formbook | 9983298c20cfbf4d592ab49495ff623673003a942259bab634c3cdad4b918adf

General

Target

0791e8ab1ff5119cb4dedba8cbd260f6a163100eb60657cad11f494cb34bbc71.exe
Size

409KB
MD5

d7fd44db6ff7913a79d60eae65422594
SHA1

00bdf1e46cb1c7a9f0c2d2b354482213517f2c18
SHA256

0791e8ab1ff5119cb4dedba8cbd260f6a163100eb60657cad11f494cb34bbc71
SHA512

b18ffc00c0b5c3e07554d846aa6ed3c99913f81fee441c09db54f77ec717a4161bc447d47780d6a16558f0e96757b1c5e98298dd994ca2ac4ed5531713114fa7
SSDEEP

6144:IzvmRaG/aq0YEYBJ6gjiOFuBt5a9LwNCKFYc/z3EHEle70IEU0rq/UiAY:IicGX0YHJ6gOp+LmCmz3EH1Ft/Uil

Score

10^/10

formbook dv9n discovery rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dv9n

Decoy

nblvqing.com

delmegebuildingproducts.com

xiongba8.com

latuawebreputation.online

nowcloud.tech

cckghs.com

tradeoo.ltd

ppapo.com

tphoaphuongdo.club

whitefoxy.site

bottle-sentences.net

computersewa.com

lushberryholidays.com

motobotz.com

shadurj.com

amazonlexdeveloper.com

shunli178.xyz

sjzzlmh.com

6eu09rp.xyz

novinmes.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Formbook family
formbook

Formbook payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/3040-16-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/3040-21-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/2712-27-0x0000000000760000-0x000000000078F000-memory.dmp	formbook

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	0791e8ab1ff5119cb4dedba8cbd260f6a163100eb60657cad11f494cb34bbc71.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4056 set thread context of 3040	4056	0791e8ab1ff5119cb4dedba8cbd260f6a163100eb60657cad11f494cb34bbc71.exe	101
PID 3040 set thread context of 3460	3040	RegSvcs.exe	56
PID 2712 set thread context of 3460	2712	cmd.exe	56

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0791e8ab1ff5119cb4dedba8cbd260f6a163100eb60657cad11f494cb34bbc71.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3272	schtasks.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
4056	0791e8ab1ff5119cb4dedba8cbd260f6a163100eb60657cad11f494cb34bbc71.exe
4056	0791e8ab1ff5119cb4dedba8cbd260f6a163100eb60657cad11f494cb34bbc71.exe
3040	RegSvcs.exe
3040	RegSvcs.exe
3040	RegSvcs.exe
3040	RegSvcs.exe
2712	cmd.exe
2712	cmd.exe
2712	cmd.exe
2712	cmd.exe
2712	cmd.exe
2712	cmd.exe
2712	cmd.exe
2712	cmd.exe
2712	cmd.exe
2712	cmd.exe
2712	cmd.exe
2712	cmd.exe
2712	cmd.exe
2712	cmd.exe
2712	cmd.exe
2712	cmd.exe
2712	cmd.exe
2712	cmd.exe
2712	cmd.exe
2712	cmd.exe
2712	cmd.exe
2712	cmd.exe
2712	cmd.exe
2712	cmd.exe
2712	cmd.exe
2712	cmd.exe
2712	cmd.exe
2712	cmd.exe
2712	cmd.exe
2712	cmd.exe
2712	cmd.exe
2712	cmd.exe
2712	cmd.exe
2712	cmd.exe
2712	cmd.exe
2712	cmd.exe
2712	cmd.exe
2712	cmd.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
3040	RegSvcs.exe
3040	RegSvcs.exe
3040	RegSvcs.exe
2712	cmd.exe
2712	cmd.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4056	0791e8ab1ff5119cb4dedba8cbd260f6a163100eb60657cad11f494cb34bbc71.exe
Token: SeDebugPrivilege	3040	RegSvcs.exe
Token: SeShutdownPrivilege	3460	Explorer.EXE
Token: SeCreatePagefilePrivilege	3460	Explorer.EXE
Token: SeDebugPrivilege	2712	cmd.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4056 wrote to memory of 3272	4056	0791e8ab1ff5119cb4dedba8cbd260f6a163100eb60657cad11f494cb34bbc71.exe	99
PID 4056 wrote to memory of 3272	4056	0791e8ab1ff5119cb4dedba8cbd260f6a163100eb60657cad11f494cb34bbc71.exe	99
PID 4056 wrote to memory of 3272	4056	0791e8ab1ff5119cb4dedba8cbd260f6a163100eb60657cad11f494cb34bbc71.exe	99
PID 4056 wrote to memory of 3040	4056	0791e8ab1ff5119cb4dedba8cbd260f6a163100eb60657cad11f494cb34bbc71.exe	101
PID 4056 wrote to memory of 3040	4056	0791e8ab1ff5119cb4dedba8cbd260f6a163100eb60657cad11f494cb34bbc71.exe	101
PID 4056 wrote to memory of 3040	4056	0791e8ab1ff5119cb4dedba8cbd260f6a163100eb60657cad11f494cb34bbc71.exe	101
PID 4056 wrote to memory of 3040	4056	0791e8ab1ff5119cb4dedba8cbd260f6a163100eb60657cad11f494cb34bbc71.exe	101
PID 4056 wrote to memory of 3040	4056	0791e8ab1ff5119cb4dedba8cbd260f6a163100eb60657cad11f494cb34bbc71.exe	101
PID 4056 wrote to memory of 3040	4056	0791e8ab1ff5119cb4dedba8cbd260f6a163100eb60657cad11f494cb34bbc71.exe	101
PID 3460 wrote to memory of 2712	3460	Explorer.EXE	102
PID 3460 wrote to memory of 2712	3460	Explorer.EXE	102
PID 3460 wrote to memory of 2712	3460	Explorer.EXE	102
PID 2712 wrote to memory of 664	2712	cmd.exe	103
PID 2712 wrote to memory of 664	2712	cmd.exe	103
PID 2712 wrote to memory of 664	2712	cmd.exe	103

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3460
- C:\Users\Admin\AppData\Local\Temp\0791e8ab1ff5119cb4dedba8cbd260f6a163100eb60657cad11f494cb34bbc71.exe
  "C:\Users\Admin\AppData\Local\Temp\0791e8ab1ff5119cb4dedba8cbd260f6a163100eb60657cad11f494cb34bbc71.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4056
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dvlGnUp" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5F61.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3272
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:3040
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\SysWOW64\cmd.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2712-27-0x0000000000760000-0x000000000078F000-memory.dmp

Filesize
188KB

Download
memory/2712-24-0x0000000000EB0000-0x0000000000F0A000-memory.dmp

Filesize
360KB

Download
memory/2712-26-0x0000000000EB0000-0x0000000000F0A000-memory.dmp

Filesize
360KB

Download
memory/3040-19-0x0000000001310000-0x000000000165A000-memory.dmp

Filesize
3.3MB

Download
memory/3040-21-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3040-22-0x0000000000DD0000-0x0000000000DE4000-memory.dmp

Filesize
80KB

Download
memory/3040-16-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3460-35-0x0000000008B00000-0x0000000008C62000-memory.dmp

Filesize
1.4MB

Download
memory/3460-33-0x0000000008B00000-0x0000000008C62000-memory.dmp

Filesize
1.4MB

Download
memory/3460-32-0x0000000008B00000-0x0000000008C62000-memory.dmp

Filesize
1.4MB

Download
memory/3460-28-0x00000000088E0000-0x0000000008A37000-memory.dmp

Filesize
1.3MB

Download
memory/3460-23-0x00000000088E0000-0x0000000008A37000-memory.dmp

Filesize
1.3MB

Download
memory/4056-6-0x0000000006710000-0x00000000067AC000-memory.dmp

Filesize
624KB

Download
memory/4056-18-0x0000000074DC0000-0x0000000075570000-memory.dmp

Filesize
7.7MB

Download
memory/4056-10-0x000000000A1B0000-0x000000000A208000-memory.dmp

Filesize
352KB

Download
memory/4056-9-0x0000000074DC0000-0x0000000075570000-memory.dmp

Filesize
7.7MB

Download
memory/4056-8-0x0000000074DCE000-0x0000000074DCF000-memory.dmp

Filesize
4KB

Download
memory/4056-7-0x0000000005420000-0x000000000542E000-memory.dmp

Filesize
56KB

Download
memory/4056-0-0x0000000074DCE000-0x0000000074DCF000-memory.dmp

Filesize
4KB

Download
memory/4056-5-0x0000000005060000-0x000000000506A000-memory.dmp

Filesize
40KB

Download
memory/4056-4-0x0000000074DC0000-0x0000000075570000-memory.dmp

Filesize
7.7MB

Download
memory/4056-3-0x0000000005100000-0x0000000005192000-memory.dmp

Filesize
584KB

Download
memory/4056-2-0x0000000005610000-0x0000000005BB4000-memory.dmp

Filesize
5.6MB

Download
memory/4056-1-0x0000000000730000-0x000000000079C000-memory.dmp

Filesize
432KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads