formbook | a83aef025ddef912d97df8bbae2601b592a5e8d7db22f7f604467cc9dda1f4de

General

Target

a83aef025ddef912d97df8bbae2601b592a5e8d7db22f7f604467cc9dda1f4de.exe
Size

669KB
MD5

0add33d563f3887bebf4a3fa59bc3ef8
SHA1

4359bad86463dc498bda6f2aec56b64b89790692
SHA256

a83aef025ddef912d97df8bbae2601b592a5e8d7db22f7f604467cc9dda1f4de
SHA512

be2abe83ebc7d56ad1d7e4655c434e6c9f8edd4fa63045d7039c79b0152525032f563a06c9bb4ddb599cf33fe84b9f3fde28fb2b9de3bc573cb58d1b221f0ef4
SSDEEP

12288:PhsL0pei36RMQV/YGLTz1b3FL0BGs8SKt766wiAACMOcx:Ph7pp36WQV/BTV3FL0BGs8l766n5Ocx

Score

10^/10

formbook pz12 execution rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

pz12

Decoy

paucanyes.com

autonwheels.com

cowboysandcaviarbar.com

fitnessengineeredworkouts.com

nuevobajonfavorito.com

dflx8.com

rothability.com

sxybet88.com

onesource.live

brenjitu1904.com

airdrop-zero1labs.com

guangdongqiangzhetc.com

apartments-for-rent-72254.bond

ombak99.lol

qqfoodsolutions.com

kyyzz.com

thepicklematch.com

ainth.com

missorris.com

gabbygomez.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2656-13-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

2616 powershell.exe

pid	process
2616	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

a83aef025ddef912d97df8bbae2601b592a5e8d7db22f7f604467cc9dda1f4de.exe

description	pid	process	target process
PID 1368 set thread context of 2656	1368	a83aef025ddef912d97df8bbae2601b592a5e8d7db22f7f604467cc9dda1f4de.exe	a83aef025ddef912d97df8bbae2601b592a5e8d7db22f7f604467cc9dda1f4de.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

a83aef025ddef912d97df8bbae2601b592a5e8d7db22f7f604467cc9dda1f4de.exepowershell.exe

pid process

2656 a83aef025ddef912d97df8bbae2601b592a5e8d7db22f7f604467cc9dda1f4de.exe
2616 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2616 powershell.exe

pid	process
2656	a83aef025ddef912d97df8bbae2601b592a5e8d7db22f7f604467cc9dda1f4de.exe
2616	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2616	powershell.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

a83aef025ddef912d97df8bbae2601b592a5e8d7db22f7f604467cc9dda1f4de.exe

description	pid	process	target process
PID 1368 wrote to memory of 2616	1368	a83aef025ddef912d97df8bbae2601b592a5e8d7db22f7f604467cc9dda1f4de.exe	powershell.exe
PID 1368 wrote to memory of 2616	1368	a83aef025ddef912d97df8bbae2601b592a5e8d7db22f7f604467cc9dda1f4de.exe	powershell.exe
PID 1368 wrote to memory of 2616	1368	a83aef025ddef912d97df8bbae2601b592a5e8d7db22f7f604467cc9dda1f4de.exe	powershell.exe
PID 1368 wrote to memory of 2616	1368	a83aef025ddef912d97df8bbae2601b592a5e8d7db22f7f604467cc9dda1f4de.exe	powershell.exe
PID 1368 wrote to memory of 2656	1368	a83aef025ddef912d97df8bbae2601b592a5e8d7db22f7f604467cc9dda1f4de.exe	a83aef025ddef912d97df8bbae2601b592a5e8d7db22f7f604467cc9dda1f4de.exe
PID 1368 wrote to memory of 2656	1368	a83aef025ddef912d97df8bbae2601b592a5e8d7db22f7f604467cc9dda1f4de.exe	a83aef025ddef912d97df8bbae2601b592a5e8d7db22f7f604467cc9dda1f4de.exe
PID 1368 wrote to memory of 2656	1368	a83aef025ddef912d97df8bbae2601b592a5e8d7db22f7f604467cc9dda1f4de.exe	a83aef025ddef912d97df8bbae2601b592a5e8d7db22f7f604467cc9dda1f4de.exe
PID 1368 wrote to memory of 2656	1368	a83aef025ddef912d97df8bbae2601b592a5e8d7db22f7f604467cc9dda1f4de.exe	a83aef025ddef912d97df8bbae2601b592a5e8d7db22f7f604467cc9dda1f4de.exe
PID 1368 wrote to memory of 2656	1368	a83aef025ddef912d97df8bbae2601b592a5e8d7db22f7f604467cc9dda1f4de.exe	a83aef025ddef912d97df8bbae2601b592a5e8d7db22f7f604467cc9dda1f4de.exe
PID 1368 wrote to memory of 2656	1368	a83aef025ddef912d97df8bbae2601b592a5e8d7db22f7f604467cc9dda1f4de.exe	a83aef025ddef912d97df8bbae2601b592a5e8d7db22f7f604467cc9dda1f4de.exe
PID 1368 wrote to memory of 2656	1368	a83aef025ddef912d97df8bbae2601b592a5e8d7db22f7f604467cc9dda1f4de.exe	a83aef025ddef912d97df8bbae2601b592a5e8d7db22f7f604467cc9dda1f4de.exe

C:\Users\Admin\AppData\Local\Temp\a83aef025ddef912d97df8bbae2601b592a5e8d7db22f7f604467cc9dda1f4de.exe
"C:\Users\Admin\AppData\Local\Temp\a83aef025ddef912d97df8bbae2601b592a5e8d7db22f7f604467cc9dda1f4de.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1368

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\a83aef025ddef912d97df8bbae2601b592a5e8d7db22f7f604467cc9dda1f4de.exe"
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2616

C:\Users\Admin\AppData\Local\Temp\a83aef025ddef912d97df8bbae2601b592a5e8d7db22f7f604467cc9dda1f4de.exe
"C:\Users\Admin\AppData\Local\Temp\a83aef025ddef912d97df8bbae2601b592a5e8d7db22f7f604467cc9dda1f4de.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2656

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1368-6-0x0000000000630000-0x00000000006A6000-memory.dmp

Filesize
472KB

Download
memory/1368-1-0x0000000000940000-0x00000000009EE000-memory.dmp

Filesize
696KB

Download
memory/1368-2-0x0000000074A40000-0x000000007512E000-memory.dmp

Filesize
6.9MB

Download
memory/1368-3-0x00000000004B0000-0x00000000004D2000-memory.dmp

Filesize
136KB

Download
memory/1368-4-0x0000000000320000-0x000000000032C000-memory.dmp

Filesize
48KB

Download
memory/1368-5-0x00000000004D0000-0x00000000004E0000-memory.dmp

Filesize
64KB

Download
memory/1368-0-0x0000000074A4E000-0x0000000074A4F000-memory.dmp

Filesize
4KB

Download
memory/1368-14-0x0000000074A40000-0x000000007512E000-memory.dmp

Filesize
6.9MB

Download
memory/2656-7-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2656-13-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2656-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2656-9-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2656-15-0x0000000000B80000-0x0000000000E83000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads