formbook | 2047ecb45a1bd7dad219077cd5446bffc34fdc7acad3d3293c576fc187b08996

General

Target
Urgent Order.exe
Size 571KB
Sample201109-cbxc6rcbgn
SHA256 2047ecb45a1bd7dad219077cd5446bffc34fdc7acad3d3293c576fc187b08996
MD5 a53efdaa04913ffc49daf42d4a4545ff
SHA1 70df6989db00fa3dc0102d8cc537b348a139cb40
SHA512 629695aab44338267b35e3e3d8a11ba66e8a64500119f396dfd1c8b86477cc383b328b083e8c97ce22fb8e9ceeb5d4063b03679bac2f40c40fb7821abd439007
MD5 SHA1 SHA512

Score

10^/10

formbook rat rezer0 spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.sandrxy.com/t8c/

Decoy

kasra-shafieezadeh.com
geekhubworld.com
alevokotel.com
sayagantengok.com
mlearningapp.com
lseisraeltechtrip.com
goolge-img.com
lyjnys.com
choavealvlcidreyevfolk.win
buy-me-now.online
mercadologodelfuturo.com
hotelgreenvalleyjaipur.com
gujianworld.com
kitaherbal.com
bonemarrow.news
veronikagabrielova.com
xjwfgg.net
memoryid.info
aa9088.com
footballpredictionstomorrow.com
checkmyfreightbroker.com
jnlcollegekhagaul.com
affinityhealthservice.com
eligius-translations.com
wiredwithwords.com
beveragewaters.com
souqnajran.com
managementsolutioneast.com
cyberprotecioncorp.com
yoecha.com
smartfinancebroker.com
andyismylawyer.com
agtfinstitute.com
ggg666tube.com
icoifo.com
theraggedyhouse.com
plushcurvlyinc.com
plateauuno.com
sellericentrllse-amazon.com
electrico.company
columbusmotorcycles.com
mypitchbook.com
furgoimport.com
diswallet.com
airmaxtnfr.com
mumlearningfootball.com
topopal.com
familyenterprisecouncil.info
passeurdeau.com
outdoormistfan.com
kech24h.com
sinotrian.com
mdklx.com
youmo001.com
changetransformevolve.com
gastrodelivalencia.com
ciftlikkentsitesi.com
lixtech.net
jenniferalonsophotograghy.com
mobile-quality-night.com
flowsarve.com
vemarinenj.com
mikearchive.com
passekey.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/1224-6-0x0000000000400000-0x000000000042D000-memory.dmp	formbook
behavioral1/memory/1224-7-0x000000000041E370-mapping.dmp	formbook
behavioral1/memory/1684-9-0x0000000000000000-mapping.dmp	formbook

rezer0 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

resource	yara_rule
behavioral1/memory/932-5-0x0000000004CF0000-0x0000000004D24000-memory.dmp	rezer0

Deletes itself 1 IoCs

pid	Process
996	cmd.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 932 set thread context of 1224	932	Urgent Order.exe	30
PID 1224 set thread context of 1276	1224	Urgent Order.exe	21
PID 1224 set thread context of 1276	1224	Urgent Order.exe	21
PID 1684 set thread context of 1276	1684	msiexec.exe	21

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
932	Urgent Order.exe
932	Urgent Order.exe
1224	Urgent Order.exe
1224	Urgent Order.exe
1224	Urgent Order.exe
1684	msiexec.exe
1684	msiexec.exe
1684	msiexec.exe
1684	msiexec.exe
1684	msiexec.exe
1684	msiexec.exe
1684	msiexec.exe
1684	msiexec.exe
1684	msiexec.exe
1684	msiexec.exe
1684	msiexec.exe
1684	msiexec.exe
1684	msiexec.exe
1684	msiexec.exe
1684	msiexec.exe
1684	msiexec.exe
1684	msiexec.exe
1684	msiexec.exe
1684	msiexec.exe
1684	msiexec.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
1224	Urgent Order.exe
1224	Urgent Order.exe
1224	Urgent Order.exe
1224	Urgent Order.exe
1684	msiexec.exe
1684	msiexec.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	932	Urgent Order.exe
Token: SeDebugPrivilege	1224	Urgent Order.exe
Token: SeDebugPrivilege	1684	msiexec.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 932 wrote to memory of 1344	932	Urgent Order.exe	29
PID 932 wrote to memory of 1344	932	Urgent Order.exe	29
PID 932 wrote to memory of 1344	932	Urgent Order.exe	29
PID 932 wrote to memory of 1344	932	Urgent Order.exe	29
PID 932 wrote to memory of 1224	932	Urgent Order.exe	30
PID 932 wrote to memory of 1224	932	Urgent Order.exe	30
PID 932 wrote to memory of 1224	932	Urgent Order.exe	30
PID 932 wrote to memory of 1224	932	Urgent Order.exe	30
PID 932 wrote to memory of 1224	932	Urgent Order.exe	30
PID 932 wrote to memory of 1224	932	Urgent Order.exe	30
PID 932 wrote to memory of 1224	932	Urgent Order.exe	30
PID 1224 wrote to memory of 1684	1224	Urgent Order.exe	32
PID 1224 wrote to memory of 1684	1224	Urgent Order.exe	32
PID 1224 wrote to memory of 1684	1224	Urgent Order.exe	32
PID 1224 wrote to memory of 1684	1224	Urgent Order.exe	32
PID 1224 wrote to memory of 1684	1224	Urgent Order.exe	32
PID 1224 wrote to memory of 1684	1224	Urgent Order.exe	32
PID 1224 wrote to memory of 1684	1224	Urgent Order.exe	32
PID 1684 wrote to memory of 996	1684	msiexec.exe	33
PID 1684 wrote to memory of 996	1684	msiexec.exe	33
PID 1684 wrote to memory of 996	1684	msiexec.exe	33
PID 1684 wrote to memory of 996	1684	msiexec.exe	33

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1276
- C:\Users\Admin\AppData\Local\Temp\Urgent Order.exe
  "C:\Users\Admin\AppData\Local\Temp\Urgent Order.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:932
- - C:\Users\Admin\AppData\Local\Temp\Urgent Order.exe
    "{path}"
    3⤵
    PID:1344
- - C:\Users\Admin\AppData\Local\Temp\Urgent Order.exe
    "{path}"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1224
  - - C:\Windows\SysWOW64\autochk.exe
      "C:\Windows\SysWOW64\autochk.exe"
      4⤵
      PID:276
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\SysWOW64\msiexec.exe"
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1684
    - - C:\Windows\SysWOW64\cmd.exe
        
        /c del "C:\Users\Admin\AppData\Local\Temp\Urgent Order.exe"
        5⤵
        Deletes itself
        
        PID:996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/932-0-0x0000000074120000-0x000000007480E000-memory.dmp

Download

memory/932-1-0x00000000012D0000-0x00000000012D1000-memory.dmp

Download

memory/932-3-0x0000000000BB0000-0x0000000000C34000-memory.dmp

Download

memory/932-4-0x00000000003A0000-0x00000000003A2000-memory.dmp

Download

memory/932-5-0x0000000004CF0000-0x0000000004D24000-memory.dmp

Download

memory/1224-6-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1276-8-0x0000000006B40000-0x0000000006C71000-memory.dmp

Download

memory/1684-10-0x0000000000470000-0x0000000000484000-memory.dmp

Download

memory/1684-12-0x00000000031A0000-0x00000000032B4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads