formbook | 7d09a3768f7dfb3e2aaacabc46d05e59fc4ae20ee20c3e0c61e371ad5e3c30a3

General

Target

S12GF803.exe
Size

276KB
MD5

73d7525cc16a70fdd326f3cee8928a80
SHA1

2354ed7b61f9764d318088aca0c92884e408aa28
SHA256

4518329e81a1a2e8a9bebd6dc7797ec5cc93723075409cd44e89d572da46eab4
SHA512

40722cda09838d1f5e0ddde6dbbde9111149bb59c02b21af63cf1626fa2cb59a7126d018ceccaff80295bbc4f0f8e84f065104f971a9b587112a454a653afcef
SSDEEP

6144:/wNTMFkC+gUJIqC7uITtV66zZ6zNpTbwnxR7PUj:ZFk5k7xlAbwnAj

Score

10^/10

formbook sl12 discovery rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

sl12

Decoy

monsore-records.com

discoverthis.world

ishop-brasil.com

foxeshaveholesintl.com

currenteitherknowledge.xyz

haaph.com

leggacyfarm.com

theaudiobookdb.net

ungerstahlbaubrehna.com

cliphindi.com

thht86.com

b4d5h0t.com

yashentcbsmall.com

ltcibenefits.com

allwaystravelservice.com

1gethear.com

elstery.com

buyervalet.com

snowyrangecpa.com

bshuan.icu

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Formbook family
formbook

Formbook payload 4 IoCs

rat

resource	yara_rule
behavioral1/memory/2796-17-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/2796-20-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/2796-23-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/2900-30-0x0000000000080000-0x00000000000AF000-memory.dmp	formbook

Executes dropped EXE 2 IoCs

pid	Process
2404	xsdzemml.exe
2796	xsdzemml.exe

Loads dropped DLL 3 IoCs

pid	Process
1920	S12GF803.exe
1920	S12GF803.exe
2404	xsdzemml.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2404 set thread context of 2796	2404	xsdzemml.exe	31
PID 2796 set thread context of 1212	2796	xsdzemml.exe	21
PID 2796 set thread context of 1212	2796	xsdzemml.exe	21
PID 2900 set thread context of 1212	2900	svchost.exe	21

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xsdzemml.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	S12GF803.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
2796	xsdzemml.exe
2796	xsdzemml.exe
2796	xsdzemml.exe
2900	svchost.exe
2900	svchost.exe
2900	svchost.exe
2900	svchost.exe
2900	svchost.exe
2900	svchost.exe
2900	svchost.exe
2900	svchost.exe
2900	svchost.exe
2900	svchost.exe
2900	svchost.exe
2900	svchost.exe
2900	svchost.exe
2900	svchost.exe
2900	svchost.exe
2900	svchost.exe
2900	svchost.exe
2900	svchost.exe
2900	svchost.exe
2900	svchost.exe
2900	svchost.exe
2900	svchost.exe
2900	svchost.exe
2900	svchost.exe
2900	svchost.exe
2900	svchost.exe
2900	svchost.exe
2900	svchost.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
2796	xsdzemml.exe
2796	xsdzemml.exe
2796	xsdzemml.exe
2796	xsdzemml.exe
2900	svchost.exe
2900	svchost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2796	xsdzemml.exe
Token: SeDebugPrivilege	2900	svchost.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1920 wrote to memory of 2404	1920	S12GF803.exe	30
PID 1920 wrote to memory of 2404	1920	S12GF803.exe	30
PID 1920 wrote to memory of 2404	1920	S12GF803.exe	30
PID 1920 wrote to memory of 2404	1920	S12GF803.exe	30
PID 2404 wrote to memory of 2796	2404	xsdzemml.exe	31
PID 2404 wrote to memory of 2796	2404	xsdzemml.exe	31
PID 2404 wrote to memory of 2796	2404	xsdzemml.exe	31
PID 2404 wrote to memory of 2796	2404	xsdzemml.exe	31
PID 2404 wrote to memory of 2796	2404	xsdzemml.exe	31
PID 2404 wrote to memory of 2796	2404	xsdzemml.exe	31
PID 2404 wrote to memory of 2796	2404	xsdzemml.exe	31
PID 1212 wrote to memory of 2900	1212	Explorer.EXE	32
PID 1212 wrote to memory of 2900	1212	Explorer.EXE	32
PID 1212 wrote to memory of 2900	1212	Explorer.EXE	32
PID 1212 wrote to memory of 2900	1212	Explorer.EXE	32
PID 2900 wrote to memory of 2736	2900	svchost.exe	33
PID 2900 wrote to memory of 2736	2900	svchost.exe	33
PID 2900 wrote to memory of 2736	2900	svchost.exe	33
PID 2900 wrote to memory of 2736	2900	svchost.exe	33

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Users\Admin\AppData\Local\Temp\S12GF803.exe
  "C:\Users\Admin\AppData\Local\Temp\S12GF803.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1920
- - C:\Users\Admin\AppData\Local\Temp\xsdzemml.exe
    C:\Users\Admin\AppData\Local\Temp\xsdzemml.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2404
  - - C:\Users\Admin\AppData\Local\Temp\xsdzemml.exe
      C:\Users\Admin\AppData\Local\Temp\xsdzemml.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:2796
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\SysWOW64\svchost.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2900
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\xsdzemml.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4mf1mzagrewnllrh6j

Filesize
211KB

MD5
8c48106096f4a63651b3904ff5564120

SHA1
fd237c8ee9120742312c3f231bd38e499cc01d72

SHA256
dc7b738bcef4cd84d1878b06dfeb06766d325dd662822d7846a61f3a4e036412

SHA512
9f351531ae3134c77ec5c6f76eb30ca4fc7be50e9200990f386305ccb4ae78f5377723633c8ee2bb5068c57b0f5f7baf7c97aa1da1400ba8b80aaebb356afde6

Download Submit
C:\Users\Admin\AppData\Local\Temp\rophhuo

Filesize
4KB

MD5
f9b46f5ed05166cdc656815ff324f538

SHA1
e2ce5a8c29dd51ac34dc88118a153269b3a11709

SHA256
c6dcc3d8f540d15bffd5fd31c2ac9e0cfebcf6473cb55975e7a50fa9055cbf76

SHA512
1d444c0ac9f19c02bcfa0468be96cc6efd0c9d32ff6cb7fa7f120da3fb7fd2878ab6424de23da975c7ccd66523f633dc1a630867244aba89c537123cc5c786b8

Download Submit
\Users\Admin\AppData\Local\Temp\xsdzemml.exe

Filesize
55KB

MD5
e2aa91fb3599cb7cbbd1cb3d5e4c3063

SHA1
f4278c4f6e1f3358b1ea4748aa2c9401488b6fb7

SHA256
2e61c28dea3a0dcde21b06fba573bac629a6cc2fb464bde2f332f3e8c3ba62df

SHA512
f5f91140dbeaf73a724bca50914a13bb4bd180c0a6b4ccc87f7abd34cea94bd0f16d2d601ec8e6fde5d414f24e8078622f2f203d135469213d524a0f4b632ce3

Download Submit
memory/1212-25-0x00000000051A0000-0x00000000052A1000-memory.dmp

Filesize
1.0MB

Download
memory/1212-21-0x00000000051A0000-0x00000000052A1000-memory.dmp

Filesize
1.0MB

Download
memory/1212-24-0x00000000052B0000-0x0000000005381000-memory.dmp

Filesize
836KB

Download
memory/1212-31-0x00000000052B0000-0x0000000005381000-memory.dmp

Filesize
836KB

Download
memory/2404-14-0x0000000000290000-0x0000000000292000-memory.dmp

Filesize
8KB

Download
memory/2796-17-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2796-20-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2796-23-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2900-29-0x0000000000D50000-0x0000000000D58000-memory.dmp

Filesize
32KB

Download
memory/2900-28-0x0000000000D50000-0x0000000000D58000-memory.dmp

Filesize
32KB

Download
memory/2900-30-0x0000000000080000-0x00000000000AF000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing