formbook | 4ff42ff73c27136fbf3ff918b0beae0b7e461c6762a3b8e96e1d6826ef2643c4

General

Target

PO#1120098.exe
Size

404KB
MD5

87d4ee2c81b5fae355cad8d154907d7b
SHA1

cb8fc5cfdf9b5f9202360f51f9cd1663177bb719
SHA256

3fe13e6186755a24b331072e722fd65a60f1c40dea337e4f4e53640f083d26b3
SHA512

9c43ec32b1dbb877eb8e51e0a6ab6135e9500d17c17bdaabc3390e0eb6218f66728d6ca40775252f38cedaad3f3555ec0b55afe328dbdf481e2a2d836ece338b
SSDEEP

6144:yGiNSjUEBnA+hiVs8786nkn9eyOZxcyd5jJLMLtO1b3wvG:z1Al17899Gxc+pJLJ

Score

10^/10

formbook f1d4 discovery rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

f1d4

Decoy

kuikstore.com

nr6377.online

finedesigncarpentry.info

weddingsnorthvalley.com

jana-philipp.com

kaiyuancement.com

lucidfear.com

workwithaika.online

webuyyourhome-4cash.com

katiskey.com

twice-tourmerchandise.com

jbmm.net

koper.xyz

entrustedcareers.com

redphoenixvallc.com

fiustore.com

dingsec.xyz

997528.com

carlosmarketer.store

tjhiftstores.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Formbook family
formbook

Formbook payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/1384-15-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1384-18-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1912-24-0x00000000000D0000-0x00000000000FF000-memory.dmp	formbook

Executes dropped EXE 2 IoCs

pid	Process
3040	xyqsqa.exe
1384	xyqsqa.exe

Loads dropped DLL 3 IoCs

pid	Process
2344	PO#1120098.exe
2344	PO#1120098.exe
3040	xyqsqa.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3040 set thread context of 1384	3040	xyqsqa.exe	32
PID 1384 set thread context of 1200	1384	xyqsqa.exe	21
PID 1912 set thread context of 1200	1912	cmstp.exe	21

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PO#1120098.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xyqsqa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmstp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
1384	xyqsqa.exe
1384	xyqsqa.exe
1912	cmstp.exe
1912	cmstp.exe
1912	cmstp.exe
1912	cmstp.exe
1912	cmstp.exe
1912	cmstp.exe
1912	cmstp.exe
1912	cmstp.exe
1912	cmstp.exe
1912	cmstp.exe
1912	cmstp.exe
1912	cmstp.exe
1912	cmstp.exe
1912	cmstp.exe
1912	cmstp.exe
1912	cmstp.exe
1912	cmstp.exe
1912	cmstp.exe
1912	cmstp.exe
1912	cmstp.exe
1912	cmstp.exe
1912	cmstp.exe
1912	cmstp.exe
1912	cmstp.exe
1912	cmstp.exe
1912	cmstp.exe
1912	cmstp.exe
1912	cmstp.exe
1912	cmstp.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
1384	xyqsqa.exe
1384	xyqsqa.exe
1384	xyqsqa.exe
1912	cmstp.exe
1912	cmstp.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1384	xyqsqa.exe
Token: SeDebugPrivilege	1912	cmstp.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 3040	2344	PO#1120098.exe	31
PID 2344 wrote to memory of 3040	2344	PO#1120098.exe	31
PID 2344 wrote to memory of 3040	2344	PO#1120098.exe	31
PID 2344 wrote to memory of 3040	2344	PO#1120098.exe	31
PID 3040 wrote to memory of 1384	3040	xyqsqa.exe	32
PID 3040 wrote to memory of 1384	3040	xyqsqa.exe	32
PID 3040 wrote to memory of 1384	3040	xyqsqa.exe	32
PID 3040 wrote to memory of 1384	3040	xyqsqa.exe	32
PID 3040 wrote to memory of 1384	3040	xyqsqa.exe	32
PID 3040 wrote to memory of 1384	3040	xyqsqa.exe	32
PID 3040 wrote to memory of 1384	3040	xyqsqa.exe	32
PID 1200 wrote to memory of 1912	1200	Explorer.EXE	33
PID 1200 wrote to memory of 1912	1200	Explorer.EXE	33
PID 1200 wrote to memory of 1912	1200	Explorer.EXE	33
PID 1200 wrote to memory of 1912	1200	Explorer.EXE	33
PID 1200 wrote to memory of 1912	1200	Explorer.EXE	33
PID 1200 wrote to memory of 1912	1200	Explorer.EXE	33
PID 1200 wrote to memory of 1912	1200	Explorer.EXE	33
PID 1912 wrote to memory of 2372	1912	cmstp.exe	34
PID 1912 wrote to memory of 2372	1912	cmstp.exe	34
PID 1912 wrote to memory of 2372	1912	cmstp.exe	34
PID 1912 wrote to memory of 2372	1912	cmstp.exe	34

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Users\Admin\AppData\Local\Temp\PO#1120098.exe
  "C:\Users\Admin\AppData\Local\Temp\PO#1120098.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2344
- - C:\Users\Admin\AppData\Local\Temp\xyqsqa.exe
    C:\Users\Admin\AppData\Local\Temp\xyqsqa.exe C:\Users\Admin\AppData\Local\Temp\nbjlcjvmov
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3040
  - - C:\Users\Admin\AppData\Local\Temp\xyqsqa.exe
      C:\Users\Admin\AppData\Local\Temp\xyqsqa.exe C:\Users\Admin\AppData\Local\Temp\nbjlcjvmov
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:1384
- C:\Windows\SysWOW64\cmstp.exe
  "C:\Windows\SysWOW64\cmstp.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1912
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\xyqsqa.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nbjlcjvmov

Filesize
4KB

MD5
2b8b0a034e8fb4d57c0d164ba87e924a

SHA1
fbec290904da1bda280974cc94084f1b7ba298cb

SHA256
53afd5eccd6c60f9e8bea6fe031e3a4ecb14b000d5d53c56f1b4f8b73633f317

SHA512
19b91cab1eff4f8e8a5bdce7fc0269479594e743b9fde868696123669809bbb431169467767c5edf3a0f8049325dedd1563f3a53da8a1bc538516557b1df3728

Download Submit
C:\Users\Admin\AppData\Local\Temp\t2i91mr3jl

Filesize
213KB

MD5
7b03b9ce6b0a3a2352a97acedcda24f2

SHA1
3b2b1935d0cccb4345359a2ed55cb0170a4de4bf

SHA256
0ef25fa1ab9fc1f4ce82d926cdd97974d531a8b0e3050befc6bcc6ca42620888

SHA512
6c124afabad14a532390f747e4f8a6be6460a362ee47eafe09488150170e54312ff6a6df4c474872ff217001bb911757b9777c60ef344d285e7d97ec58718069

Download Submit
\Users\Admin\AppData\Local\Temp\xyqsqa.exe

Filesize
4KB

MD5
21703a2b69551aa3ce5465ae96181491

SHA1
6cb32673f3bf2eac1e9d6f7f21465d9b598b05ec

SHA256
094e08dcd36e68eff615e0e1aa4aa9d0525d5200b212af4ff89ff3b0c5dafdd4

SHA512
edece5ae3dad4d37192bae6d6bec301ce1e7faef181a93218a193ecd3e2e2c89fe2103ff4bd3f8a4f4b0c677b39db36d91586e981fb75826a5558d98f15cfc2e

Download Submit
memory/1200-19-0x0000000004710000-0x000000000484D000-memory.dmp

Filesize
1.2MB

Download
memory/1200-25-0x0000000004710000-0x000000000484D000-memory.dmp

Filesize
1.2MB

Download
memory/1384-15-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1384-18-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1912-22-0x0000000000D50000-0x0000000000D68000-memory.dmp

Filesize
96KB

Download
memory/1912-23-0x0000000000D50000-0x0000000000D68000-memory.dmp

Filesize
96KB

Download
memory/1912-24-0x00000000000D0000-0x00000000000FF000-memory.dmp

Filesize
188KB

Download
memory/3040-14-0x0000000000250000-0x0000000000252000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing