formbook | 404f88f8e5d2270cbab30c8e9de8d30aa8054939580a6ef40f41df59cc1f90a8

Analysis

max time kernel
148s
max time network
109s
platform
windows7_x64
resource
win7v200722
submitted
17/08/2020, 19:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
August P_O.exe
Size 531KB
Sample200817-ml6vbqrbd6
SHA256 404f88f8e5d2270cbab30c8e9de8d30aa8054939580a6ef40f41df59cc1f90a8
MD5 bb077b3a30320f1a9c60060bd5c21dc9
SHA1 f4517ae4aacd8730d4991936b7201fe72e82401b
SHA512 01da87ca4c04e328eeb787f42bad2a6be4ff0a55dab28d77c0703d1f6ca33ab540104be7f16a07b989430e5bb883d1da3d2b117916e27e9c27da603f438bc98c
MD5 SHA1 SHA512

Score

10^/10

rat trojan spyware stealer formbook

Malware Config

Extracted

Family

formbook

http://www.ranges-xx.com/g82/

Decoy

hqeknj.men
keboku.com
westofbroadway.net
trustbetween.com
alpa-dachbeschichtung.com
korea-kone.com
akira-fukui.com
bikehire.net
stabilizedliquidoxyen.com
thepigeonpea.com
myilene.life
classroomclosets.com
albergodellasalute.com
propiedadesok.com
gannettinsights.com
marie-rae.com
essentalgems.com
appicot.com
lupinpaints.com
jizhehua.com
skjev.info
hashimotoshota.com
greenworlduganda.com
kmcfadyen.com
alexander-property.com
myroofrepairleads.com
bencaoye.com
byqld.com
xn--hg3b21bu5coyh9wnhnb.com
1l5sevenmoney.men
mir2.ink
hjehzsebcrrd.site
equifaxsecurity2-017.com
monyet-office.com
clicemploi.com
xshe.ltd
revsquarellc.com
reoffi.com
tedarikistanbul.com
dreamownernation.com
hnobor.com
bostonlubricant.com
bither.tech
attentiontoexcellence.info
akterzi.com
dwalornodeal.com
westvirginiarailplan.com
pinnaclecontractorsllc.net
so-geht-es.com
acerruti.com
kadment.top
updsglobal.com
yanahijab.com
065858567.com
hbatp.info
boreclothing.com
brickaccounts.com
chaussuresalomon.com
3v-concept-bh.com
studiomachetti.com
cricplatoon.com
danielsdresses.com
orlistat-buycheapest.com
335manbet.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 4 IoCs

rat

resource	yara_rule
behavioral1/memory/1184-6-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/1184-6-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/1184-7-0x000000000041ED50-mapping.dmp	formbook
behavioral1/memory/672-8-0x0000000000000000-mapping.dmp	formbook

Deletes itself 1 IoCs

pid	Process
1660	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1764 set thread context of 1184	1764	August P_O.exe	28
PID 1184 set thread context of 1240	1184	August P_O.exe	20
PID 672 set thread context of 1240	672	help.exe	20

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
1764	August P_O.exe
1764	August P_O.exe
1764	August P_O.exe
1764	August P_O.exe
1764	August P_O.exe
1764	August P_O.exe
1764	August P_O.exe
1184	August P_O.exe
1184	August P_O.exe
672	help.exe
672	help.exe
672	help.exe
672	help.exe
672	help.exe
672	help.exe
672	help.exe
672	help.exe
672	help.exe
672	help.exe
672	help.exe
672	help.exe
672	help.exe
672	help.exe
672	help.exe
672	help.exe
672	help.exe
672	help.exe
672	help.exe
672	help.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
1184	August P_O.exe
1184	August P_O.exe
1184	August P_O.exe
672	help.exe
672	help.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1764	August P_O.exe
Token: SeDebugPrivilege	1184	August P_O.exe
Token: SeDebugPrivilege	672	help.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 836	1764	August P_O.exe	26
PID 1764 wrote to memory of 836	1764	August P_O.exe	26
PID 1764 wrote to memory of 836	1764	August P_O.exe	26
PID 1764 wrote to memory of 836	1764	August P_O.exe	26
PID 1764 wrote to memory of 1280	1764	August P_O.exe	27
PID 1764 wrote to memory of 1280	1764	August P_O.exe	27
PID 1764 wrote to memory of 1280	1764	August P_O.exe	27
PID 1764 wrote to memory of 1280	1764	August P_O.exe	27
PID 1764 wrote to memory of 1184	1764	August P_O.exe	28
PID 1764 wrote to memory of 1184	1764	August P_O.exe	28
PID 1764 wrote to memory of 1184	1764	August P_O.exe	28
PID 1764 wrote to memory of 1184	1764	August P_O.exe	28
PID 1764 wrote to memory of 1184	1764	August P_O.exe	28
PID 1764 wrote to memory of 1184	1764	August P_O.exe	28
PID 1764 wrote to memory of 1184	1764	August P_O.exe	28
PID 1240 wrote to memory of 672	1240	Explorer.EXE	57
PID 1240 wrote to memory of 672	1240	Explorer.EXE	57
PID 1240 wrote to memory of 672	1240	Explorer.EXE	57
PID 1240 wrote to memory of 672	1240	Explorer.EXE	57
PID 672 wrote to memory of 1660	672	help.exe	58
PID 672 wrote to memory of 1660	672	help.exe	58
PID 672 wrote to memory of 1660	672	help.exe	58
PID 672 wrote to memory of 1660	672	help.exe	58

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Users\Admin\AppData\Local\Temp\August P_O.exe
  "C:\Users\Admin\AppData\Local\Temp\August P_O.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1764
- - C:\Users\Admin\AppData\Local\Temp\August P_O.exe
    "{path}"
    3⤵
    PID:836
- - C:\Users\Admin\AppData\Local\Temp\August P_O.exe
    "{path}"
    3⤵
    PID:1280
- - C:\Users\Admin\AppData\Local\Temp\August P_O.exe
    "{path}"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:1184
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:1840
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:1948
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:1756
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:1664
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:832
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:1592
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:1584
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:1608
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:1644
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:1656
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:1700
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:1588
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:1560
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:1632
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:1612
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:1520
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:1428
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:1320
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:1204
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:904
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:772
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:912
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:1624
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:360
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:764
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:112
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:768
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:580
- C:\Windows\SysWOW64\help.exe
  "C:\Windows\SysWOW64\help.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:672
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\August P_O.exe"
    3⤵
    - Deletes itself
    PID:1660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/672-9-0x0000000000790000-0x0000000000796000-memory.dmp

Download

memory/672-11-0x0000000003050000-0x00000000031AD000-memory.dmp

Download

memory/1184-6-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1764-0-0x00000000742C0000-0x00000000749AE000-memory.dmp

Download

memory/1764-1-0x0000000000290000-0x0000000000291000-memory.dmp

Download

memory/1764-3-0x00000000003E0000-0x00000000003E4000-memory.dmp

Download

memory/1764-4-0x0000000004EC0000-0x0000000004F0B000-memory.dmp

Download

memory/1764-5-0x0000000004120000-0x000000000414F000-memory.dmp

Download