formbook | f89ea3eb5f2720e6194642d92ef8de19d90dcb0cf12c64bc42dd9aba0edfeb85

General

Target
Quotation.exe
Size 501KB
Sample201019-kwavy43ynx
SHA256 f89ea3eb5f2720e6194642d92ef8de19d90dcb0cf12c64bc42dd9aba0edfeb85
MD5 28b16a7e4ee7f2b7035273f0f47d6030
SHA1 9ad18f3f9170ae0207d232135efdac5f3c89dba5
SHA512 08e6539a74a87697b1e472d3a95a629e9c664763bba06d10ec1b49d170ba69bcc014554cc0a1a8196f810c0aacb68764fa70ad5148533a0a84e15058e584cedc
MD5 SHA1 SHA512

Score

10^/10

rat trojan spyware stealer formbook

Malware Config

Extracted

Family

formbook

C2

http://www.xqxsm.com/mc5/

Decoy

bettermol.com
ludocrew.com
seidoknives.com
risunohonya.com
kaorukinoshita.com
filmblingalley.com
whenitclick.com
pathwaymediation.net
veracruzdigital.net
phoenixluxuries.com
3dyazicibaski.net
recorsaqu.com
mwilifirewire.online
dicobeuchert.com
vr036.com
ugenpt.com
mysecurityassessment.com
seolahmrekakorban04.com
outlierlearningcycle.com
dgwszjnmh.icu
dubreuil-automobiles.com
daddythreads.com
dogslee.com
hollywoodbodysculpting.com
youtaopu.com
greenovenindia.com
tecnicoit.net
magnaskincareclinic.com
adsuitex.com
katiescleaning.club
jubbibeauty.com
emarkyter.com
affordableroof.net
michaelmaas7777.com
adelaidecabling.site
marketplaceveterinary.com
northviewwindow.com
carnivorebio.com
yaldeiyisroel.net
cleanketogenics.com
konstorex.com
metaldeploy.com
bargaindropper.com
youcancallmekev.online
camelbacktownhouse.com
unpluggedpartners.com
glamoodz.com
idaasuka.com
naxt756.online
howtattoos.com
ricardoinman.com
kadinbilgim.com
nolafluids.com
workbrighter.media
dl521f.com
atreusinteriors.com
yorkshirevampirefacelift.com
theywhoarenotthere.com
deathvalleywind.com
tutoretc.com
gabrielmoraoficial.com
xn--knsntrt-5wa0yu6j.com
bobdj22.com
blockchainacademie.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

resource	yara_rule
behavioral1/memory/1932-9-0x000000000041ED10-mapping.dmp	formbook
behavioral1/memory/1940-11-0x0000000000000000-mapping.dmp	formbook

Executes dropped EXE 1 IoCs

pid	Process
1932	AddInProcess32.exe

Loads dropped DLL 3 IoCs

pid	Process
824	Quotation.exe
824	Quotation.exe
824	Quotation.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 824 set thread context of 1932	824	Quotation.exe	28
PID 1932 set thread context of 1200	1932	AddInProcess32.exe	20
PID 1940 set thread context of 1200	1940	cmmon32.exe	20

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
824	Quotation.exe
1932	AddInProcess32.exe
1932	AddInProcess32.exe
1940	cmmon32.exe
1940	cmmon32.exe
1940	cmmon32.exe
1940	cmmon32.exe
1940	cmmon32.exe
1940	cmmon32.exe
1940	cmmon32.exe
1940	cmmon32.exe
1940	cmmon32.exe
1940	cmmon32.exe
1940	cmmon32.exe
1940	cmmon32.exe
1940	cmmon32.exe
1940	cmmon32.exe
1940	cmmon32.exe
1940	cmmon32.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
1932	AddInProcess32.exe
1932	AddInProcess32.exe
1932	AddInProcess32.exe
1940	cmmon32.exe
1940	cmmon32.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	824	Quotation.exe
Token: SeDebugPrivilege	1932	AddInProcess32.exe
Token: SeDebugPrivilege	1940	cmmon32.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 824 wrote to memory of 1932	824	Quotation.exe	28
PID 824 wrote to memory of 1932	824	Quotation.exe	28
PID 824 wrote to memory of 1932	824	Quotation.exe	28
PID 824 wrote to memory of 1932	824	Quotation.exe	28
PID 824 wrote to memory of 1932	824	Quotation.exe	28
PID 824 wrote to memory of 1932	824	Quotation.exe	28
PID 824 wrote to memory of 1932	824	Quotation.exe	28
PID 1200 wrote to memory of 1940	1200	Explorer.EXE	31
PID 1200 wrote to memory of 1940	1200	Explorer.EXE	31
PID 1200 wrote to memory of 1940	1200	Explorer.EXE	31
PID 1200 wrote to memory of 1940	1200	Explorer.EXE	31
PID 1940 wrote to memory of 676	1940	cmmon32.exe	32
PID 1940 wrote to memory of 676	1940	cmmon32.exe	32
PID 1940 wrote to memory of 676	1940	cmmon32.exe	32
PID 1940 wrote to memory of 676	1940	cmmon32.exe	32

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Users\Admin\AppData\Local\Temp\Quotation.exe
  "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:824
- - C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe
    "C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:1932
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:1964
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:1972
- C:\Windows\SysWOW64\cmmon32.exe
  "C:\Windows\SysWOW64\cmmon32.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"
    3⤵
    PID:676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/824-5-0x0000000001F00000-0x0000000001F16000-memory.dmp

Download

memory/824-0-0x0000000074230000-0x000000007491E000-memory.dmp

Download

memory/824-3-0x00000000002B0000-0x00000000002E6000-memory.dmp

Download

memory/824-1-0x00000000001B0000-0x00000000001B1000-memory.dmp

Download

memory/1940-12-0x0000000000630000-0x000000000063D000-memory.dmp

Download

memory/1940-15-0x0000000002090000-0x000000000213D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads