formbook | 88ae2d739cf1bb2cb87e55498b46f53cc6c641ede1cf5619af8d0a128a1a2a39

Analysis

max time kernel
149s
max time network
10s
platform
windows7_x64
resource
win7v20201028
submitted
04/11/2020, 11:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
noah crypt(1).exe
Size 703KB
Sample201104-cf41tmc94x
SHA256 88ae2d739cf1bb2cb87e55498b46f53cc6c641ede1cf5619af8d0a128a1a2a39
MD5 1785158f20ac4437f58b257f34a3a5b3
SHA1 4552ad8e9225d14042c85c2336e4664003736dc5
SHA512 a697bea653015b007b5ecd11a06870be1e75a5b141cab708e3e8472dd530c751155d23393c7c355aef678c951fc238802b1d44fc1cd47e49c31762eba4f1a4b0
MD5 SHA1 SHA512

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

http://www.impactheroes.agency/bns/

Decoy

americontractors.com
zzpf110.com
erictrueman.com
rajinination.com
dpmystar.com
0769dhl.com
solopergrazia.com
ciocolombia.com
the-djay.com
tradingforexmastery.com
myselfkare.com
crossfitgrapheneatl.com
hindigkquestion.com
zaidaburtoarte.com
rashiarora17.website
2999online.com
cyphergrey.com
kaioit.com
mazzarothcl.com
1000t.online
trxmef.info
delaparraconsultingroup.com
acryliccrates.com
atlaslabsis.xyz
applywithbroch.com
phoenixhypnotic.com
mynormaklen.com
garage-repair-near-me.com
joshuamusick.com
sandiegorealestate.report
tataxian.com
generalelectionstrike.com
balloonsouthbend.com
t-delivery.com
smxlyhq.com
cheap-housekeeping.com
lavisheventsanddecor.website
westorlandocbd.com
timeshare-free.com
bitcoinsix.com
dawnrayspharmacy.com
nationwidecleaning.net
pgictd.com
peanutcustomcreations.com
quickpayboards.com
luzshoesr.online
centigrampay.com
seospecialised.com
twenty1atoms.com
lojanatufit.com
buxs.xyz
priceelasticityofsupply.com
3528385.com
51zao.net
blackmarlinbroadband.com
rare-vn.xyz
pk435.com
estate-in-russia.club
hoopersbbqinc.com
bellasebastianhair.com
fedosia.net
kanbsvtsrkfrtk.com
gangstargames.com
dhlpost.online

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/1272-0-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/1272-1-0x000000000041EB80-mapping.dmp	formbook
behavioral1/memory/400-3-0x0000000000000000-mapping.dmp	formbook

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1588 set thread context of 1272	1588	noah crypt(1).exe	31
PID 1272 set thread context of 1276	1272	RegSvcs.exe	21
PID 1272 set thread context of 1276	1272	RegSvcs.exe	21
PID 400 set thread context of 1276	400	cmstp.exe	21

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
1588	noah crypt(1).exe
1588	noah crypt(1).exe
1588	noah crypt(1).exe
1588	noah crypt(1).exe
1588	noah crypt(1).exe
1272	RegSvcs.exe
1272	RegSvcs.exe
1272	RegSvcs.exe
400	cmstp.exe
400	cmstp.exe
400	cmstp.exe
400	cmstp.exe
400	cmstp.exe
400	cmstp.exe
400	cmstp.exe
400	cmstp.exe
400	cmstp.exe
400	cmstp.exe
400	cmstp.exe
400	cmstp.exe
400	cmstp.exe
400	cmstp.exe
400	cmstp.exe
400	cmstp.exe
400	cmstp.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
1272	RegSvcs.exe
1272	RegSvcs.exe
1272	RegSvcs.exe
1272	RegSvcs.exe
400	cmstp.exe
400	cmstp.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1588	noah crypt(1).exe
Token: SeDebugPrivilege	1272	RegSvcs.exe
Token: SeDebugPrivilege	400	cmstp.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 1296	1588	noah crypt(1).exe	29
PID 1588 wrote to memory of 1296	1588	noah crypt(1).exe	29
PID 1588 wrote to memory of 1296	1588	noah crypt(1).exe	29
PID 1588 wrote to memory of 1296	1588	noah crypt(1).exe	29
PID 1588 wrote to memory of 1296	1588	noah crypt(1).exe	29
PID 1588 wrote to memory of 1296	1588	noah crypt(1).exe	29
PID 1588 wrote to memory of 1296	1588	noah crypt(1).exe	29
PID 1588 wrote to memory of 888	1588	noah crypt(1).exe	30
PID 1588 wrote to memory of 888	1588	noah crypt(1).exe	30
PID 1588 wrote to memory of 888	1588	noah crypt(1).exe	30
PID 1588 wrote to memory of 888	1588	noah crypt(1).exe	30
PID 1588 wrote to memory of 888	1588	noah crypt(1).exe	30
PID 1588 wrote to memory of 888	1588	noah crypt(1).exe	30
PID 1588 wrote to memory of 888	1588	noah crypt(1).exe	30
PID 1588 wrote to memory of 1272	1588	noah crypt(1).exe	31
PID 1588 wrote to memory of 1272	1588	noah crypt(1).exe	31
PID 1588 wrote to memory of 1272	1588	noah crypt(1).exe	31
PID 1588 wrote to memory of 1272	1588	noah crypt(1).exe	31
PID 1588 wrote to memory of 1272	1588	noah crypt(1).exe	31
PID 1588 wrote to memory of 1272	1588	noah crypt(1).exe	31
PID 1588 wrote to memory of 1272	1588	noah crypt(1).exe	31
PID 1588 wrote to memory of 1272	1588	noah crypt(1).exe	31
PID 1588 wrote to memory of 1272	1588	noah crypt(1).exe	31
PID 1588 wrote to memory of 1272	1588	noah crypt(1).exe	31
PID 1276 wrote to memory of 400	1276	Explorer.EXE	32
PID 1276 wrote to memory of 400	1276	Explorer.EXE	32
PID 1276 wrote to memory of 400	1276	Explorer.EXE	32
PID 1276 wrote to memory of 400	1276	Explorer.EXE	32
PID 1276 wrote to memory of 400	1276	Explorer.EXE	32
PID 1276 wrote to memory of 400	1276	Explorer.EXE	32
PID 1276 wrote to memory of 400	1276	Explorer.EXE	32
PID 400 wrote to memory of 972	400	cmstp.exe	33
PID 400 wrote to memory of 972	400	cmstp.exe	33
PID 400 wrote to memory of 972	400	cmstp.exe	33
PID 400 wrote to memory of 972	400	cmstp.exe	33

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Users\Admin\AppData\Local\Temp\noah crypt(1).exe
  "C:\Users\Admin\AppData\Local\Temp\noah crypt(1).exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1588
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
    3⤵
    PID:1296
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
    3⤵
    PID:888
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:1272
- C:\Windows\SysWOW64\cmstp.exe
  "C:\Windows\SysWOW64\cmstp.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:400
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
    3⤵
    PID:972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/400-4-0x0000000000080000-0x0000000000098000-memory.dmp

Download

memory/400-6-0x0000000003000000-0x0000000003160000-memory.dmp

Download

memory/1272-0-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1276-2-0x0000000004F10000-0x0000000004FE2000-memory.dmp

Download