formbook | 2858bfcb9388b05049df45459ee60bf96be0b0d75a3be34cf3c00f57ec9f4469

General

Target

PT300975-inv.exe
Size

546KB
MD5

025544a9014cf1667e8a1d4ff68da253
SHA1

0123853e7960cdae4f3ad95945b4ec86adbb93c6
SHA256

2858bfcb9388b05049df45459ee60bf96be0b0d75a3be34cf3c00f57ec9f4469
SHA512

a22db404c3a154339b3cd6d4a4227f319f6cb99d103346856ffd6fd249fe08bace4f528f185edc25c0672ae03b2e14c87b31b0b2d0728372c5893821b5a43068

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.registeredagentfirm.com/jqc/

Decoy

strahlenschutz.digital

soterppe.com

wlw-hnlt.com

topheadlinetowitness-today.info

droriginals.com

baculatechie.online

definity.finance

weddingmustgoon.com

ludisenofloral.com

kenniscourtureconsignments.com

dl888.net

singledynamics.com

internetmarkaching.com

solidconstruct.site

ip-freight.com

11sxsx.com

incomecontent.com

the343radio.com

kimberlygoedhart.net

dgdoughnuts.net

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/316-6-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/316-7-0x000000000041EB50-mapping.dmp	formbook
behavioral1/memory/332-8-0x0000000000000000-mapping.dmp	formbook

Suspicious use of SetThreadContext 3 IoCs

Processes:

PT300975-inv.exemscorsvw.exerundll32.exe

description	pid	process	target process
PID 744 set thread context of 316	744	PT300975-inv.exe	mscorsvw.exe
PID 316 set thread context of 1256	316	mscorsvw.exe	Explorer.EXE
PID 332 set thread context of 1256	332	rundll32.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 24 IoCs

Processes:

mscorsvw.exerundll32.exe

pid	process
316	mscorsvw.exe
316	mscorsvw.exe
332	rundll32.exe
332	rundll32.exe
332	rundll32.exe
332	rundll32.exe
332	rundll32.exe
332	rundll32.exe
332	rundll32.exe
332	rundll32.exe
332	rundll32.exe
332	rundll32.exe
332	rundll32.exe
332	rundll32.exe
332	rundll32.exe
332	rundll32.exe
332	rundll32.exe
332	rundll32.exe
332	rundll32.exe
332	rundll32.exe
332	rundll32.exe
332	rundll32.exe
332	rundll32.exe
332	rundll32.exe

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

mscorsvw.exerundll32.exe

pid process

316 mscorsvw.exe
316 mscorsvw.exe
316 mscorsvw.exe
332 rundll32.exe
332 rundll32.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

PT300975-inv.exemscorsvw.exerundll32.exe

description pid process

Token: SeDebugPrivilege 744 PT300975-inv.exe
Token: SeDebugPrivilege 316 mscorsvw.exe
Token: SeDebugPrivilege 332 rundll32.exe
Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

Explorer.EXE

pid process

1256 Explorer.EXE
1256 Explorer.EXE
1256 Explorer.EXE
1256 Explorer.EXE
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

Explorer.EXE

pid process

1256 Explorer.EXE
1256 Explorer.EXE
1256 Explorer.EXE
1256 Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	744	PT300975-inv.exe
Token: SeDebugPrivilege	316	mscorsvw.exe
Token: SeDebugPrivilege	332	rundll32.exe

pid	process
1256	Explorer.EXE
1256	Explorer.EXE
1256	Explorer.EXE
1256	Explorer.EXE

pid	process
1256	Explorer.EXE
1256	Explorer.EXE
1256	Explorer.EXE
1256	Explorer.EXE

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

PT300975-inv.exeExplorer.EXErundll32.exe

description	pid	process	target process
PID 744 wrote to memory of 316	744	PT300975-inv.exe	mscorsvw.exe
PID 744 wrote to memory of 316	744	PT300975-inv.exe	mscorsvw.exe
PID 744 wrote to memory of 316	744	PT300975-inv.exe	mscorsvw.exe
PID 744 wrote to memory of 316	744	PT300975-inv.exe	mscorsvw.exe
PID 744 wrote to memory of 316	744	PT300975-inv.exe	mscorsvw.exe
PID 744 wrote to memory of 316	744	PT300975-inv.exe	mscorsvw.exe
PID 744 wrote to memory of 316	744	PT300975-inv.exe	mscorsvw.exe
PID 1256 wrote to memory of 332	1256	Explorer.EXE	rundll32.exe
PID 1256 wrote to memory of 332	1256	Explorer.EXE	rundll32.exe
PID 1256 wrote to memory of 332	1256	Explorer.EXE	rundll32.exe
PID 1256 wrote to memory of 332	1256	Explorer.EXE	rundll32.exe
PID 1256 wrote to memory of 332	1256	Explorer.EXE	rundll32.exe
PID 1256 wrote to memory of 332	1256	Explorer.EXE	rundll32.exe
PID 1256 wrote to memory of 332	1256	Explorer.EXE	rundll32.exe
PID 332 wrote to memory of 756	332	rundll32.exe	cmd.exe
PID 332 wrote to memory of 756	332	rundll32.exe	cmd.exe
PID 332 wrote to memory of 756	332	rundll32.exe	cmd.exe
PID 332 wrote to memory of 756	332	rundll32.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1256

C:\Users\Admin\AppData\Local\Temp\PT300975-inv.exe
"C:\Users\Admin\AppData\Local\Temp\PT300975-inv.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:744

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:316

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\SysWOW64\rundll32.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:332

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe"
3⤵
PID:756

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/316-6-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/316-7-0x000000000041EB50-mapping.dmp

Download
memory/332-8-0x0000000000000000-mapping.dmp

Download
memory/332-9-0x0000000000D60000-0x0000000000D6E000-memory.dmp

Filesize
56KB

Download
memory/332-11-0x0000000000C20000-0x0000000000D08000-memory.dmp

Filesize
928KB

Download
memory/744-0-0x0000000074CC0000-0x00000000753AE000-memory.dmp

Filesize
6.9MB

Download
memory/744-1-0x0000000000FB0000-0x0000000000FB1000-memory.dmp

Filesize
4KB

Download
memory/744-3-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/744-4-0x0000000000420000-0x000000000043F000-memory.dmp

Filesize
124KB

Download
memory/744-5-0x0000000000450000-0x000000000045A000-memory.dmp

Filesize
40KB

Download
memory/756-10-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads