formbook | 8eade02ff3abef532d9070a1e3ea6f8df6c213748bce1c0f55b75686706a53c4

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/06/2024, 01:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8eade02ff3abef532d9070a1e3ea6f8df6c213748bce1c0f55b75686706a53c4.exe
Size 1.1MB
Sample240608-bq8cpafa5y
SHA256 8eade02ff3abef532d9070a1e3ea6f8df6c213748bce1c0f55b75686706a53c4
MD5 0c6407d325d33ae44fe0ea0fc5f85711
SHA1 fe4a8ecf4a0f744bd9550824daf199af03920821
SHA512 6876d67f36b301704b86a6b3843c2a7c2a4520fdc67b93a4556090b4941c217540a0d0d4bf1ceba791152c4d9a083cce8b9e6190ed8ac2284b96dc95cc87bad3
SSDEEP 24576:KAHnh+eWsN3skA4RV1Hom2KXMmHahnQdptU/Nmvvv+zrVV7Dip5:dh+ZkldoPK8YahQdp0geVV7Q
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook rn94 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

rn94

Decoy

st68v.xyz
conciergenotary.net
qwechaotk.top
rtpdonatoto29.xyz
8ad.xyz
powermove.top
cameras-30514.bond
vanguardcoffee.shop
umoe53fxc1bsujv.buzz
consultoriamax.net
hplxx.com
ndu.wtf
yzh478c.xyz
bigbrown999.site
xiake07.asia
resdai.xyz
the35678.shop
ba6rf.rest
ceo688.com
phimxhot.xyz
010101-11122-2222.cloud
champion-casino-skw.buzz
laku77.bar
popumail.net
stargazerastrology.click
beauty.university
t460.top
sparkyos.app
day2go.net
minrungis.shop
cognigrid.com
abandoned-houses-39863.bond
liderparti.store
hinet.tech
moviemax.live
business-printer-22001.bond
yakintv.pro
longmaosol.xyz
hello4d.dev
vestircool.store
surpriseinside.net
betflixfan.asia
ln2m1.shop
5302mcavt.website
conf-contact.online
31140.ooo
bdkasinoxox.xyz
nicoleb.tech
mainz-cruise-deals.today
run-run.tokyo
practicalfranchises.info
usmanovbanki-uz.space
superlottery.top
zabbet911.bet
ambassadorshipvottings.click
sangforln.tech
expertoffersusa.lat
plong.cloud
cryptoautomata.dev
dq33xa.xyz
handtools-16660.bond
24763wbk.hair
sportswear-30530.bond
lusuidnx.shop
laske.xyz

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 4 IoCs

rat

resource	yara_rule
behavioral2/memory/916-28-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/916-32-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/916-35-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/4536-40-0x0000000000E50000-0x0000000000E7F000-memory.dmp	formbook

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs	name.exe

Executes dropped EXE 1 IoCs

pid	Process
1900	name.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0003000000022974-13.dat	autoit_exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1900 set thread context of 916	1900	name.exe	86
PID 916 set thread context of 3508	916	svchost.exe	56
PID 916 set thread context of 3508	916	svchost.exe	56
PID 4536 set thread context of 3508	4536	ipconfig.exe	56

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4536	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 62 IoCs

pid	Process
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
4536	ipconfig.exe
4536	ipconfig.exe
4536	ipconfig.exe
4536	ipconfig.exe
4536	ipconfig.exe
4536	ipconfig.exe
4536	ipconfig.exe
4536	ipconfig.exe
4536	ipconfig.exe
4536	ipconfig.exe
4536	ipconfig.exe
4536	ipconfig.exe
4536	ipconfig.exe
4536	ipconfig.exe
4536	ipconfig.exe
4536	ipconfig.exe
4536	ipconfig.exe
4536	ipconfig.exe
4536	ipconfig.exe
4536	ipconfig.exe
4536	ipconfig.exe
4536	ipconfig.exe
4536	ipconfig.exe
4536	ipconfig.exe
4536	ipconfig.exe
4536	ipconfig.exe
4536	ipconfig.exe
4536	ipconfig.exe
4536	ipconfig.exe
4536	ipconfig.exe
4536	ipconfig.exe
4536	ipconfig.exe
4536	ipconfig.exe
4536	ipconfig.exe
4536	ipconfig.exe
4536	ipconfig.exe
4536	ipconfig.exe
4536	ipconfig.exe
4536	ipconfig.exe
4536	ipconfig.exe
4536	ipconfig.exe
4536	ipconfig.exe
4536	ipconfig.exe
4536	ipconfig.exe
4536	ipconfig.exe
4536	ipconfig.exe
4536	ipconfig.exe
4536	ipconfig.exe
4536	ipconfig.exe
4536	ipconfig.exe
4536	ipconfig.exe
4536	ipconfig.exe
4536	ipconfig.exe
4536	ipconfig.exe
4536	ipconfig.exe
4536	ipconfig.exe

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
1900	name.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
4536	ipconfig.exe
4536	ipconfig.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	916	svchost.exe
Token: SeShutdownPrivilege	3508	Explorer.EXE
Token: SeCreatePagefilePrivilege	3508	Explorer.EXE
Token: SeShutdownPrivilege	3508	Explorer.EXE
Token: SeCreatePagefilePrivilege	3508	Explorer.EXE
Token: SeDebugPrivilege	4536	ipconfig.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
2340	8eade02ff3abef532d9070a1e3ea6f8df6c213748bce1c0f55b75686706a53c4.exe
2340	8eade02ff3abef532d9070a1e3ea6f8df6c213748bce1c0f55b75686706a53c4.exe
1900	name.exe
1900	name.exe
3508	Explorer.EXE
3508	Explorer.EXE

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
2340	8eade02ff3abef532d9070a1e3ea6f8df6c213748bce1c0f55b75686706a53c4.exe
2340	8eade02ff3abef532d9070a1e3ea6f8df6c213748bce1c0f55b75686706a53c4.exe
1900	name.exe
1900	name.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3508	Explorer.EXE

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 1900	2340	8eade02ff3abef532d9070a1e3ea6f8df6c213748bce1c0f55b75686706a53c4.exe	85
PID 2340 wrote to memory of 1900	2340	8eade02ff3abef532d9070a1e3ea6f8df6c213748bce1c0f55b75686706a53c4.exe	85
PID 2340 wrote to memory of 1900	2340	8eade02ff3abef532d9070a1e3ea6f8df6c213748bce1c0f55b75686706a53c4.exe	85
PID 1900 wrote to memory of 916	1900	name.exe	86
PID 1900 wrote to memory of 916	1900	name.exe	86
PID 1900 wrote to memory of 916	1900	name.exe	86
PID 1900 wrote to memory of 916	1900	name.exe	86
PID 3508 wrote to memory of 4536	3508	Explorer.EXE	93
PID 3508 wrote to memory of 4536	3508	Explorer.EXE	93
PID 3508 wrote to memory of 4536	3508	Explorer.EXE	93
PID 4536 wrote to memory of 3928	4536	ipconfig.exe	96
PID 4536 wrote to memory of 3928	4536	ipconfig.exe	96
PID 4536 wrote to memory of 3928	4536	ipconfig.exe	96

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3508
- C:\Users\Admin\AppData\Local\Temp\8eade02ff3abef532d9070a1e3ea6f8df6c213748bce1c0f55b75686706a53c4.exe
  "C:\Users\Admin\AppData\Local\Temp\8eade02ff3abef532d9070a1e3ea6f8df6c213748bce1c0f55b75686706a53c4.exe"
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2340
- - C:\Users\Admin\AppData\Local\directory\name.exe
    "C:\Users\Admin\AppData\Local\Temp\8eade02ff3abef532d9070a1e3ea6f8df6c213748bce1c0f55b75686706a53c4.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1900
  - - C:\Windows\SysWOW64\svchost.exe
      "C:\Users\Admin\AppData\Local\Temp\8eade02ff3abef532d9070a1e3ea6f8df6c213748bce1c0f55b75686706a53c4.exe"
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:916
- C:\Windows\SysWOW64\ipconfig.exe
  "C:\Windows\SysWOW64\ipconfig.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Gathers network information
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4536
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Windows\SysWOW64\svchost.exe"
    3⤵
    PID:3928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

biopsies

Path C:\Users\Admin\AppData\Local\Temp\biopsies
Size 28KB
SHA256 4392549d97f9eed84f606b3e39767702d8c394d524578bd85ac868821f9228fe
MD5 93539ca4f277d10b079052b96465d096
SHA1 542edab9599e3589407ef215337806b7f101a920
SHA512 5d4f6df33778dec60b0bc962e61404133e3e3f481d5d7c36a8b66ae03532784213b800825cc607e6e26b90c4245dca85a9d32619fb2045dbef9160c67f2819e9
SSDEEP 768:WiTZ+2QoioGRk6ZklputwjpjBkCiw2RuJ3nXKUrvzjsNbJ+IIm54vfF3if6gyyNQ:WiTZ+2QoioGRk6ZklputwjpjBkCiw2Rm
MD5 SHA1 SHA512 SSDEEP

Submit Download

name.exe

Path C:\Users\Admin\AppData\Local\directory\name.exe
Size 1.1MB
SHA256 8eade02ff3abef532d9070a1e3ea6f8df6c213748bce1c0f55b75686706a53c4
MD5 0c6407d325d33ae44fe0ea0fc5f85711
SHA1 fe4a8ecf4a0f744bd9550824daf199af03920821
SHA512 6876d67f36b301704b86a6b3843c2a7c2a4520fdc67b93a4556090b4941c217540a0d0d4bf1ceba791152c4d9a083cce8b9e6190ed8ac2284b96dc95cc87bad3
SSDEEP 24576:KAHnh+eWsN3skA4RV1Hom2KXMmHahnQdptU/Nmvvv+zrVV7Dip5:dh+ZkldoPK8YahQdp0geVV7Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/916-36-0x0000000003390000-0x00000000033A5000-memory.dmp

Download

memory/916-30-0x0000000001600000-0x000000000194A000-memory.dmp

Download

memory/916-32-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/916-31-0x0000000000DC0000-0x0000000000DD5000-memory.dmp

Download

memory/916-28-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/916-35-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2340-10-0x00000000014D0000-0x00000000014D4000-memory.dmp

Download

memory/3508-43-0x000000000A7E0000-0x000000000A920000-memory.dmp

Download

memory/3508-37-0x000000000A7E0000-0x000000000A920000-memory.dmp

Download

memory/3508-42-0x0000000008970000-0x0000000008A5C000-memory.dmp

Download

memory/3508-33-0x0000000008970000-0x0000000008A5C000-memory.dmp

Download

memory/3508-45-0x000000000ABA0000-0x000000000AD28000-memory.dmp

Download

memory/3508-46-0x000000000ABA0000-0x000000000AD28000-memory.dmp

Download

memory/3508-49-0x000000000ABA0000-0x000000000AD28000-memory.dmp

Download

memory/4536-38-0x0000000000A20000-0x0000000000A2B000-memory.dmp

Download

memory/4536-39-0x0000000000A20000-0x0000000000A2B000-memory.dmp

Download

memory/4536-40-0x0000000000E50000-0x0000000000E7F000-memory.dmp

Download