formbook | d4d0077e12c1b749c38b0cedf2de547b49aaf3d97bdbbe00bc68ba06da6356b8

General

Target

15676e5199913f6f2263bbb3ac5ebf1aab24703083bbcd0934a7c09ac7c0abb0.exe
Size

244KB
MD5

cccc6563d6ec2f4b31a72592795147ba
SHA1

01bdcece3d320ba8e110b60d33cc95bd44bfdc21
SHA256

15676e5199913f6f2263bbb3ac5ebf1aab24703083bbcd0934a7c09ac7c0abb0
SHA512

eaebe3cf77a5ad43723704d8f195735e964dd476a210b4ad40b71159400af11567e3359bd9f0fd209dc5e7e656e2b0855a9756a4cdf4eb0c4aa180978c618e29
SSDEEP

6144:HNeZmQNbl/ZVFHVsPFoHqjaufM0FvZCGu5aobQ9Imy4mw:HNlObl/ZHioDufM0Fkd5aD2mH5

Score

10^/10

formbook r1e3 discovery rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

r1e3

Decoy

floorwaves.com

leshigou.top

2y3jq.com

karobazaar.com

cookdd9.com

xn--9kqu10bhqv.top

hollieforson.com

peachso.com

gerberry.info

abslikepro.com

lesourire-official.com

dfhgxi.icu

lightofcg.com

hismozart.com

nieuwemaniervanleven.com

trimble-gs-112-cable-reel.com

putacandleinit.com

gopenly.xyz

northcountyneuropsychology.com

thekittyherbalist.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Formbook family
formbook

Formbook payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/2008-14-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/2008-18-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1460-24-0x00000000000D0000-0x00000000000FF000-memory.dmp	formbook

Executes dropped EXE 2 IoCs

pid	Process
2304	vyozh.exe
2008	vyozh.exe

Loads dropped DLL 2 IoCs

pid	Process
2204	15676e5199913f6f2263bbb3ac5ebf1aab24703083bbcd0934a7c09ac7c0abb0.exe
2304	vyozh.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2304 set thread context of 2008	2304	vyozh.exe	29
PID 2008 set thread context of 1216	2008	vyozh.exe	21
PID 1460 set thread context of 1216	1460	cmstp.exe	21

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	15676e5199913f6f2263bbb3ac5ebf1aab24703083bbcd0934a7c09ac7c0abb0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vyozh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmstp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
2008	vyozh.exe
2008	vyozh.exe
1460	cmstp.exe
1460	cmstp.exe
1460	cmstp.exe
1460	cmstp.exe
1460	cmstp.exe
1460	cmstp.exe
1460	cmstp.exe
1460	cmstp.exe
1460	cmstp.exe
1460	cmstp.exe
1460	cmstp.exe
1460	cmstp.exe
1460	cmstp.exe
1460	cmstp.exe
1460	cmstp.exe
1460	cmstp.exe
1460	cmstp.exe
1460	cmstp.exe
1460	cmstp.exe
1460	cmstp.exe
1460	cmstp.exe
1460	cmstp.exe
1460	cmstp.exe
1460	cmstp.exe
1460	cmstp.exe
1460	cmstp.exe
1460	cmstp.exe
1460	cmstp.exe
1460	cmstp.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
2008	vyozh.exe
2008	vyozh.exe
2008	vyozh.exe
1460	cmstp.exe
1460	cmstp.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2008	vyozh.exe
Token: SeDebugPrivilege	1460	cmstp.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2304	2204	15676e5199913f6f2263bbb3ac5ebf1aab24703083bbcd0934a7c09ac7c0abb0.exe	28
PID 2204 wrote to memory of 2304	2204	15676e5199913f6f2263bbb3ac5ebf1aab24703083bbcd0934a7c09ac7c0abb0.exe	28
PID 2204 wrote to memory of 2304	2204	15676e5199913f6f2263bbb3ac5ebf1aab24703083bbcd0934a7c09ac7c0abb0.exe	28
PID 2204 wrote to memory of 2304	2204	15676e5199913f6f2263bbb3ac5ebf1aab24703083bbcd0934a7c09ac7c0abb0.exe	28
PID 2304 wrote to memory of 2008	2304	vyozh.exe	29
PID 2304 wrote to memory of 2008	2304	vyozh.exe	29
PID 2304 wrote to memory of 2008	2304	vyozh.exe	29
PID 2304 wrote to memory of 2008	2304	vyozh.exe	29
PID 2304 wrote to memory of 2008	2304	vyozh.exe	29
PID 2304 wrote to memory of 2008	2304	vyozh.exe	29
PID 2304 wrote to memory of 2008	2304	vyozh.exe	29
PID 1216 wrote to memory of 1460	1216	Explorer.EXE	33
PID 1216 wrote to memory of 1460	1216	Explorer.EXE	33
PID 1216 wrote to memory of 1460	1216	Explorer.EXE	33
PID 1216 wrote to memory of 1460	1216	Explorer.EXE	33
PID 1216 wrote to memory of 1460	1216	Explorer.EXE	33
PID 1216 wrote to memory of 1460	1216	Explorer.EXE	33
PID 1216 wrote to memory of 1460	1216	Explorer.EXE	33
PID 1460 wrote to memory of 2420	1460	cmstp.exe	34
PID 1460 wrote to memory of 2420	1460	cmstp.exe	34
PID 1460 wrote to memory of 2420	1460	cmstp.exe	34
PID 1460 wrote to memory of 2420	1460	cmstp.exe	34

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Users\Admin\AppData\Local\Temp\15676e5199913f6f2263bbb3ac5ebf1aab24703083bbcd0934a7c09ac7c0abb0.exe
  "C:\Users\Admin\AppData\Local\Temp\15676e5199913f6f2263bbb3ac5ebf1aab24703083bbcd0934a7c09ac7c0abb0.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2204
- - C:\Users\Admin\AppData\Local\Temp\vyozh.exe
    C:\Users\Admin\AppData\Local\Temp\vyozh.exe C:\Users\Admin\AppData\Local\Temp\gehccpdltf
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2304
  - - C:\Users\Admin\AppData\Local\Temp\vyozh.exe
      C:\Users\Admin\AppData\Local\Temp\vyozh.exe C:\Users\Admin\AppData\Local\Temp\gehccpdltf
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:2008
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:2820
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:2936
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:1268
- C:\Windows\SysWOW64\cmstp.exe
  "C:\Windows\SysWOW64\cmstp.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1460
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\vyozh.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gehccpdltf

Filesize
4KB

MD5
ca90529b1d776da2aa4e34a2cbfe6285

SHA1
6ee3a8438b5b371252ae3b6244439bf0c2697e2f

SHA256
47f9cb1338faaccaaffcad5a076d6e4ae5a7041b5c393b53b29d6f5fe08f3d63

SHA512
768943698acb7e01f6396b10690a263ad84fd8fe8da6944ca42907cba974d43bf22d18de70e98ff9024732bba81b7daf9bda26e9f7a7040d36a323fbd286abc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\oh3pmsvnq6u12pfsiun

Filesize
214KB

MD5
e419594f70d9fd2bfe630503ccb51ab6

SHA1
3f3c863f2f9a6206105fd5ead347a7feecf46a58

SHA256
d4225f54c7be7a20fabbc123ddd00a0ef759b4f9c7bc30df04725828bc540b5f

SHA512
85cc3f04feac5dadca8f2329f011e0e4227a583ebc80c558d87692ae0a03461794c46c123cfd5c807f63f833c2f8464078cd9af7c49f82de66c4ee2d1a321c2f

Download Submit
\Users\Admin\AppData\Local\Temp\vyozh.exe

Filesize
7KB

MD5
cd213c05fe29d8ea2abebe71678b9828

SHA1
ac00f24f1d70bfc40909d438c93362e53e954fd3

SHA256
c3ef3d6c6f8b85e8d88363028d7058662fd32709836c707daf56e597570e3de9

SHA512
457d821f5c2965ea5c3e1dc50fd44bf0e67e175f109efd5ae61fd4d8d123bbb75c856b545008e19a8c56af601999d56cada617dc368d4ae8f02e0099ed72e23b

Download Submit
memory/1216-20-0x0000000004290000-0x0000000004374000-memory.dmp

Filesize
912KB

Download
memory/1216-25-0x0000000004290000-0x0000000004374000-memory.dmp

Filesize
912KB

Download
memory/1460-24-0x00000000000D0000-0x00000000000FF000-memory.dmp

Filesize
188KB

Download
memory/1460-21-0x0000000000730000-0x0000000000748000-memory.dmp

Filesize
96KB

Download
memory/1460-23-0x0000000000730000-0x0000000000748000-memory.dmp

Filesize
96KB

Download
memory/2008-19-0x0000000000430000-0x0000000000444000-memory.dmp

Filesize
80KB

Download
memory/2008-18-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2008-15-0x0000000000920000-0x0000000000C23000-memory.dmp

Filesize
3.0MB

Download
memory/2008-14-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2304-9-0x0000000000160000-0x0000000000162000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing