formbook | ad660d774f78137622d038976557c8782211dbfd39d2ff9a7a4bcc9279ba0f41

General

Target
7ae4cb8f9396def9bf87b1cc7206016f.exe
Size 1.0MB
Sample200901-clyd4423t2
SHA256 ad660d774f78137622d038976557c8782211dbfd39d2ff9a7a4bcc9279ba0f41
MD5 7ae4cb8f9396def9bf87b1cc7206016f
SHA1 2bda31a6472ab84800c8a7fb158e4ddbe2b4a5ad
SHA512 5556bb8956310761ba1519403d19891239daa5ebf2e92bf5d63f75e050e2537b7aefb8dd3a069709435b9ccc269e76428b2bdf26f5f2d7a1b804add7eeb6b060
MD5 SHA1 SHA512

Score

10^/10

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/2400-1-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral2/memory/2400-1-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral2/memory/2400-2-0x000000000041EB40-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3956 set thread context of 2400	3956	7ae4cb8f9396def9bf87b1cc7206016f.exe	72

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat	svchost.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1"	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = 6e9303a22c80d601	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0"	svchost.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3956	7ae4cb8f9396def9bf87b1cc7206016f.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1936	svchost.exe
Token: SeCreatePagefilePrivilege	1936	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3956 wrote to memory of 2400	3956	7ae4cb8f9396def9bf87b1cc7206016f.exe	72
PID 3956 wrote to memory of 2400	3956	7ae4cb8f9396def9bf87b1cc7206016f.exe	72
PID 3956 wrote to memory of 2400	3956	7ae4cb8f9396def9bf87b1cc7206016f.exe	72

C:\Users\Admin\AppData\Local\Temp\7ae4cb8f9396def9bf87b1cc7206016f.exe
"C:\Users\Admin\AppData\Local\Temp\7ae4cb8f9396def9bf87b1cc7206016f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3956
- C:\Users\Admin\AppData\Local\Temp\7ae4cb8f9396def9bf87b1cc7206016f.exe
  "C:\Users\Admin\AppData\Local\Temp\7ae4cb8f9396def9bf87b1cc7206016f.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2400

memory/2400-1-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/3956-0-0x0000000000400000-0x0000000000509000-memory.dmp

Download