formbook | ebb20ece00b9d35c26bb797dbbbd6df726473e198a53095cb232dc8042c18d7e

General

Target
Scan_03062020.exe
Size 568KB
Sample201109-2av2fxr356
SHA256 ebb20ece00b9d35c26bb797dbbbd6df726473e198a53095cb232dc8042c18d7e
MD5 a2d6ec11cb9f5d84ec286e04ffe53e9d
SHA1 c1b71a77289261258d63964f1f6c661229cee80c
SHA512 a4deb7bc658d767d257e52f6e157b2b21c544b26ac41b9d31d91f895cace9452f5fd8d9a1d3d10f7d1441d3f6d79bea63439dce4c3052e24704baa082a840735
MD5 SHA1 SHA512

Score

10^/10

formbook rat rezer0 spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.porcber.com/mq3/

Decoy

clarksonassistivetech.com
sjzam6.com
designermarken-outlet.online
kampoengkurma.online
shamsmaltdrinks.com
d7r4u1.info
sportsboulder.com
snagabag31.com
am0rsexkreto.com
sj233.com
estaladores.online
icbjesusdenazaret.net
bobi-frs.net
steminvr.com
yoxi.ltd
aaronnational.com
charliezangelzagency.com
rolex218238.com
snacksejuice.com
educationgrants.site
powerciser.com
endemikhardwoods.com
runcessories.com
cock-or-ball.com
thehuyertrnes.com
consultaprobidad.info
changancloud.com
therryvanvreden.com
latableovale.com
springholdingsbnk.com
hugoph.com
sarealodinge.com
searchmakeup.com
eddiefigure.win
r-ev-ival.com
essentialassetstraining.net
yolandekouznetsov.com
lianxiaoshu.com
3dcellmodelscongress.com
xn--3bst11cpvj0o2a.com
enginardergisi.com
tams.rocks
askcopdtreatmentok.live
bncosmetics.com
greenerpharms.com
lettersfromsanta.email
spartanpronos.com
wwwx36599.com
julqe.com
dannyhustle.com
evevon.com
copycatfunnels.com
tzacg.com
eckgjx.men
izzymetics.com
uzhackteam.com
islandlifeaccounting.com
hnbxm.com
missyunita.com
scriptfail006.win
blackgirlgenius.com
herzfeldandrubin.com
operatorcloud.net
cielarkodesign.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/1908-5-0x0000000000400000-0x000000000042D000-memory.dmp	formbook
behavioral1/memory/1908-6-0x000000000041E310-mapping.dmp	formbook
behavioral1/memory/476-7-0x0000000000000000-mapping.dmp	formbook

rezer0 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

resource	yara_rule
behavioral1/memory/1068-4-0x0000000000640000-0x0000000000674000-memory.dmp	rezer0

Deletes itself 1 IoCs

pid	Process
268	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1068 set thread context of 1908	1068	Scan_03062020.exe	29
PID 1908 set thread context of 1252	1908	Scan_03062020.exe	21
PID 476 set thread context of 1252	476	cmd.exe	21

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
1068	Scan_03062020.exe
1068	Scan_03062020.exe
1908	Scan_03062020.exe
1908	Scan_03062020.exe
476	cmd.exe
476	cmd.exe
476	cmd.exe
476	cmd.exe
476	cmd.exe
476	cmd.exe
476	cmd.exe
476	cmd.exe
476	cmd.exe
476	cmd.exe
476	cmd.exe
476	cmd.exe
476	cmd.exe
476	cmd.exe
476	cmd.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
1908	Scan_03062020.exe
1908	Scan_03062020.exe
1908	Scan_03062020.exe
476	cmd.exe
476	cmd.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1068	Scan_03062020.exe
Token: SeDebugPrivilege	1908	Scan_03062020.exe
Token: SeDebugPrivilege	476	cmd.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 1908	1068	Scan_03062020.exe	29
PID 1068 wrote to memory of 1908	1068	Scan_03062020.exe	29
PID 1068 wrote to memory of 1908	1068	Scan_03062020.exe	29
PID 1068 wrote to memory of 1908	1068	Scan_03062020.exe	29
PID 1068 wrote to memory of 1908	1068	Scan_03062020.exe	29
PID 1068 wrote to memory of 1908	1068	Scan_03062020.exe	29
PID 1068 wrote to memory of 1908	1068	Scan_03062020.exe	29
PID 1252 wrote to memory of 476	1252	Explorer.EXE	30
PID 1252 wrote to memory of 476	1252	Explorer.EXE	30
PID 1252 wrote to memory of 476	1252	Explorer.EXE	30
PID 1252 wrote to memory of 476	1252	Explorer.EXE	30
PID 476 wrote to memory of 268	476	cmd.exe	31
PID 476 wrote to memory of 268	476	cmd.exe	31
PID 476 wrote to memory of 268	476	cmd.exe	31
PID 476 wrote to memory of 268	476	cmd.exe	31

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Users\Admin\AppData\Local\Temp\Scan_03062020.exe
  "C:\Users\Admin\AppData\Local\Temp\Scan_03062020.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1068
- - C:\Users\Admin\AppData\Local\Temp\Scan_03062020.exe
    "{path}"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:1908
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\SysWOW64\cmd.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:476
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\Scan_03062020.exe"
    3⤵
    - Deletes itself
    PID:268

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/476-8-0x000000004A890000-0x000000004A8DC000-memory.dmp

Download

memory/476-10-0x0000000003190000-0x0000000003266000-memory.dmp

Download

memory/1068-0-0x0000000074EE0000-0x00000000755CE000-memory.dmp

Download

memory/1068-1-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

Download

memory/1068-3-0x0000000000290000-0x0000000000292000-memory.dmp

Download

memory/1068-4-0x0000000000640000-0x0000000000674000-memory.dmp

Download

memory/1908-5-0x0000000000400000-0x000000000042D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads