formbook | 36e9bfc5337aa8a4dd2c8c24087a3cdc3f589df01ec12c0d81a28eb62b67b9e4

Analysis

max time kernel
148s
max time network
120s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
26/02/2025, 02:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3xi73dos6I7cy7Z.exe
Size 665KB
Sample250226-dbpcdatls8
SHA256 36e9bfc5337aa8a4dd2c8c24087a3cdc3f589df01ec12c0d81a28eb62b67b9e4
MD5 78fe6d31c4628807f53c8114f6007111
SHA1 8d3ba0fe1b6cf783f21595b8e43c4da5ac6a370a
SHA512 4cb3e835651f208e3a5e0f9022b6acfb94ffba6a6e2c281fca4f9a65d4f20c31e83b5e1af29c9e39aed5d3581fcbdfa3977a7bfec9c12fd4f7b26db09c5bf800
SSDEEP 12288:sO383le9ci9+zEn8fB6SWolRC8jiWBszT17zSF6:s43/+zEnSUkRC6i517c
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook my18 discovery execution rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

my18

Decoy

cicotte.shop
tetrf.net
rkidnclothing.net
ibriz.online
49fb2ka.top
matic.xyz
yh.lol
f59m.club
vc-panels-coral.sbs
tpsx.top
ealturmat.xyz
sianglobalinvestment.site
ourpetia.online
q801.info
oslslat.store
gt77.net
skpmypqxn.xyz
nackcy.shop
abfyxerlink.info
rym.net
reenhive.energy
asinobest.casino
otorhomes-for-seniors-bear.sbs
ateriapg.net
uetedit.net
evalora.xyz
ali100.online
friquechoice.shop
ommunityministernetwork.net
aytollfpg.vip
avurenilopaxo.click
s588zg.top
mtkash.online
etttttt169.top
skconofdallas.net
y009.xyz
r836068.xyz
olankidigipro.online
volvefyxerprotech.info
irosat.pro
romosinevitaveis.shop
hh113.top
77.lol
yjapan-vpass.shop
cvban.xyz
elium.solutions
eimdallsupplychains.net
pabox.xyz
ahooodi.xyz
idadari29nice.makeup
utomotivacion.net
y046.xyz
acucardsvcs.online
35lfeq932r.shop
irtualvisionlk.pro
asis.rent
nkj89qv.top
hetollroads-paytollqqc.help
luspoints.store
elegslga.best
58mc.top
47gy.top
ontery.net
ie.info
b13t17.pro

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Formbook family
formbook

Formbook payload 2 IoCs

rat

resource	yara_rule
behavioral1/memory/2856-24-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/2744-29-0x00000000000E0000-0x000000000010F000-memory.dmp	formbook

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2432	powershell.exe
2940	powershell.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2580 set thread context of 2856	2580	3xi73dos6I7cy7Z.exe	38
PID 2856 set thread context of 1196	2856	RegSvcs.exe	21
PID 2744 set thread context of 1196	2744	NETSTAT.EXE	21

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3xi73dos6I7cy7Z.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NETSTAT.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2744	NETSTAT.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2828	schtasks.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
2580	3xi73dos6I7cy7Z.exe
2432	powershell.exe
2940	powershell.exe
2580	3xi73dos6I7cy7Z.exe
2580	3xi73dos6I7cy7Z.exe
2580	3xi73dos6I7cy7Z.exe
2856	RegSvcs.exe
2856	RegSvcs.exe
2744	NETSTAT.EXE
2744	NETSTAT.EXE
2744	NETSTAT.EXE
2744	NETSTAT.EXE
2744	NETSTAT.EXE
2744	NETSTAT.EXE
2744	NETSTAT.EXE
2744	NETSTAT.EXE
2744	NETSTAT.EXE
2744	NETSTAT.EXE
2744	NETSTAT.EXE
2744	NETSTAT.EXE
2744	NETSTAT.EXE
2744	NETSTAT.EXE
2744	NETSTAT.EXE
2744	NETSTAT.EXE
2744	NETSTAT.EXE
2744	NETSTAT.EXE
2744	NETSTAT.EXE
2744	NETSTAT.EXE
2744	NETSTAT.EXE
2744	NETSTAT.EXE
2744	NETSTAT.EXE
2744	NETSTAT.EXE
2744	NETSTAT.EXE
2744	NETSTAT.EXE

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
2856	RegSvcs.exe
2856	RegSvcs.exe
2856	RegSvcs.exe
2744	NETSTAT.EXE
2744	NETSTAT.EXE

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2580	3xi73dos6I7cy7Z.exe
Token: SeDebugPrivilege	2432	powershell.exe
Token: SeDebugPrivilege	2940	powershell.exe
Token: SeDebugPrivilege	2856	RegSvcs.exe
Token: SeDebugPrivilege	2744	NETSTAT.EXE

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 2432	2580	3xi73dos6I7cy7Z.exe	31
PID 2580 wrote to memory of 2432	2580	3xi73dos6I7cy7Z.exe	31
PID 2580 wrote to memory of 2432	2580	3xi73dos6I7cy7Z.exe	31
PID 2580 wrote to memory of 2432	2580	3xi73dos6I7cy7Z.exe	31
PID 2580 wrote to memory of 2940	2580	3xi73dos6I7cy7Z.exe	33
PID 2580 wrote to memory of 2940	2580	3xi73dos6I7cy7Z.exe	33
PID 2580 wrote to memory of 2940	2580	3xi73dos6I7cy7Z.exe	33
PID 2580 wrote to memory of 2940	2580	3xi73dos6I7cy7Z.exe	33
PID 2580 wrote to memory of 2828	2580	3xi73dos6I7cy7Z.exe	35
PID 2580 wrote to memory of 2828	2580	3xi73dos6I7cy7Z.exe	35
PID 2580 wrote to memory of 2828	2580	3xi73dos6I7cy7Z.exe	35
PID 2580 wrote to memory of 2828	2580	3xi73dos6I7cy7Z.exe	35
PID 2580 wrote to memory of 2848	2580	3xi73dos6I7cy7Z.exe	37
PID 2580 wrote to memory of 2848	2580	3xi73dos6I7cy7Z.exe	37
PID 2580 wrote to memory of 2848	2580	3xi73dos6I7cy7Z.exe	37
PID 2580 wrote to memory of 2848	2580	3xi73dos6I7cy7Z.exe	37
PID 2580 wrote to memory of 2848	2580	3xi73dos6I7cy7Z.exe	37
PID 2580 wrote to memory of 2848	2580	3xi73dos6I7cy7Z.exe	37
PID 2580 wrote to memory of 2848	2580	3xi73dos6I7cy7Z.exe	37
PID 2580 wrote to memory of 2856	2580	3xi73dos6I7cy7Z.exe	38
PID 2580 wrote to memory of 2856	2580	3xi73dos6I7cy7Z.exe	38
PID 2580 wrote to memory of 2856	2580	3xi73dos6I7cy7Z.exe	38
PID 2580 wrote to memory of 2856	2580	3xi73dos6I7cy7Z.exe	38
PID 2580 wrote to memory of 2856	2580	3xi73dos6I7cy7Z.exe	38
PID 2580 wrote to memory of 2856	2580	3xi73dos6I7cy7Z.exe	38
PID 2580 wrote to memory of 2856	2580	3xi73dos6I7cy7Z.exe	38
PID 2580 wrote to memory of 2856	2580	3xi73dos6I7cy7Z.exe	38
PID 2580 wrote to memory of 2856	2580	3xi73dos6I7cy7Z.exe	38
PID 2580 wrote to memory of 2856	2580	3xi73dos6I7cy7Z.exe	38
PID 1196 wrote to memory of 2744	1196	Explorer.EXE	39
PID 1196 wrote to memory of 2744	1196	Explorer.EXE	39
PID 1196 wrote to memory of 2744	1196	Explorer.EXE	39
PID 1196 wrote to memory of 2744	1196	Explorer.EXE	39
PID 2744 wrote to memory of 1504	2744	NETSTAT.EXE	40
PID 2744 wrote to memory of 1504	2744	NETSTAT.EXE	40
PID 2744 wrote to memory of 1504	2744	NETSTAT.EXE	40
PID 2744 wrote to memory of 1504	2744	NETSTAT.EXE	40

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Users\Admin\AppData\Local\Temp\3xi73dos6I7cy7Z.exe
  "C:\Users\Admin\AppData\Local\Temp\3xi73dos6I7cy7Z.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2580
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\3xi73dos6I7cy7Z.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2432
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\HrquyzWzCqiOaf.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2940
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HrquyzWzCqiOaf" /XML "C:\Users\Admin\AppData\Local\Temp\tmp55E.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2828
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    PID:2848
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:2856
- C:\Windows\SysWOW64\NETSTAT.EXE
  "C:\Windows\SysWOW64\NETSTAT.EXE"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Gathers network information
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2744
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp55E.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp55E.tmp
Size 1KB
SHA256 8af7c42dc278c950dd6f95e2e52133ab7c8b48b4a3eb9aa5ddef12ffaafcbf18
MD5 4ae6176cddc97158bafa99fc9669effa
SHA1 dc761bf84de795b502fa6a7bea6343611e2535d1
SHA512 b56548bb698e014cb024cf6c2aaa9f74cd99304e6dc16ca886d2a878d16256b131c178269ccc63493b4865dca8435bddf8cbbaa658a2f15fd8616f787077da4e
MD5 SHA1 SHA512

Submit Download

d93f411851d7c929.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Size 7KB
SHA256 cc968753d06d14aa96e391a61a16e38a2e3218d76527f3dea822e07f737a803d
MD5 101cca56a44393022929a85d681a8653
SHA1 78dda1f1bbd361f828ac5c3b974c132ca930f8e3
SHA512 450a3e9e720ab24a40a971cdb60199ce2a6b83352845030b1162190cce5a7289900a796cb320a0742b422184a33946096089ce15281126e3311dadba2dd46d5a
SSDEEP 96:0leCV3M81nqvsqvJCwoQleCV3M81nqvsEHyqvJCworWF+TQHXd7WTXlUVD:4XZUosXZAHnorWYGd7WTc
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1196-27-0x0000000004FC0000-0x00000000050C0000-memory.dmp

Download

memory/2580-4-0x000000007469E000-0x000000007469F000-memory.dmp

Download

memory/2580-25-0x0000000074690000-0x0000000074D7E000-memory.dmp

Download

memory/2580-5-0x0000000074690000-0x0000000074D7E000-memory.dmp

Download

memory/2580-6-0x0000000004EC0000-0x0000000004F38000-memory.dmp

Download

memory/2580-3-0x0000000000C10000-0x0000000000C28000-memory.dmp

Download

memory/2580-2-0x0000000074690000-0x0000000074D7E000-memory.dmp

Download

memory/2580-1-0x0000000000C30000-0x0000000000CDC000-memory.dmp

Download

memory/2580-0-0x000000007469E000-0x000000007469F000-memory.dmp

Download

memory/2744-28-0x0000000000F60000-0x0000000000F69000-memory.dmp

Download

memory/2744-29-0x00000000000E0000-0x000000000010F000-memory.dmp

Download

memory/2856-21-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2856-19-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2856-23-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2856-24-0x0000000000400000-0x000000000042F000-memory.dmp

Download