formbook | ed3318102d772c4dcecfb1e10f37cfd3fdcbaff1d340ba9c2bc5dcfe6383f339

General

Target
e9401ef816354b65fc208d692fa8b94c.exe
Size 607KB
Sample201109-dackmqmwsx
SHA256 ed3318102d772c4dcecfb1e10f37cfd3fdcbaff1d340ba9c2bc5dcfe6383f339
MD5 e9401ef816354b65fc208d692fa8b94c
SHA1 291996028f7df646794aef71199200c4d72aa6bc
SHA512 21802ab6d6809c91bb431c72d02eec9a9b7c49f34543d49bdc3bd3d5cb2c8cab0daedfcb02c9b6de3cee3e34e411a596255362e9edcdd2407c0bee8ea0619762
MD5 SHA1 SHA512

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.mansiobok2.info/mnf3/

Decoy

tech-d.info
ultra-dance.net
csssecurity.net
alanmoralesloyola.com
aqualityfilters.com
rustylimbs.com
ziyi119.com
appliedpsu.com
chocolatespeakeasy.com
workoutfashionwear.com
integrityrockstars.com
patryanotsegodistrict5.com
desertshieldpainting.com
cnqr-global-master.com
gestoriainigo.com
bigdatacd.com
eterna-med.com
mysundaymornings.com
xn--289aw8k.com
handykrafty.com
eastcoastwesterners.com
azmyhealth.com
henryfitch.info
fm776.com
racinglinks.net
51866699.com
becstorage.com
coolestresistancebands.com
cars-4hire.com
thenorthwestbar.com
syxjsn.com
paintogain.life
insightsforchurch.com
unboxingalloftheboxes.com
passportglory.com
lavazza-firma.store
zhongqijiqi.com
jemployee.com
eejbb.info
jigwoc.info
goodkarmamke.com
kg-siding.com
jessurgo.com
groolgirls.com
dluznik.online
kismigration.com
xn--ydso18l.com
cabocostumes.com
uniroomer.com
mazzandfinn.com
cdn-network24-server5.biz
kancelariaradom.com
crodstudios.com
houseofcigarette.biz
nearmob.com
thatcolinmurphy.com
51taopos.com
treva.science
migrainefixnow.rocks
topfoundationrepairhouston.com
letsdindin.com
hochschulmarketing.online
greentherapyfl.info
auntdianecookies.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/1744-7-0x0000000000400000-0x000000000042A000-memory.dmp	formbook
behavioral1/memory/1744-8-0x000000000041B700-mapping.dmp	formbook
behavioral1/memory/572-9-0x0000000000000000-mapping.dmp	formbook

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 536 set thread context of 1744	536	e9401ef816354b65fc208d692fa8b94c.exe	29
PID 1744 set thread context of 1328	1744	mscorsvw.exe	21
PID 572 set thread context of 1328	572	cmd.exe	21

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
536	e9401ef816354b65fc208d692fa8b94c.exe
536	e9401ef816354b65fc208d692fa8b94c.exe
536	e9401ef816354b65fc208d692fa8b94c.exe
1744	mscorsvw.exe
1744	mscorsvw.exe
572	cmd.exe
572	cmd.exe
572	cmd.exe
572	cmd.exe
572	cmd.exe
572	cmd.exe
572	cmd.exe
572	cmd.exe
572	cmd.exe
572	cmd.exe
572	cmd.exe
572	cmd.exe
572	cmd.exe
572	cmd.exe
572	cmd.exe
572	cmd.exe
572	cmd.exe
572	cmd.exe
572	cmd.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
1744	mscorsvw.exe
1744	mscorsvw.exe
1744	mscorsvw.exe
572	cmd.exe
572	cmd.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	536	e9401ef816354b65fc208d692fa8b94c.exe
Token: SeDebugPrivilege	1744	mscorsvw.exe
Token: SeDebugPrivilege	572	cmd.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1328	Explorer.EXE
1328	Explorer.EXE
1328	Explorer.EXE
1328	Explorer.EXE

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1328	Explorer.EXE
1328	Explorer.EXE
1328	Explorer.EXE
1328	Explorer.EXE

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 1744	536	e9401ef816354b65fc208d692fa8b94c.exe	29
PID 536 wrote to memory of 1744	536	e9401ef816354b65fc208d692fa8b94c.exe	29
PID 536 wrote to memory of 1744	536	e9401ef816354b65fc208d692fa8b94c.exe	29
PID 536 wrote to memory of 1744	536	e9401ef816354b65fc208d692fa8b94c.exe	29
PID 536 wrote to memory of 1744	536	e9401ef816354b65fc208d692fa8b94c.exe	29
PID 536 wrote to memory of 1744	536	e9401ef816354b65fc208d692fa8b94c.exe	29
PID 536 wrote to memory of 1744	536	e9401ef816354b65fc208d692fa8b94c.exe	29
PID 1328 wrote to memory of 572	1328	Explorer.EXE	30
PID 1328 wrote to memory of 572	1328	Explorer.EXE	30
PID 1328 wrote to memory of 572	1328	Explorer.EXE	30
PID 1328 wrote to memory of 572	1328	Explorer.EXE	30
PID 572 wrote to memory of 1016	572	cmd.exe	31
PID 572 wrote to memory of 1016	572	cmd.exe	31
PID 572 wrote to memory of 1016	572	cmd.exe	31
PID 572 wrote to memory of 1016	572	cmd.exe	31

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1328
- C:\Users\Admin\AppData\Local\Temp\e9401ef816354b65fc208d692fa8b94c.exe
  "C:\Users\Admin\AppData\Local\Temp\e9401ef816354b65fc208d692fa8b94c.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:536
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:1744
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\SysWOW64\cmd.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:572
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe"
    3⤵
    PID:1016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/536-0-0x0000000074360000-0x0000000074A4E000-memory.dmp

Download

memory/536-1-0x0000000000070000-0x0000000000071000-memory.dmp

Download

memory/536-3-0x00000000002C0000-0x00000000002D0000-memory.dmp

Download

memory/536-4-0x0000000000590000-0x0000000000593000-memory.dmp

Download

memory/536-5-0x00000000006B0000-0x00000000006B2000-memory.dmp

Download

memory/536-6-0x00000000006C0000-0x00000000006C5000-memory.dmp

Download

memory/572-10-0x0000000049E00000-0x0000000049E4C000-memory.dmp

Download

memory/572-12-0x00000000030C0000-0x00000000031FC000-memory.dmp

Download

memory/1744-7-0x0000000000400000-0x000000000042A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads