formbook | ae9e7502a23c5e541559ffb7e28af15e4e9eccabd451f5c916d86496968a0eec

General

Target
rPaymentsInvoicePO110228.exe
Size 1.2MB
Sample251124-e4519sak8z
SHA256 ae9e7502a23c5e541559ffb7e28af15e4e9eccabd451f5c916d86496968a0eec
MD5 2865fbd7ba369ea9682733a672b25951
SHA1 4ff001ffbb400069207030627e513d1b8cff8b34
SHA512 d0ddcb979decae58cffebb256511b4d69781c100ffe6ac08ab3011f297758b0287c9d527da907c46ccb5baf215917e7091baabd3bbd229fc560dc8669d376c43
SSDEEP 24576:G5EmXFtKaL4/oFe5T9yyXYfP1ijXday3xR0/RnsRsW4f:GPVt/LZeJbInQRayBR0/RnG
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery formbook rat spyware stealer trojan

Malware Config

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Formbook family
formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/716-33-0x0000000000400000-0x0000000000448000-memory.dmp	family_formbook

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wainable.vbs	wainable.exe

Executes dropped EXE 1 IoCs

pid	Process
2620	wainable.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x001900000002b3c6-13.dat	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2620 set thread context of 716	2620	wainable.exe	79

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5308	2620	WerFault.exe	78

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rPaymentsInvoicePO110228.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wainable.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
716	svchost.exe
716	svchost.exe
716	svchost.exe
716	svchost.exe
716	svchost.exe
716	svchost.exe
716	svchost.exe
716	svchost.exe
716	svchost.exe
716	svchost.exe
716	svchost.exe
716	svchost.exe
716	svchost.exe
716	svchost.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2620	wainable.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
5388	rPaymentsInvoicePO110228.exe
5388	rPaymentsInvoicePO110228.exe
2620	wainable.exe
2620	wainable.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
5388	rPaymentsInvoicePO110228.exe
5388	rPaymentsInvoicePO110228.exe
2620	wainable.exe
2620	wainable.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5388 wrote to memory of 2620	5388	rPaymentsInvoicePO110228.exe	78
PID 5388 wrote to memory of 2620	5388	rPaymentsInvoicePO110228.exe	78
PID 5388 wrote to memory of 2620	5388	rPaymentsInvoicePO110228.exe	78
PID 2620 wrote to memory of 716	2620	wainable.exe	79
PID 2620 wrote to memory of 716	2620	wainable.exe	79
PID 2620 wrote to memory of 716	2620	wainable.exe	79
PID 2620 wrote to memory of 716	2620	wainable.exe	79

C:\Users\Admin\AppData\Local\Temp\rPaymentsInvoicePO110228.exe
"C:\Users\Admin\AppData\Local\Temp\rPaymentsInvoicePO110228.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5388
- C:\Users\Admin\AppData\Local\unnervously\wainable.exe
  "C:\Users\Admin\AppData\Local\Temp\rPaymentsInvoicePO110228.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Windows\SysWOW64\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\rPaymentsInvoicePO110228.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:716
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 748
    3⤵
    - Program crash
    PID:5308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2620 -ip 2620
1⤵
PID:1652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aut8434.tmp

Path C:\Users\Admin\AppData\Local\Temp\aut8434.tmp
Size 288KB
SHA256 773e943e976fe015e999c95495b374c821e09fdce3c69d1a69b1477066e875d6
MD5 2f3847970be3e46fa7e53e9aef33a9ec
SHA1 4444d441c58c371eb42b17cbd4231043ec325b9a
SHA512 5d29e4b132cf01f3f6a3eaa049b2cc0a9ded4a44273a6be6b6247fb28e9156e7ee18a5a04c0cb872e3387c73031823e612c6c48f3ed71517f70ad8734feab5d9
SSDEEP 6144:wgD3KxjxjVYuiDi+v6o00/hrHPtL3kFt47tmu3lWXZY8oy0:wgD3ujpVY9ao0OvRkFhvJBM
MD5 SHA1 SHA512 SSDEEP

Submit Download

croc

Path C:\Users\Admin\AppData\Local\Temp\croc
Size 28KB
SHA256 93f681d9f34dab9b9102bf8a8fc961c11fb0a5a8b6d12b060f196a070e628a89
MD5 039ed5a2871883a48c136c4388e87ac5
SHA1 91617928fa401f1da2aea9674ae3d0bcce04576d
SHA512 fda2d20f036ab38d7ce90c5274123e2ee82f55638a2d85fd8c87b20c29c8bca409b15c47d32e668b70a72a85d6b13f5653931fd19316d76aeebc333951443552
SSDEEP 192:aIU0YzxURqp0mXY+15jeDE49yry+a9ydK7esTl/zbUzl9LD1LXVBvbcENwwZUU1d:rYzxrp0fwaIoMLXDXGpPdqEXaU50d
MD5 SHA1 SHA512 SSDEEP

Submit Download

wainable.exe

Path C:\Users\Admin\AppData\Local\unnervously\wainable.exe
Size 1.2MB
SHA256 ae9e7502a23c5e541559ffb7e28af15e4e9eccabd451f5c916d86496968a0eec
MD5 2865fbd7ba369ea9682733a672b25951
SHA1 4ff001ffbb400069207030627e513d1b8cff8b34
SHA512 d0ddcb979decae58cffebb256511b4d69781c100ffe6ac08ab3011f297758b0287c9d527da907c46ccb5baf215917e7091baabd3bbd229fc560dc8669d376c43
SSDEEP 24576:G5EmXFtKaL4/oFe5T9yyXYfP1ijXday3xR0/RnsRsW4f:GPVt/LZeJbInQRayBR0/RnG
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/716-30-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/716-31-0x0000000001C00000-0x0000000001F56000-memory.dmp

Download

memory/716-32-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/716-33-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/5388-11-0x0000000002410000-0x0000000002414000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads