formbook | c1858ad1833c246ff8bf6cf2c60bace1f63dca90674b2a3006deaea9013c4079

General

Target

PO.exe
Size

465KB
MD5

4de9bfdd90db75c0b1ad968af9c094b2
SHA1

6c674e0cdc8735a3cf9bb6530c1ea08c4da13744
SHA256

45cb18a4c71c0330d1d8d493e0e32f7c55e6125d7219b0dedee54ccfe0aa85c9
SHA512

93a850a9881aedacfa2fafa35e7f316bcb260f424f4a566e35fdca773f10be1e3f02297c79f2ac882a027489b04f5c952e3c15a0151ece0f9be4ecf2c3318f59
SSDEEP

12288:ottbLWQOiDKDfdhBQwEgL8EObvrdz0YOsWN6Ax3ThZB:+bCiDuFhBQwtL8truYONN1B

Score

10^/10

formbook s2l6 discovery rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

s2l6

Decoy

avispk.store

thomasfreitag.net

audazzo.com

wheelblastspareparts.com

babeson.top

bvvseafood-shop.com

fibertech.xyz

tapscrawlspacecleanup.com

jujiashu.com

lavech.com

kusdportal.com

luissonautodetailing.com

lomboktourist.com

mazaltovgift.com

u3vs.digital

metanovi.win

dakontoys.com

estavrse.com

partnerwithsentri.com

nissanquantum.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Formbook family
formbook

Formbook payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/2868-12-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/2868-16-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/2868-20-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1620 set thread context of 2868	1620	PO.exe	31
PID 2868 set thread context of 1140	2868	PO.exe	20
PID 2868 set thread context of 1140	2868	PO.exe	20

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PO.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2868	PO.exe
2868	PO.exe
2868	PO.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2868	PO.exe
2868	PO.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2868	PO.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 2868	1620	PO.exe	31
PID 1620 wrote to memory of 2868	1620	PO.exe	31
PID 1620 wrote to memory of 2868	1620	PO.exe	31
PID 1620 wrote to memory of 2868	1620	PO.exe	31
PID 1620 wrote to memory of 2868	1620	PO.exe	31
PID 1620 wrote to memory of 2868	1620	PO.exe	31
PID 1620 wrote to memory of 2868	1620	PO.exe	31

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1140
- C:\Users\Admin\AppData\Local\Temp\PO.exe
  "C:\Users\Admin\AppData\Local\Temp\PO.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1620
- - C:\Users\Admin\AppData\Local\Temp\PO.exe
    "C:\Users\Admin\AppData\Local\Temp\PO.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:2868
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:2764
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:2860
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:2636
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:2836
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:2704
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:2792
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:2856
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:2016
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:960
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:2768
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:2876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1140-18-0x00000000066C0000-0x00000000067FD000-memory.dmp

Filesize
1.2MB

Download
memory/1140-24-0x0000000007530000-0x00000000076C7000-memory.dmp

Filesize
1.6MB

Download
memory/1140-23-0x00000000066C0000-0x00000000067FD000-memory.dmp

Filesize
1.2MB

Download
memory/1140-22-0x0000000007530000-0x00000000076C7000-memory.dmp

Filesize
1.6MB

Download
memory/1620-1-0x0000000000F70000-0x0000000000FEA000-memory.dmp

Filesize
488KB

Download
memory/1620-2-0x0000000073F10000-0x00000000745FE000-memory.dmp

Filesize
6.9MB

Download
memory/1620-3-0x0000000000380000-0x000000000038C000-memory.dmp

Filesize
48KB

Download
memory/1620-4-0x0000000073F1E000-0x0000000073F1F000-memory.dmp

Filesize
4KB

Download
memory/1620-5-0x0000000073F10000-0x00000000745FE000-memory.dmp

Filesize
6.9MB

Download
memory/1620-6-0x00000000047F0000-0x0000000004848000-memory.dmp

Filesize
352KB

Download
memory/1620-0-0x0000000073F1E000-0x0000000073F1F000-memory.dmp

Filesize
4KB

Download
memory/1620-13-0x0000000073F10000-0x00000000745FE000-memory.dmp

Filesize
6.9MB

Download
memory/2868-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2868-14-0x0000000000970000-0x0000000000C73000-memory.dmp

Filesize
3.0MB

Download
memory/2868-17-0x0000000000140000-0x0000000000154000-memory.dmp

Filesize
80KB

Download
memory/2868-16-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2868-21-0x00000000001D0000-0x00000000001E4000-memory.dmp

Filesize
80KB

Download
memory/2868-20-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2868-12-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2868-8-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2868-7-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing