formbook | ad43937eb3ac4cfd6bd460642102eafdd1d2007bdbd369e3db624613284c325c

General

Target

ad43937eb3ac4cfd6bd460642102eafdd1d2007bdbd369e3db624613284c325c.exe
Size

254KB
MD5

7e86663fc95e3f20293b31f0cd963035
SHA1

2836048b1082fc7d3e6c7e7bbb6557b03b0b953c
SHA256

ad43937eb3ac4cfd6bd460642102eafdd1d2007bdbd369e3db624613284c325c
SHA512

4e629deff964155575d7f92cc2cbc35389f2c00de83a51389d9cffd170cde450acfd7ffa0eb9616535ea0a38587cd6b5917303bea0994960f9531fc7e6109df9
SSDEEP

6144:wBlL/caJNKQfAY5g28QFjaHWXJ4a2cqaplKYHPlFbfUwndzE0M1:CeavTIYtjaH9cqklvP/dzE0M1

Score

10^/10

formbook s3dy discovery rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

s3dy

Decoy

ravlygte.info

marketnewsville.online

flooring-envy.com

flavourhouston.com

donghohanghieunam.com

globleitsolutions.com

digitalgraphicarts.com

cupidbeautybar.com

cannavybes.com

negative-dsp.com

littledali.com

meltwatersoftware.info

blackdogland.com

danasales.com

mississippiscorecard.com

mainesmoker.com

sirenxinlilzixun.com

tychehang.com

gentciu.com

weckloltd.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Formbook family
formbook

Formbook payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1372-9-0x0000000000400000-0x000000000042E000-memory.dmp	formbook

Loads dropped DLL 1 IoCs

Processes:

ad43937eb3ac4cfd6bd460642102eafdd1d2007bdbd369e3db624613284c325c.exe

pid process

2996 ad43937eb3ac4cfd6bd460642102eafdd1d2007bdbd369e3db624613284c325c.exe

pid	process
2996	ad43937eb3ac4cfd6bd460642102eafdd1d2007bdbd369e3db624613284c325c.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

ad43937eb3ac4cfd6bd460642102eafdd1d2007bdbd369e3db624613284c325c.exe

description	pid	process	target process
PID 2996 set thread context of 1372	2996	ad43937eb3ac4cfd6bd460642102eafdd1d2007bdbd369e3db624613284c325c.exe	ad43937eb3ac4cfd6bd460642102eafdd1d2007bdbd369e3db624613284c325c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

ad43937eb3ac4cfd6bd460642102eafdd1d2007bdbd369e3db624613284c325c.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ad43937eb3ac4cfd6bd460642102eafdd1d2007bdbd369e3db624613284c325c.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

ad43937eb3ac4cfd6bd460642102eafdd1d2007bdbd369e3db624613284c325c.exe

pid process

1372 ad43937eb3ac4cfd6bd460642102eafdd1d2007bdbd369e3db624613284c325c.exe

pid	process
1372	ad43937eb3ac4cfd6bd460642102eafdd1d2007bdbd369e3db624613284c325c.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

ad43937eb3ac4cfd6bd460642102eafdd1d2007bdbd369e3db624613284c325c.exe

description	pid	process	target process
PID 2996 wrote to memory of 1372	2996	ad43937eb3ac4cfd6bd460642102eafdd1d2007bdbd369e3db624613284c325c.exe	ad43937eb3ac4cfd6bd460642102eafdd1d2007bdbd369e3db624613284c325c.exe
PID 2996 wrote to memory of 1372	2996	ad43937eb3ac4cfd6bd460642102eafdd1d2007bdbd369e3db624613284c325c.exe	ad43937eb3ac4cfd6bd460642102eafdd1d2007bdbd369e3db624613284c325c.exe
PID 2996 wrote to memory of 1372	2996	ad43937eb3ac4cfd6bd460642102eafdd1d2007bdbd369e3db624613284c325c.exe	ad43937eb3ac4cfd6bd460642102eafdd1d2007bdbd369e3db624613284c325c.exe
PID 2996 wrote to memory of 1372	2996	ad43937eb3ac4cfd6bd460642102eafdd1d2007bdbd369e3db624613284c325c.exe	ad43937eb3ac4cfd6bd460642102eafdd1d2007bdbd369e3db624613284c325c.exe
PID 2996 wrote to memory of 1372	2996	ad43937eb3ac4cfd6bd460642102eafdd1d2007bdbd369e3db624613284c325c.exe	ad43937eb3ac4cfd6bd460642102eafdd1d2007bdbd369e3db624613284c325c.exe
PID 2996 wrote to memory of 1372	2996	ad43937eb3ac4cfd6bd460642102eafdd1d2007bdbd369e3db624613284c325c.exe	ad43937eb3ac4cfd6bd460642102eafdd1d2007bdbd369e3db624613284c325c.exe
PID 2996 wrote to memory of 1372	2996	ad43937eb3ac4cfd6bd460642102eafdd1d2007bdbd369e3db624613284c325c.exe	ad43937eb3ac4cfd6bd460642102eafdd1d2007bdbd369e3db624613284c325c.exe

C:\Users\Admin\AppData\Local\Temp\ad43937eb3ac4cfd6bd460642102eafdd1d2007bdbd369e3db624613284c325c.exe
"C:\Users\Admin\AppData\Local\Temp\ad43937eb3ac4cfd6bd460642102eafdd1d2007bdbd369e3db624613284c325c.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Users\Admin\AppData\Local\Temp\ad43937eb3ac4cfd6bd460642102eafdd1d2007bdbd369e3db624613284c325c.exe
  "C:\Users\Admin\AppData\Local\Temp\ad43937eb3ac4cfd6bd460642102eafdd1d2007bdbd369e3db624613284c325c.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nso730F.tmp\gtlbztpsztf.dll

Filesize
49KB

MD5
6432c43cc5cb60bb4a484470e8693ab3

SHA1
78f0e1e34dbee0fee48d70949ff07deef94215bc

SHA256
e21a1e1f87a1c05b1c97688f72fce20e5f1c42f8579b49d189b3e06f3be8a735

SHA512
760c3906675ca690b23e195a7b4c295289dc6242e096ca3140fc199e41474fff7df0500243bde937e4e5ab311d2c4969f02b8b3d87b97bd26d3c3feee5a5ef6e

Download Submit
memory/1372-9-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2996-7-0x000000007424C000-0x000000007424E000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads