formbook | acb58cf1f819372ca5f461636f47ef790ec5d2748a5eaa3676104e46cdca1b19

General

Target

acb58cf1f819372ca5f461636f47ef790ec5d2748a5eaa3676104e46cdca1b19.msi
Size

480KB
MD5

6d7ada8915023eb188f47444a77d169d
SHA1

f87023a7c0de6b0ff4b0b2b799e58f41b938c332
SHA256

acb58cf1f819372ca5f461636f47ef790ec5d2748a5eaa3676104e46cdca1b19
SHA512

d37cf81df8f8dc64c5d5f0d68a2ad428b7d7d31658dd6980bc27db0d3dbc3ef44776012ea72feafc1c3348b0c9cd3599ce89168aa7edd992769dca26a98cc084
SSDEEP

12288:TEqy7sSW7kNUhBiTL1wuG2YVkp455oaomdIbTbq:TE5wzAQUTO/2SkpWon

Score

10^/10

formbook ai rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

3.9

Campaign

ai

Decoy

theapschool.com

riseupfloridakeys.com

xn--mgbb2awa9dm20i.com

apnee-coach.com

christianmarketinggifts.com

eurothereum.biz

solutionfull.com

equifaxqsecurity2017.com

roboeye-tech.com

living-isar.immo

cable-online-zone.sale

parfumirza.com

civilizationsprice.com

zealasia.com

billet-bateau-tanger.com

andrewkurtsummers.net

darylandkaitlyn.com

ddaak.com

seattlepetadventures.com

iopuern.online

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/372-21-0x0000000000400000-0x000000000042A000-memory.dmp	formbook

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

MSIAD67.tmpMSIAD67.tmpnetsh.exe

description	pid	process	target process
PID 1692 set thread context of 372	1692	MSIAD67.tmp	MSIAD67.tmp
PID 372 set thread context of 3440	372	MSIAD67.tmp	Explorer.EXE
PID 4708 set thread context of 3440	4708	netsh.exe	Explorer.EXE

Drops file in Windows directory 8 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Windows\Installer\e57ac1e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57ac1e.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{29EF7317-DCA1-4159-97B2-C883AD400AC6}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIACDA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAD67.tmp	msiexec.exe

Executes dropped EXE 2 IoCs

Processes:

MSIAD67.tmpMSIAD67.tmp

pid process

1692 MSIAD67.tmp
372 MSIAD67.tmp

pid	process
1692	MSIAD67.tmp
372	MSIAD67.tmp

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vssvc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000f9c3b1b881b13bb50000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000f9c3b1b80000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900f9c3b1b8000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1df9c3b1b8000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000f9c3b1b800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

Processes:

msiexec.exeMSIAD67.tmpnetsh.exe

pid	process
3652	msiexec.exe
3652	msiexec.exe
372	MSIAD67.tmp
372	MSIAD67.tmp
372	MSIAD67.tmp
372	MSIAD67.tmp
4708	netsh.exe
4708	netsh.exe
4708	netsh.exe
4708	netsh.exe
4708	netsh.exe
4708	netsh.exe
4708	netsh.exe
4708	netsh.exe
4708	netsh.exe
4708	netsh.exe
4708	netsh.exe
4708	netsh.exe
4708	netsh.exe
4708	netsh.exe
4708	netsh.exe
4708	netsh.exe
4708	netsh.exe
4708	netsh.exe
4708	netsh.exe
4708	netsh.exe
4708	netsh.exe
4708	netsh.exe
4708	netsh.exe
4708	netsh.exe
4708	netsh.exe
4708	netsh.exe
4708	netsh.exe
4708	netsh.exe
4708	netsh.exe
4708	netsh.exe
4708	netsh.exe
4708	netsh.exe
4708	netsh.exe
4708	netsh.exe
4708	netsh.exe
4708	netsh.exe

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

MSIAD67.tmpnetsh.exe

pid process

372 MSIAD67.tmp
372 MSIAD67.tmp
372 MSIAD67.tmp
4708 netsh.exe
4708 netsh.exe

pid	process
372	MSIAD67.tmp
372	MSIAD67.tmp
372	MSIAD67.tmp
4708	netsh.exe
4708	netsh.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exeMSIAD67.tmpsrtasks.exeMSIAD67.tmpExplorer.EXE

description	pid	process
Token: SeShutdownPrivilege	4556	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4556	msiexec.exe
Token: SeSecurityPrivilege	3652	msiexec.exe
Token: SeCreateTokenPrivilege	4556	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4556	msiexec.exe
Token: SeLockMemoryPrivilege	4556	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4556	msiexec.exe
Token: SeMachineAccountPrivilege	4556	msiexec.exe
Token: SeTcbPrivilege	4556	msiexec.exe
Token: SeSecurityPrivilege	4556	msiexec.exe
Token: SeTakeOwnershipPrivilege	4556	msiexec.exe
Token: SeLoadDriverPrivilege	4556	msiexec.exe
Token: SeSystemProfilePrivilege	4556	msiexec.exe
Token: SeSystemtimePrivilege	4556	msiexec.exe
Token: SeProfSingleProcessPrivilege	4556	msiexec.exe
Token: SeIncBasePriorityPrivilege	4556	msiexec.exe
Token: SeCreatePagefilePrivilege	4556	msiexec.exe
Token: SeCreatePermanentPrivilege	4556	msiexec.exe
Token: SeBackupPrivilege	4556	msiexec.exe
Token: SeRestorePrivilege	4556	msiexec.exe
Token: SeShutdownPrivilege	4556	msiexec.exe
Token: SeDebugPrivilege	4556	msiexec.exe
Token: SeAuditPrivilege	4556	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4556	msiexec.exe
Token: SeChangeNotifyPrivilege	4556	msiexec.exe
Token: SeRemoteShutdownPrivilege	4556	msiexec.exe
Token: SeUndockPrivilege	4556	msiexec.exe
Token: SeSyncAgentPrivilege	4556	msiexec.exe
Token: SeEnableDelegationPrivilege	4556	msiexec.exe
Token: SeManageVolumePrivilege	4556	msiexec.exe
Token: SeImpersonatePrivilege	4556	msiexec.exe
Token: SeCreateGlobalPrivilege	4556	msiexec.exe
Token: SeBackupPrivilege	4020	vssvc.exe
Token: SeRestorePrivilege	4020	vssvc.exe
Token: SeAuditPrivilege	4020	vssvc.exe
Token: SeBackupPrivilege	3652	msiexec.exe
Token: SeRestorePrivilege	3652	msiexec.exe
Token: SeRestorePrivilege	3652	msiexec.exe
Token: SeTakeOwnershipPrivilege	3652	msiexec.exe
Token: SeRestorePrivilege	3652	msiexec.exe
Token: SeTakeOwnershipPrivilege	3652	msiexec.exe
Token: SeRestorePrivilege	3652	msiexec.exe
Token: SeTakeOwnershipPrivilege	3652	msiexec.exe
Token: SeDebugPrivilege	1692	MSIAD67.tmp
Token: SeBackupPrivilege	4876	srtasks.exe
Token: SeRestorePrivilege	4876	srtasks.exe
Token: SeSecurityPrivilege	4876	srtasks.exe
Token: SeTakeOwnershipPrivilege	4876	srtasks.exe
Token: SeBackupPrivilege	4876	srtasks.exe
Token: SeRestorePrivilege	4876	srtasks.exe
Token: SeSecurityPrivilege	4876	srtasks.exe
Token: SeTakeOwnershipPrivilege	4876	srtasks.exe
Token: SeDebugPrivilege	372	MSIAD67.tmp
Token: SeRestorePrivilege	3652	msiexec.exe
Token: SeTakeOwnershipPrivilege	3652	msiexec.exe
Token: SeRestorePrivilege	3652	msiexec.exe
Token: SeTakeOwnershipPrivilege	3652	msiexec.exe
Token: SeShutdownPrivilege	3440	Explorer.EXE
Token: SeCreatePagefilePrivilege	3440	Explorer.EXE
Token: SeShutdownPrivilege	3440	Explorer.EXE
Token: SeCreatePagefilePrivilege	3440	Explorer.EXE
Token: SeShutdownPrivilege	3440	Explorer.EXE
Token: SeCreatePagefilePrivilege	3440	Explorer.EXE
Token: SeShutdownPrivilege	3440	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid process

4556 msiexec.exe
4556 msiexec.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

3440 Explorer.EXE

pid	process
4556	msiexec.exe
4556	msiexec.exe

pid	process
3440	Explorer.EXE

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

msiexec.exeMSIAD67.tmpExplorer.EXEnetsh.exe

description	pid	process	target process
PID 3652 wrote to memory of 4876	3652	msiexec.exe	srtasks.exe
PID 3652 wrote to memory of 4876	3652	msiexec.exe	srtasks.exe
PID 3652 wrote to memory of 1692	3652	msiexec.exe	MSIAD67.tmp
PID 3652 wrote to memory of 1692	3652	msiexec.exe	MSIAD67.tmp
PID 3652 wrote to memory of 1692	3652	msiexec.exe	MSIAD67.tmp
PID 1692 wrote to memory of 372	1692	MSIAD67.tmp	MSIAD67.tmp
PID 1692 wrote to memory of 372	1692	MSIAD67.tmp	MSIAD67.tmp
PID 1692 wrote to memory of 372	1692	MSIAD67.tmp	MSIAD67.tmp
PID 1692 wrote to memory of 372	1692	MSIAD67.tmp	MSIAD67.tmp
PID 1692 wrote to memory of 372	1692	MSIAD67.tmp	MSIAD67.tmp
PID 1692 wrote to memory of 372	1692	MSIAD67.tmp	MSIAD67.tmp
PID 3440 wrote to memory of 4708	3440	Explorer.EXE	netsh.exe
PID 3440 wrote to memory of 4708	3440	Explorer.EXE	netsh.exe
PID 3440 wrote to memory of 4708	3440	Explorer.EXE	netsh.exe
PID 4708 wrote to memory of 2068	4708	netsh.exe	cmd.exe
PID 4708 wrote to memory of 2068	4708	netsh.exe	cmd.exe
PID 4708 wrote to memory of 2068	4708	netsh.exe	cmd.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Windows\system32\msiexec.exe
  msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\acb58cf1f819372ca5f461636f47ef790ec5d2748a5eaa3676104e46cdca1b19.msi
  2⤵
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:4556
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\SysWOW64\netsh.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4708
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Windows\Installer\MSIAD67.tmp"
    3⤵
    PID:2068

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3652
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4876
- C:\Windows\Installer\MSIAD67.tmp
  "C:\Windows\Installer\MSIAD67.tmp"
  2⤵
  - Suspicious use of SetThreadContext
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Windows\Installer\MSIAD67.tmp
    "C:\Windows\Installer\MSIAD67.tmp"
    3⤵
    - Suspicious use of SetThreadContext
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:372

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57ac21.rbs

Filesize
681B

MD5
8265e67c7ef56672480f25c64bfe7e7d

SHA1
1ccb1478c65643501dd46c0de91871c906346c62

SHA256
ea49ad09bd3b664f4494ebc6a251fe6ed9c6e390df5569b34281f0529f139569

SHA512
c189b18ca3aa383d02ce3c5e2256ddefdd5bd06f56b4f92a8898477c03039b72a5e727707ab5a69fcb262d8ae84bb3a414af55e10e4ddf7b85534ee79c755392

Download Submit
C:\Windows\Installer\MSIAD67.tmp

Filesize
453KB

MD5
fb6874156f7530ccaac5c0c8b4ab22ba

SHA1
8e70fa2fb16735594c961db602ccd965f7634122

SHA256
6e7119cc172059cedc3933aa66cfbe816196859a1bb87604ac8253ddebf85f8b

SHA512
56f131092278769526e5d8b784be32781d7c36cbdf14e535919ab654b5a5c9ae7d7734c6549e92bad18b3b5289f9b86a820daed2bdc18fc78392455dfefa1f90

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.7MB

MD5
4ff3740ae5098a7b15474f0a10f3afa6

SHA1
59400ca82c90056bf949972606da562ce11cbedc

SHA256
be7d4defcf951592556737505d50ba4f1153a2fb07f4ea1eb60561480f58e535

SHA512
eded1df7c4b53765cd2ca7f03dfb8003a367adf3d2ef1498ba87c263943b2cd6779ff33eb30e28d57518dd02bfc58fdf4be8f7c3605b95cfc2ae23105b7e57b7

Download Submit
\??\Volume{b8b1c3f9-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{83224c48-7eb9-4d09-bda3-180880608ab4}_OnDiskSnapshotProp

Filesize
6KB

MD5
4a49213e3b8509074f8eb52dfa9e9101

SHA1
df3e72d874f905648f3369f8c918fbe71062766a

SHA256
e666b8ced12883ab1bb8ed5ec47544259798760938cfbc8fa294da7f48f9859e

SHA512
bac623776027496734dfb763d150ccecd605880328fc869d471162470988d335d7d2e951f04f045101504d3f3bbb88ec43c9213ef183113866ccbe6e049cf70c

Download Submit
memory/372-21-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1692-17-0x00000000029F0000-0x00000000029FA000-memory.dmp

Filesize
40KB

Download
memory/1692-16-0x0000000005140000-0x000000000515E000-memory.dmp

Filesize
120KB

Download
memory/1692-15-0x0000000005090000-0x00000000050C0000-memory.dmp

Filesize
192KB

Download
memory/1692-14-0x0000000005180000-0x0000000005212000-memory.dmp

Filesize
584KB

Download
memory/1692-20-0x00000000089B0000-0x0000000008A4C000-memory.dmp

Filesize
624KB

Download
memory/1692-13-0x0000000005730000-0x0000000005CD4000-memory.dmp

Filesize
5.6MB

Download
memory/1692-12-0x00000000007A0000-0x000000000081A000-memory.dmp

Filesize
488KB

Download
memory/3440-43-0x00000000088B0000-0x000000000899E000-memory.dmp

Filesize
952KB

Download
memory/4708-35-0x00000000015F0000-0x000000000160E000-memory.dmp

Filesize
120KB

Download
memory/4708-36-0x00000000015F0000-0x000000000160E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads