formbook | 1a4cd34adc6abfab45060e502911d580b52e689375a81835b2753fb038a21fe1

General

Target

tmp.exe
Size

604KB
MD5

97c714162ef1642b13216a22f6d76b7c
SHA1

c5b4bf4078229531546d1a447711ef1d1ead83f3
SHA256

1a4cd34adc6abfab45060e502911d580b52e689375a81835b2753fb038a21fe1
SHA512

9ec065ee13f57045b8011663fbeaa59af8e9f348efdefc1856c2c5d94bb63e3cfb55f30459a9d5a0872af376b4e7615dff3280b9a57f55b98019e6b41d226943
SSDEEP

12288:1lYifT9r8TyKftQb8SrAYL7jWNdxDgEzb8lwAhaopQhn7bKTOuzwJ86p:QiGfCfA0aDg/ljL07m5zc86p

Score

10^/10

formbook pz12 execution rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

pz12

Decoy

paucanyes.com

autonwheels.com

cowboysandcaviarbar.com

fitnessengineeredworkouts.com

nuevobajonfavorito.com

dflx8.com

rothability.com

sxybet88.com

onesource.live

brenjitu1904.com

airdrop-zero1labs.com

guangdongqiangzhetc.com

apartments-for-rent-72254.bond

ombak99.lol

qqfoodsolutions.com

kyyzz.com

thepicklematch.com

ainth.com

missorris.com

gabbygomez.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/3036-11-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/3036-19-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/2584-20-0x0000000000080000-0x00000000000AF000-memory.dmp	formbook

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

2104 powershell.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2532 cmd.exe

pid	process
2104	powershell.exe

pid	process
2532	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

tmp.exetmp.exechkdsk.exe

description	pid	process	target process
PID 2028 set thread context of 3036	2028	tmp.exe	tmp.exe
PID 3036 set thread context of 1204	3036	tmp.exe	Explorer.EXE
PID 2584 set thread context of 1204	2584	chkdsk.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

chkdsk.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	chkdsk.exe

Suspicious behavior: EnumeratesProcesses 29 IoCs

Processes:

tmp.exepowershell.exechkdsk.exe

pid	process
3036	tmp.exe
3036	tmp.exe
2104	powershell.exe
2584	chkdsk.exe
2584	chkdsk.exe
2584	chkdsk.exe
2584	chkdsk.exe
2584	chkdsk.exe
2584	chkdsk.exe
2584	chkdsk.exe
2584	chkdsk.exe
2584	chkdsk.exe
2584	chkdsk.exe
2584	chkdsk.exe
2584	chkdsk.exe
2584	chkdsk.exe
2584	chkdsk.exe
2584	chkdsk.exe
2584	chkdsk.exe
2584	chkdsk.exe
2584	chkdsk.exe
2584	chkdsk.exe
2584	chkdsk.exe
2584	chkdsk.exe
2584	chkdsk.exe
2584	chkdsk.exe
2584	chkdsk.exe
2584	chkdsk.exe
2584	chkdsk.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1204 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

tmp.exechkdsk.exe

pid process

3036 tmp.exe
3036 tmp.exe
3036 tmp.exe
2584 chkdsk.exe
2584 chkdsk.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

tmp.exepowershell.exechkdsk.exe

description pid process

Token: SeDebugPrivilege 3036 tmp.exe
Token: SeDebugPrivilege 2104 powershell.exe
Token: SeDebugPrivilege 2584 chkdsk.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1204 Explorer.EXE
1204 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1204 Explorer.EXE
1204 Explorer.EXE

pid	process
1204	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	3036	tmp.exe
Token: SeDebugPrivilege	2104	powershell.exe
Token: SeDebugPrivilege	2584	chkdsk.exe

pid	process
1204	Explorer.EXE
1204	Explorer.EXE

pid	process
1204	Explorer.EXE
1204	Explorer.EXE

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

tmp.exeExplorer.EXEchkdsk.exe

description	pid	process	target process
PID 2028 wrote to memory of 2104	2028	tmp.exe	powershell.exe
PID 2028 wrote to memory of 2104	2028	tmp.exe	powershell.exe
PID 2028 wrote to memory of 2104	2028	tmp.exe	powershell.exe
PID 2028 wrote to memory of 2104	2028	tmp.exe	powershell.exe
PID 2028 wrote to memory of 3036	2028	tmp.exe	tmp.exe
PID 2028 wrote to memory of 3036	2028	tmp.exe	tmp.exe
PID 2028 wrote to memory of 3036	2028	tmp.exe	tmp.exe
PID 2028 wrote to memory of 3036	2028	tmp.exe	tmp.exe
PID 2028 wrote to memory of 3036	2028	tmp.exe	tmp.exe
PID 2028 wrote to memory of 3036	2028	tmp.exe	tmp.exe
PID 2028 wrote to memory of 3036	2028	tmp.exe	tmp.exe
PID 1204 wrote to memory of 2584	1204	Explorer.EXE	chkdsk.exe
PID 1204 wrote to memory of 2584	1204	Explorer.EXE	chkdsk.exe
PID 1204 wrote to memory of 2584	1204	Explorer.EXE	chkdsk.exe
PID 1204 wrote to memory of 2584	1204	Explorer.EXE	chkdsk.exe
PID 2584 wrote to memory of 2532	2584	chkdsk.exe	cmd.exe
PID 2584 wrote to memory of 2532	2584	chkdsk.exe	cmd.exe
PID 2584 wrote to memory of 2532	2584	chkdsk.exe	cmd.exe
PID 2584 wrote to memory of 2532	2584	chkdsk.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1204

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2028

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2104

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3036

C:\Windows\SysWOW64\autochk.exe
"C:\Windows\SysWOW64\autochk.exe"
2⤵
PID:2616

C:\Windows\SysWOW64\chkdsk.exe
"C:\Windows\SysWOW64\chkdsk.exe"
2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2584

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
3⤵
- Deletes itself
PID:2532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1204-15-0x0000000003B50000-0x0000000003C50000-memory.dmp

Filesize
1024KB

Download
memory/1204-24-0x0000000007530000-0x0000000007641000-memory.dmp

Filesize
1.1MB

Download
memory/2028-1-0x0000000000820000-0x00000000008BC000-memory.dmp

Filesize
624KB

Download
memory/2028-2-0x00000000745E0000-0x0000000074CCE000-memory.dmp

Filesize
6.9MB

Download
memory/2028-3-0x00000000004A0000-0x00000000004BA000-memory.dmp

Filesize
104KB

Download
memory/2028-4-0x0000000000460000-0x0000000000470000-memory.dmp

Filesize
64KB

Download
memory/2028-5-0x0000000004C90000-0x0000000004D06000-memory.dmp

Filesize
472KB

Download
memory/2028-0-0x00000000745EE000-0x00000000745EF000-memory.dmp

Filesize
4KB

Download
memory/2028-12-0x00000000745E0000-0x0000000074CCE000-memory.dmp

Filesize
6.9MB

Download
memory/2584-20-0x0000000000080000-0x00000000000AF000-memory.dmp

Filesize
188KB

Download
memory/2584-18-0x00000000002D0000-0x00000000002D7000-memory.dmp

Filesize
28KB

Download
memory/3036-6-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3036-14-0x0000000000B90000-0x0000000000E93000-memory.dmp

Filesize
3.0MB

Download
memory/3036-11-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3036-19-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3036-7-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3036-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads