formbook | a76869f6ece56a889175cb2cebdb60e4a24025184ebeb7fa9c6210668eb023fe

Analysis

Target
ASQ2109942.exe
Size 365KB
Sample201016-dc2txmvhes
SHA256 a76869f6ece56a889175cb2cebdb60e4a24025184ebeb7fa9c6210668eb023fe
MD5 693849c501a595f56ca33ce5ca0ef2a2
SHA1 90b1a338a8d98b95bcb61c786c27833a79ded566
SHA512 ee956882b02b80b8775c5cf990cd020a7bc381e652b46fb2a1892ac0d7c548af77451394662d20cdda5e67bb2742c5db82401d178b87c6ea2f80b08ef616bdee
MD5 SHA1 SHA512

Score

10^/10

Family

Decoy

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/1620-0-0x0000000000400000-0x0000000000428000-memory.dmp	formbook
behavioral2/memory/1620-1-0x000000000041C9D0-mapping.dmp	formbook
behavioral2/memory/1876-4-0x0000000000000000-mapping.dmp	formbook

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3868 set thread context of 1620	3868	ASQ2109942.exe	77
PID 1620 set thread context of 2988	1620	ASQ2109942.exe	56
PID 1876 set thread context of 2988	1876	cmmon32.exe	56

Suspicious behavior: EnumeratesProcesses 58 IoCs

Suspicious behavior: MapViewOfSection 6 IoCs

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	1620	ASQ2109942.exe
Token: SeDebugPrivilege	1876	cmmon32.exe
Token: SeShutdownPrivilege	2988	Explorer.EXE
Token: SeCreatePagefilePrivilege	2988	Explorer.EXE
Token: SeShutdownPrivilege	2988	Explorer.EXE
Token: SeCreatePagefilePrivilege	2988	Explorer.EXE
Token: SeShutdownPrivilege	2988	Explorer.EXE
Token: SeCreatePagefilePrivilege	2988	Explorer.EXE

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3868 wrote to memory of 1620	3868	ASQ2109942.exe	77
PID 3868 wrote to memory of 1620	3868	ASQ2109942.exe	77
PID 3868 wrote to memory of 1620	3868	ASQ2109942.exe	77
PID 3868 wrote to memory of 1620	3868	ASQ2109942.exe	77
PID 2988 wrote to memory of 1876	2988	Explorer.EXE	78
PID 2988 wrote to memory of 1876	2988	Explorer.EXE	78
PID 2988 wrote to memory of 1876	2988	Explorer.EXE	78
PID 1876 wrote to memory of 1576	1876	cmmon32.exe	79
PID 1876 wrote to memory of 1576	1876	cmmon32.exe	79
PID 1876 wrote to memory of 1576	1876	cmmon32.exe	79

memory/1620-0-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/1876-5-0x0000000000B40000-0x0000000000B4C000-memory.dmp

Download

memory/1876-6-0x0000000000B40000-0x0000000000B4C000-memory.dmp

Download

memory/1876-8-0x00000000057B0000-0x00000000058D1000-memory.dmp

Download