0854n5.shop
jxscols.top
camelpmkrf.com
myxtremecleanshq.services
beautyloungebydede.online
artbydianayorktownva.com
functional-yarns.com
accepted6.com
ug19bklo.com
roelofsen.online
batuoe.com
amiciperlacoda.com
883831.com
qieqyt.xyz
vendorato.online
6733633.com
stadtliche-arbeit.info
survivordental.com
mrbmed.com
elbt-ag.com
mtdiyx.xyz
mediayoki.site
zom11.com
biosif.com
aicashu.com
inovarevending.com
8x101n.xyz
ioherstrulybeauty.com
mosaica.online
venitro.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 4 IoCs

rat

resource	yara_rule
behavioral1/memory/2612-22-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/2612-30-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1192-36-0x0000000000080000-0x00000000000AF000-memory.dmp	formbook
behavioral1/memory/1192-38-0x0000000000080000-0x00000000000AF000-memory.dmp	formbook

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2364 set thread context of 2612	2364	REQUERIMIENTO DE COTIZACION.exe	33
PID 2612 set thread context of 1372	2612	RegSvcs.exe	7
PID 1192 set thread context of 1372	1192	msdt.exe	7

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2644	schtasks.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
2364	REQUERIMIENTO DE COTIZACION.exe
2364	REQUERIMIENTO DE COTIZACION.exe
2612	RegSvcs.exe
2612	RegSvcs.exe
2288	powershell.exe
1192	msdt.exe
1192	msdt.exe
1192	msdt.exe
1192	msdt.exe
1192	msdt.exe
1192	msdt.exe
1192	msdt.exe
1192	msdt.exe
1192	msdt.exe
1192	msdt.exe
1192	msdt.exe
1192	msdt.exe
1192	msdt.exe
1192	msdt.exe
1192	msdt.exe
1192	msdt.exe
1192	msdt.exe
1192	msdt.exe
1192	msdt.exe
1192	msdt.exe
1192	msdt.exe
1192	msdt.exe
1192	msdt.exe
1192	msdt.exe
1192	msdt.exe
1192	msdt.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
2612	RegSvcs.exe
2612	RegSvcs.exe
2612	RegSvcs.exe
1192	msdt.exe
1192	msdt.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2364	REQUERIMIENTO DE COTIZACION.exe
Token: SeDebugPrivilege	2612	RegSvcs.exe
Token: SeDebugPrivilege	2288	powershell.exe
Token: SeDebugPrivilege	1192	msdt.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2288	2364	REQUERIMIENTO DE COTIZACION.exe	28
PID 2364 wrote to memory of 2288	2364	REQUERIMIENTO DE COTIZACION.exe	28
PID 2364 wrote to memory of 2288	2364	REQUERIMIENTO DE COTIZACION.exe	28
PID 2364 wrote to memory of 2288	2364	REQUERIMIENTO DE COTIZACION.exe	28
PID 2364 wrote to memory of 2644	2364	REQUERIMIENTO DE COTIZACION.exe	30
PID 2364 wrote to memory of 2644	2364	REQUERIMIENTO DE COTIZACION.exe	30
PID 2364 wrote to memory of 2644	2364	REQUERIMIENTO DE COTIZACION.exe	30
PID 2364 wrote to memory of 2644	2364	REQUERIMIENTO DE COTIZACION.exe	30
PID 2364 wrote to memory of 2576	2364	REQUERIMIENTO DE COTIZACION.exe	32
PID 2364 wrote to memory of 2576	2364	REQUERIMIENTO DE COTIZACION.exe	32
PID 2364 wrote to memory of 2576	2364	REQUERIMIENTO DE COTIZACION.exe	32
PID 2364 wrote to memory of 2576	2364	REQUERIMIENTO DE COTIZACION.exe	32
PID 2364 wrote to memory of 2576	2364	REQUERIMIENTO DE COTIZACION.exe	32
PID 2364 wrote to memory of 2576	2364	REQUERIMIENTO DE COTIZACION.exe	32
PID 2364 wrote to memory of 2576	2364	REQUERIMIENTO DE COTIZACION.exe	32
PID 2364 wrote to memory of 2612	2364	REQUERIMIENTO DE COTIZACION.exe	33
PID 2364 wrote to memory of 2612	2364	REQUERIMIENTO DE COTIZACION.exe	33
PID 2364 wrote to memory of 2612	2364	REQUERIMIENTO DE COTIZACION.exe	33
PID 2364 wrote to memory of 2612	2364	REQUERIMIENTO DE COTIZACION.exe	33
PID 2364 wrote to memory of 2612	2364	REQUERIMIENTO DE COTIZACION.exe	33
PID 2364 wrote to memory of 2612	2364	REQUERIMIENTO DE COTIZACION.exe	33
PID 2364 wrote to memory of 2612	2364	REQUERIMIENTO DE COTIZACION.exe	33
PID 2364 wrote to memory of 2612	2364	REQUERIMIENTO DE COTIZACION.exe	33
PID 2364 wrote to memory of 2612	2364	REQUERIMIENTO DE COTIZACION.exe	33
PID 2364 wrote to memory of 2612	2364	REQUERIMIENTO DE COTIZACION.exe	33
PID 1372 wrote to memory of 1192	1372	Explorer.EXE	34
PID 1372 wrote to memory of 1192	1372	Explorer.EXE	34
PID 1372 wrote to memory of 1192	1372	Explorer.EXE	34
PID 1372 wrote to memory of 1192	1372	Explorer.EXE	34
PID 1192 wrote to memory of 2400	1192	msdt.exe	36
PID 1192 wrote to memory of 2400	1192	msdt.exe	36
PID 1192 wrote to memory of 2400	1192	msdt.exe	36
PID 1192 wrote to memory of 2400	1192	msdt.exe	36

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Users\Admin\AppData\Local\Temp\REQUERIMIENTO DE COTIZACION.exe
  "C:\Users\Admin\AppData\Local\Temp\REQUERIMIENTO DE COTIZACION.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2364
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\BVuDUxCjtd.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2288
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BVuDUxCjtd" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4D36.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:2644
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    PID:2576
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:2612
- C:\Windows\SysWOW64\msdt.exe
  "C:\Windows\SysWOW64\msdt.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1192
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    PID:2400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp4D36.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp4D36.tmp
Size 1KB
SHA256 98e12cb3ef4fa0886668216eb2a80fc09534890eac9a0ac9adc904d2549a9d03
MD5 7f3de076cd1fa6d62b9f8337e299e21a
SHA1 5069fd93e3f933b6fb80f2d7538ffae2340794f0
SHA512 226665c6810c174a0993b66809739d103df2f8d702990931725bf15f920710cbf5e0664169063d1b9f0b64c09c123e8c097da0fe7f25e42ea2d0f89e2bbb6c35
MD5 SHA1 SHA512

Submit Download

memory/1192-34-0x00000000004A0000-0x0000000000594000-memory.dmp

Download

memory/1192-37-0x00000000022F0000-0x00000000025F3000-memory.dmp

Download

memory/1192-36-0x0000000000080000-0x00000000000AF000-memory.dmp

Download

memory/1192-35-0x00000000004A0000-0x0000000000594000-memory.dmp

Download

memory/1192-40-0x0000000002150000-0x00000000021E4000-memory.dmp

Download

memory/1192-38-0x0000000000080000-0x00000000000AF000-memory.dmp

Download

memory/1372-29-0x0000000000310000-0x0000000000410000-memory.dmp

Download

memory/1372-32-0x0000000004E70000-0x0000000004FBF000-memory.dmp

Download

memory/2288-15-0x000000006DBA0000-0x000000006E14B000-memory.dmp

Download

memory/2288-17-0x000000006DBA0000-0x000000006E14B000-memory.dmp

Download

memory/2288-19-0x000000006DBA0000-0x000000006E14B000-memory.dmp

Download

memory/2288-20-0x0000000000480000-0x00000000004C0000-memory.dmp

Download

memory/2288-24-0x0000000000480000-0x00000000004C0000-memory.dmp

Download

memory/2288-33-0x000000006DBA0000-0x000000006E14B000-memory.dmp

Download

memory/2364-25-0x0000000004C50000-0x0000000004C90000-memory.dmp

Download

memory/2364-6-0x0000000004B80000-0x0000000004BF6000-memory.dmp

Download

memory/2364-0-0x0000000000210000-0x00000000002BA000-memory.dmp

Download

memory/2364-26-0x00000000748B0000-0x0000000074F9E000-memory.dmp

Download

memory/2364-2-0x0000000004C50000-0x0000000004C90000-memory.dmp

Download

memory/2364-1-0x00000000748B0000-0x0000000074F9E000-memory.dmp

Download

memory/2364-3-0x0000000000600000-0x000000000061C000-memory.dmp

Download

memory/2364-23-0x00000000748B0000-0x0000000074F9E000-memory.dmp

Download

memory/2364-4-0x00000000007A0000-0x00000000007AE000-memory.dmp

Download

memory/2364-5-0x0000000001FB0000-0x0000000001FC4000-memory.dmp

Download

memory/2612-22-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2612-14-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2612-16-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2612-18-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2612-28-0x00000000008D0000-0x0000000000BD3000-memory.dmp

Download

memory/2612-31-0x00000000001F0000-0x0000000000205000-memory.dmp

Download

memory/2612-30-0x0000000000400000-0x000000000042F000-memory.dmp

Download