formbook | b09907806726122d410e726d60702ff11439231957a66f78681cad9bd52b87cd

General

Target

61e2a9db8f357380b18ba1017f2ae52d656d2c5f4de8851e244566b8c986d88a.exe
Size

789KB
MD5

82df9d1ee9b303d453a7ea91d5f574e2
SHA1

4b121f046e002ac5e2fbeec21079f6fd4c55d370
SHA256

61e2a9db8f357380b18ba1017f2ae52d656d2c5f4de8851e244566b8c986d88a
SHA512

d685fcd4d408f7421d9546ad82435b555563fddd698e3fc5499204935b0556f7bbf2156c1a60f49cdbdee2a289d122405992cfd0b63a1d59b05b4b545471270c
SSDEEP

12288:2uOpmBwGXjdX32ogZ+g/yHgtK+CVIN5X9yKBg7vjlRziln:ZOpmB3XZnMZ4goi39yKe/DA

Score

10^/10

formbook ij84 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ij84

Decoy

resetter.xyz

simonbelanger.me

kwip.xyz

7dbb9.baby

notion-everyday.com

saftiwall.com

pulse-gaming.com

fafafa1.shop

ihaveahole.com

sxtzzj.com

996688x.xyz

komalili.monster

haberdashere.store

nurselifegng.com

kidtryz.com

ghvx.xyz

1minvideopro.com

hidef.group

stylishbeststyler.space

spx21.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1428-30-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1428-34-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1652-40-0x00000000000C0000-0x00000000000EF000-memory.dmp	formbook
behavioral1/memory/1652-42-0x00000000000C0000-0x00000000000EF000-memory.dmp	formbook

Drops startup file 3 IoCs

Processes:

61e2a9db8f357380b18ba1017f2ae52d656d2c5f4de8851e244566b8c986d88a.execmd.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\purches order.lnk	61e2a9db8f357380b18ba1017f2ae52d656d2c5f4de8851e244566b8c986d88a.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exe	cmd.exe

Executes dropped EXE 1 IoCs

Processes:

purches order.exe

pid process

2416 purches order.exe
Loads dropped DLL 2 IoCs

Processes:

cmd.exe

pid process

2632 cmd.exe
2632 cmd.exe

pid	process
2416	purches order.exe

pid	process
2632	cmd.exe
2632	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

purches order.exeAddInProcess32.exeNAPSTAT.EXE

description	pid	process	target process
PID 2416 set thread context of 1428	2416	purches order.exe	AddInProcess32.exe
PID 1428 set thread context of 1200	1428	AddInProcess32.exe	Explorer.EXE
PID 1652 set thread context of 1200	1652	NAPSTAT.EXE	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXE

pid process

2708 PING.EXE
2768 PING.EXE

pid	process
2708	PING.EXE
2768	PING.EXE

Suspicious behavior: EnumeratesProcesses 24 IoCs

Processes:

61e2a9db8f357380b18ba1017f2ae52d656d2c5f4de8851e244566b8c986d88a.exeghedgegehe.exepurches order.exeAddInProcess32.exeNAPSTAT.EXE

pid	process
2960	61e2a9db8f357380b18ba1017f2ae52d656d2c5f4de8851e244566b8c986d88a.exe
1784	ghedgegehe.exe
1784	ghedgegehe.exe
1784	ghedgegehe.exe
1784	ghedgegehe.exe
2416	purches order.exe
2416	purches order.exe
1428	AddInProcess32.exe
1428	AddInProcess32.exe
1652	NAPSTAT.EXE
1652	NAPSTAT.EXE
1652	NAPSTAT.EXE
1652	NAPSTAT.EXE
1652	NAPSTAT.EXE
1652	NAPSTAT.EXE
1652	NAPSTAT.EXE
1652	NAPSTAT.EXE
1652	NAPSTAT.EXE
1652	NAPSTAT.EXE
1652	NAPSTAT.EXE
1652	NAPSTAT.EXE
1652	NAPSTAT.EXE
1652	NAPSTAT.EXE
1652	NAPSTAT.EXE

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

AddInProcess32.exeNAPSTAT.EXE

pid process

1428 AddInProcess32.exe
1428 AddInProcess32.exe
1428 AddInProcess32.exe
1652 NAPSTAT.EXE
1652 NAPSTAT.EXE
Suspicious behavior: RenamesItself 1 IoCs

Processes:

61e2a9db8f357380b18ba1017f2ae52d656d2c5f4de8851e244566b8c986d88a.exe

pid process

2960 61e2a9db8f357380b18ba1017f2ae52d656d2c5f4de8851e244566b8c986d88a.exe

pid	process
1428	AddInProcess32.exe
1428	AddInProcess32.exe
1428	AddInProcess32.exe
1652	NAPSTAT.EXE
1652	NAPSTAT.EXE

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

61e2a9db8f357380b18ba1017f2ae52d656d2c5f4de8851e244566b8c986d88a.exeghedgegehe.exepurches order.exeAddInProcess32.exeNAPSTAT.EXE

description	pid	process
Token: SeDebugPrivilege	2960	61e2a9db8f357380b18ba1017f2ae52d656d2c5f4de8851e244566b8c986d88a.exe
Token: SeDebugPrivilege	1784	ghedgegehe.exe
Token: SeDebugPrivilege	2416	purches order.exe
Token: SeDebugPrivilege	1428	AddInProcess32.exe
Token: SeDebugPrivilege	1652	NAPSTAT.EXE

Suspicious use of WriteProcessMemory 35 IoCs

Processes:

61e2a9db8f357380b18ba1017f2ae52d656d2c5f4de8851e244566b8c986d88a.exeghedgegehe.execmd.exepurches order.exeExplorer.EXENAPSTAT.EXE

description	pid	process	target process
PID 2960 wrote to memory of 1784	2960	61e2a9db8f357380b18ba1017f2ae52d656d2c5f4de8851e244566b8c986d88a.exe	ghedgegehe.exe
PID 2960 wrote to memory of 1784	2960	61e2a9db8f357380b18ba1017f2ae52d656d2c5f4de8851e244566b8c986d88a.exe	ghedgegehe.exe
PID 2960 wrote to memory of 1784	2960	61e2a9db8f357380b18ba1017f2ae52d656d2c5f4de8851e244566b8c986d88a.exe	ghedgegehe.exe
PID 2960 wrote to memory of 1784	2960	61e2a9db8f357380b18ba1017f2ae52d656d2c5f4de8851e244566b8c986d88a.exe	ghedgegehe.exe
PID 1784 wrote to memory of 2632	1784	ghedgegehe.exe	cmd.exe
PID 1784 wrote to memory of 2632	1784	ghedgegehe.exe	cmd.exe
PID 1784 wrote to memory of 2632	1784	ghedgegehe.exe	cmd.exe
PID 1784 wrote to memory of 2632	1784	ghedgegehe.exe	cmd.exe
PID 2632 wrote to memory of 2708	2632	cmd.exe	PING.EXE
PID 2632 wrote to memory of 2708	2632	cmd.exe	PING.EXE
PID 2632 wrote to memory of 2708	2632	cmd.exe	PING.EXE
PID 2632 wrote to memory of 2708	2632	cmd.exe	PING.EXE
PID 2632 wrote to memory of 2768	2632	cmd.exe	PING.EXE
PID 2632 wrote to memory of 2768	2632	cmd.exe	PING.EXE
PID 2632 wrote to memory of 2768	2632	cmd.exe	PING.EXE
PID 2632 wrote to memory of 2768	2632	cmd.exe	PING.EXE
PID 2632 wrote to memory of 2416	2632	cmd.exe	purches order.exe
PID 2632 wrote to memory of 2416	2632	cmd.exe	purches order.exe
PID 2632 wrote to memory of 2416	2632	cmd.exe	purches order.exe
PID 2632 wrote to memory of 2416	2632	cmd.exe	purches order.exe
PID 2416 wrote to memory of 1428	2416	purches order.exe	AddInProcess32.exe
PID 2416 wrote to memory of 1428	2416	purches order.exe	AddInProcess32.exe
PID 2416 wrote to memory of 1428	2416	purches order.exe	AddInProcess32.exe
PID 2416 wrote to memory of 1428	2416	purches order.exe	AddInProcess32.exe
PID 2416 wrote to memory of 1428	2416	purches order.exe	AddInProcess32.exe
PID 2416 wrote to memory of 1428	2416	purches order.exe	AddInProcess32.exe
PID 2416 wrote to memory of 1428	2416	purches order.exe	AddInProcess32.exe
PID 1200 wrote to memory of 1652	1200	Explorer.EXE	NAPSTAT.EXE
PID 1200 wrote to memory of 1652	1200	Explorer.EXE	NAPSTAT.EXE
PID 1200 wrote to memory of 1652	1200	Explorer.EXE	NAPSTAT.EXE
PID 1200 wrote to memory of 1652	1200	Explorer.EXE	NAPSTAT.EXE
PID 1652 wrote to memory of 872	1652	NAPSTAT.EXE	cmd.exe
PID 1652 wrote to memory of 872	1652	NAPSTAT.EXE	cmd.exe
PID 1652 wrote to memory of 872	1652	NAPSTAT.EXE	cmd.exe
PID 1652 wrote to memory of 872	1652	NAPSTAT.EXE	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:1200

C:\Users\Admin\AppData\Local\Temp\61e2a9db8f357380b18ba1017f2ae52d656d2c5f4de8851e244566b8c986d88a.exe
"C:\Users\Admin\AppData\Local\Temp\61e2a9db8f357380b18ba1017f2ae52d656d2c5f4de8851e244566b8c986d88a.exe"
2⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2960

C:\Users\Admin\AppData\Local\Temp\ghedgegehe.exe
"C:\Users\Admin\AppData\Local\Temp\ghedgegehe.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1784

C:\Windows\SysWOW64\cmd.exe
"cmd" /c ping 127.0.0.1 -n 16 > nul && copy "C:\Users\Admin\AppData\Local\Temp\ghedgegehe.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exe" && ping 127.0.0.1 -n 16 > nul && "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exe"
4⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2632

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 16
5⤵
- Runs ping.exe
PID:2708

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 16
5⤵
- Runs ping.exe
PID:2768

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2416

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
6⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1428

C:\Windows\SysWOW64\NAPSTAT.EXE
"C:\Windows\SysWOW64\NAPSTAT.EXE"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1652

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
3⤵
PID:872

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exe
Filesize
789KB

MD5
82df9d1ee9b303d453a7ea91d5f574e2

SHA1
4b121f046e002ac5e2fbeec21079f6fd4c55d370

SHA256
61e2a9db8f357380b18ba1017f2ae52d656d2c5f4de8851e244566b8c986d88a

SHA512
d685fcd4d408f7421d9546ad82435b555563fddd698e3fc5499204935b0556f7bbf2156c1a60f49cdbdee2a289d122405992cfd0b63a1d59b05b4b545471270c

Download Submit
memory/1200-36-0x0000000000150000-0x0000000000250000-memory.dmp

Filesize
1024KB

Download
memory/1200-37-0x0000000004FA0000-0x0000000005110000-memory.dmp

Filesize
1.4MB

Download
memory/1200-46-0x0000000004FA0000-0x0000000005110000-memory.dmp

Filesize
1.4MB

Download
memory/1428-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1428-32-0x0000000000940000-0x0000000000C43000-memory.dmp

Filesize
3.0MB

Download
memory/1428-35-0x0000000000280000-0x0000000000294000-memory.dmp

Filesize
80KB

Download
memory/1428-34-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1428-26-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1428-25-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1428-30-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1652-41-0x0000000000B10000-0x0000000000E13000-memory.dmp

Filesize
3.0MB

Download
memory/1652-39-0x0000000000F20000-0x0000000000F66000-memory.dmp

Filesize
280KB

Download
memory/1652-38-0x0000000000F20000-0x0000000000F66000-memory.dmp

Filesize
280KB

Download
memory/1652-40-0x00000000000C0000-0x00000000000EF000-memory.dmp

Filesize
188KB

Download
memory/1652-42-0x00000000000C0000-0x00000000000EF000-memory.dmp

Filesize
188KB

Download
memory/1652-44-0x0000000000990000-0x0000000000A23000-memory.dmp

Filesize
588KB

Download
memory/1784-8-0x0000000074AD0000-0x00000000751BE000-memory.dmp

Filesize
6.9MB

Download
memory/1784-7-0x0000000000AA0000-0x0000000000AE0000-memory.dmp

Filesize
256KB

Download
memory/1784-6-0x0000000074AD0000-0x00000000751BE000-memory.dmp

Filesize
6.9MB

Download
memory/2416-20-0x0000000074A80000-0x000000007516E000-memory.dmp

Filesize
6.9MB

Download
memory/2416-21-0x0000000004790000-0x00000000047D0000-memory.dmp

Filesize
256KB

Download
memory/2416-24-0x00000000005B0000-0x00000000005B6000-memory.dmp

Filesize
24KB

Download
memory/2416-28-0x0000000074A80000-0x000000007516E000-memory.dmp

Filesize
6.9MB

Download
memory/2416-31-0x0000000074A80000-0x000000007516E000-memory.dmp

Filesize
6.9MB

Download
memory/2416-19-0x0000000000890000-0x000000000095C000-memory.dmp

Filesize
816KB

Download
memory/2416-29-0x0000000004790000-0x00000000047D0000-memory.dmp

Filesize
256KB

Download
memory/2416-23-0x0000000000A70000-0x0000000000A8A000-memory.dmp

Filesize
104KB

Download
memory/2416-22-0x0000000004790000-0x00000000047D0000-memory.dmp

Filesize
256KB

Download
memory/2960-0-0x0000000000DE0000-0x0000000000EAC000-memory.dmp

Filesize
816KB

Download
memory/2960-2-0x00000000049F0000-0x0000000004A30000-memory.dmp

Filesize
256KB

Download
memory/2960-5-0x0000000074AD0000-0x00000000751BE000-memory.dmp

Filesize
6.9MB

Download
memory/2960-1-0x0000000074AD0000-0x00000000751BE000-memory.dmp

Filesize
6.9MB

Download
memory/2960-3-0x0000000004390000-0x00000000043D4000-memory.dmp

Filesize
272KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads