formbook | 5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900

General

Target

5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe
Size

673KB
MD5

0a4e34ccc6e3e118f225a4f38f731a14
SHA1

d8f89c49dbf6376607ea5379963bd95973fbfd18
SHA256

5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900
SHA512

9fe90ed6095223ee98eb1372708cf77c7b2cd2482899bded7bd9f99f823afdeb89370309e0a087000e4345dab4b10a428ffd1d0afa486b7091f8fc3f30d0cc70
SSDEEP

12288:1XFAO9mjNkvzScpPdK/Pr595FUCCVjscJ4nX0q2mY9+QQh3HEc:1XFNQyvzSYlCNIV+nX0q2I3HEc

Score

10^/10

formbook hy29 discovery rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

hy29

Decoy

obswell.online

etflix.luxury

ulunguwethu.store

ulbcenter.shop

nswering-service-mi-de-tt.click

upport-marketplace84.click

wepxbd163.lat

mplants-doctors.today

aofexf90yj.top

hermodynamic.space

dfg3n489.cyou

off.gay

alkak.cam

ijanarko.net

7tl.site

yaanincma.store

ires-47022.bond

elek4dalt77.xyz

foxsakepeople.online

ndefeatedqs.shop

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Formbook family
formbook

Formbook payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2432-19-0x0000000000400000-0x0000000001462000-memory.dmp	formbook
behavioral1/memory/2432-20-0x0000000000400000-0x0000000001462000-memory.dmp	formbook

Loads dropped DLL 1 IoCs

Processes:

5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe

pid	Process
2520	5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe

pid	Process
2432	5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe

pid	Process
2520	5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe
2432	5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe

description	pid	Process	procid_target
PID 2520 set thread context of 2432	2520	5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe	31

Drops file in Windows directory 1 IoCs

Processes:

5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe

description	ioc	Process
File opened for modification	C:\Windows\fips\beskydende.ini	5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe

pid	Process
2432	5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe

pid	Process
2520	5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe

description	pid	Process	procid_target
PID 2520 wrote to memory of 2432	2520	5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe	31
PID 2520 wrote to memory of 2432	2520	5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe	31
PID 2520 wrote to memory of 2432	2520	5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe	31
PID 2520 wrote to memory of 2432	2520	5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe	31
PID 2520 wrote to memory of 2432	2520	5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe	31
PID 2520 wrote to memory of 2432	2520	5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe	31

C:\Users\Admin\AppData\Local\Temp\5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe
"C:\Users\Admin\AppData\Local\Temp\5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Users\Admin\AppData\Local\Temp\5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe
  "C:\Users\Admin\AppData\Local\Temp\5bdeae823decc2e03dbe71ea05e7ea871badc0865c0a2d0580d69761e1175900.exe"
  2⤵
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nstBAC9.tmp\System.dll

Filesize
12KB

MD5
4add245d4ba34b04f213409bfe504c07

SHA1
ef756d6581d70e87d58cc4982e3f4d18e0ea5b09

SHA256
9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706

SHA512
1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d

Download Submit
memory/2432-18-0x00000000778A0000-0x0000000077A49000-memory.dmp

Filesize
1.7MB

Download
memory/2432-17-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2432-19-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2432-20-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2520-13-0x0000000004920000-0x0000000006E29000-memory.dmp

Filesize
37.0MB

Download
memory/2520-14-0x00000000778A1000-0x00000000779A2000-memory.dmp

Filesize
1.0MB

Download
memory/2520-15-0x00000000778A0000-0x0000000077A49000-memory.dmp

Filesize
1.7MB

Download
memory/2520-16-0x0000000004920000-0x0000000006E29000-memory.dmp

Filesize
37.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads