formbook | 201e2fd48dfdd75ee8abf1ad910deb3ffa1784ae0229fe7588b2b54119409aee

General

Target
po.no.4414463099.exe
Size 623KB
Sample201016-ndezhb4pxj
SHA256 201e2fd48dfdd75ee8abf1ad910deb3ffa1784ae0229fe7588b2b54119409aee
MD5 628b560274bb0807824cb9b06a8d669a
SHA1 887600f411d15a4e53b69b0c857057cb918ab284
SHA512 cc52210772ef7c5389bd785b5f66493d0c54945161780d20a17d483022b117da9191d1b94cc293e7434c7d877eff52252c0e750008978194b00a2ec4e899e2c3
MD5 SHA1 SHA512

Score

10^/10

rat trojan spyware stealer formbook

Malware Config

Extracted

Family

formbook

C2

http://www.jsbdistributor.com/u2e/

Decoy

aartihand.com
texasreloaded.com
2794moraga.com
mybcinfo.com
wriz.xyz
headlundco.com
officialangelanichelle.com
danielledelaine.com
ateliermalibu.com
vantaimanhtruong.com
zhimazhiyun.com
saimeeraservices.com
baisongke.com
catearhelmet.com
palasian.net
merchantofzanzibar.com
ateliercrepin.com
guardtactics.com
ceritadata.com
nacesiti.com
pinacle.online
sosgov.com
batchjoy.com
arosevirtualassistant.com
xn--razfashion-l8a.com
worstcasebestcase.com
lemengkj.com
rekill.space
kumpanews.com
6936399.com
theselfunknown.com
jenniferlwilsonrn.com
thefeesimple.com
my500now1.club
goflexcolors.com
moneysavingexpertmonarch.xyz
notaria8colima.com
mtourlo.com
pomp.coffee
colettesimonepsyd.com
videocoachforbusiness.com
samograd.online
sustainableminimalistyoga.com
charactermovement.net
ahyqmux.icu
severbroke.com
impresos25.com
detroitswingcompany.com
onehealthtaskforce.com
adesignmuseum.net
roguesummers.net
stephaniebauer.net
kommodore.online
daveadonai.com
a-great-homegym.fyi
duwegawe.com
bukannyaterbuai34.com
murphyconstructiongunnison.com
peacelovez.com
saleselgaucho.com
ahrmj.com
quickprepandship.com
t4pacademy.com
themarketingrecipes.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/1628-6-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/1628-7-0x000000000041ED00-mapping.dmp	formbook
behavioral1/memory/1936-8-0x0000000000000000-mapping.dmp	formbook

Deletes itself 1 IoCs

pid	Process
2036	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1460 set thread context of 1628	1460	po.no.4414463099.exe	28
PID 1628 set thread context of 1244	1628	po.no.4414463099.exe	20
PID 1936 set thread context of 1244	1936	wlanext.exe	20

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1628	po.no.4414463099.exe
1628	po.no.4414463099.exe
1936	wlanext.exe
1936	wlanext.exe
1936	wlanext.exe
1936	wlanext.exe
1936	wlanext.exe
1936	wlanext.exe
1936	wlanext.exe
1936	wlanext.exe
1936	wlanext.exe
1936	wlanext.exe
1936	wlanext.exe
1936	wlanext.exe
1936	wlanext.exe
1936	wlanext.exe
1936	wlanext.exe
1936	wlanext.exe
1936	wlanext.exe
1936	wlanext.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
1628	po.no.4414463099.exe
1628	po.no.4414463099.exe
1628	po.no.4414463099.exe
1936	wlanext.exe
1936	wlanext.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1628	po.no.4414463099.exe
Token: SeDebugPrivilege	1936	wlanext.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1244	Explorer.EXE
1244	Explorer.EXE
1244	Explorer.EXE
1244	Explorer.EXE

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1244	Explorer.EXE
1244	Explorer.EXE
1244	Explorer.EXE
1244	Explorer.EXE

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 1628	1460	po.no.4414463099.exe	28
PID 1460 wrote to memory of 1628	1460	po.no.4414463099.exe	28
PID 1460 wrote to memory of 1628	1460	po.no.4414463099.exe	28
PID 1460 wrote to memory of 1628	1460	po.no.4414463099.exe	28
PID 1460 wrote to memory of 1628	1460	po.no.4414463099.exe	28
PID 1460 wrote to memory of 1628	1460	po.no.4414463099.exe	28
PID 1460 wrote to memory of 1628	1460	po.no.4414463099.exe	28
PID 1244 wrote to memory of 1936	1244	Explorer.EXE	29
PID 1244 wrote to memory of 1936	1244	Explorer.EXE	29
PID 1244 wrote to memory of 1936	1244	Explorer.EXE	29
PID 1244 wrote to memory of 1936	1244	Explorer.EXE	29
PID 1936 wrote to memory of 2036	1936	wlanext.exe	30
PID 1936 wrote to memory of 2036	1936	wlanext.exe	30
PID 1936 wrote to memory of 2036	1936	wlanext.exe	30
PID 1936 wrote to memory of 2036	1936	wlanext.exe	30

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Users\Admin\AppData\Local\Temp\po.no.4414463099.exe
  "C:\Users\Admin\AppData\Local\Temp\po.no.4414463099.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1460
- - C:\Users\Admin\AppData\Local\Temp\po.no.4414463099.exe
    "C:\Users\Admin\AppData\Local\Temp\po.no.4414463099.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:1628
- C:\Windows\SysWOW64\wlanext.exe
  "C:\Windows\SysWOW64\wlanext.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1936
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\po.no.4414463099.exe"
    3⤵
    - Deletes itself
    PID:2036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1460-0-0x00000000738C0000-0x0000000073FAE000-memory.dmp

Download

memory/1460-1-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

Download

memory/1460-3-0x0000000000220000-0x000000000022B000-memory.dmp

Download

memory/1460-4-0x00000000055E0000-0x0000000005645000-memory.dmp

Download

memory/1460-5-0x0000000000570000-0x00000000005A0000-memory.dmp

Download

memory/1628-6-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1936-9-0x00000000002F0000-0x0000000000306000-memory.dmp

Download

memory/1936-11-0x0000000003090000-0x0000000003141000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads