formbook | 2858bfcb9388b05049df45459ee60bf96be0b0d75a3be34cf3c00f57ec9f4469

General

Target

PT300975-inv.exe
Size

546KB
MD5

025544a9014cf1667e8a1d4ff68da253
SHA1

0123853e7960cdae4f3ad95945b4ec86adbb93c6
SHA256

2858bfcb9388b05049df45459ee60bf96be0b0d75a3be34cf3c00f57ec9f4469
SHA512

a22db404c3a154339b3cd6d4a4227f319f6cb99d103346856ffd6fd249fe08bace4f528f185edc25c0672ae03b2e14c87b31b0b2d0728372c5893821b5a43068

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.registeredagentfirm.com/jqc/

Decoy

strahlenschutz.digital

soterppe.com

wlw-hnlt.com

topheadlinetowitness-today.info

droriginals.com

baculatechie.online

definity.finance

weddingmustgoon.com

ludisenofloral.com

kenniscourtureconsignments.com

dl888.net

singledynamics.com

internetmarkaching.com

solidconstruct.site

ip-freight.com

11sxsx.com

incomecontent.com

the343radio.com

kimberlygoedhart.net

dgdoughnuts.net

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 1340 created 3860 1340 WerFault.exe mscorsvw.exe

description	pid	process	target process
PID 1340 created 3860	1340	WerFault.exe	mscorsvw.exe

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3860-11-0x000000000041EB50-mapping.dmp	formbook
behavioral2/memory/3860-12-0x0000000000280000-0x00000000002AE000-memory.dmp	formbook
behavioral2/memory/3860-15-0x000000000041EB50-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

PT300975-inv.exe

description pid process target process

PID 3160 set thread context of 3860 3160 PT300975-inv.exe mscorsvw.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1340 3860 WerFault.exe mscorsvw.exe

description	pid	process	target process
PID 3160 set thread context of 3860	3160	PT300975-inv.exe	mscorsvw.exe

pid	pid_target	process	target process
1340	3860	WerFault.exe	mscorsvw.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
1340	WerFault.exe
1340	WerFault.exe
1340	WerFault.exe
1340	WerFault.exe
1340	WerFault.exe
1340	WerFault.exe
1340	WerFault.exe
1340	WerFault.exe
1340	WerFault.exe
1340	WerFault.exe
1340	WerFault.exe
1340	WerFault.exe
1340	WerFault.exe
1340	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

PT300975-inv.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	3160	PT300975-inv.exe
Token: SeRestorePrivilege	1340	WerFault.exe
Token: SeBackupPrivilege	1340	WerFault.exe
Token: SeDebugPrivilege	1340	WerFault.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

PT300975-inv.exe

description	pid	process	target process
PID 3160 wrote to memory of 3860	3160	PT300975-inv.exe	mscorsvw.exe
PID 3160 wrote to memory of 3860	3160	PT300975-inv.exe	mscorsvw.exe
PID 3160 wrote to memory of 3860	3160	PT300975-inv.exe	mscorsvw.exe
PID 3160 wrote to memory of 3860	3160	PT300975-inv.exe	mscorsvw.exe
PID 3160 wrote to memory of 3860	3160	PT300975-inv.exe	mscorsvw.exe
PID 3160 wrote to memory of 3860	3160	PT300975-inv.exe	mscorsvw.exe

C:\Users\Admin\AppData\Local\Temp\PT300975-inv.exe
"C:\Users\Admin\AppData\Local\Temp\PT300975-inv.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3160

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe"
2⤵
PID:3860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3860 -s 176
3⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1340

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1340-13-0x0000000004940000-0x0000000004941000-memory.dmp

Filesize
4KB

Download
memory/1340-16-0x0000000005030000-0x0000000005031000-memory.dmp

Filesize
4KB

Download
memory/1340-14-0x0000000004D40000-0x0000000004D41000-memory.dmp

Filesize
4KB

Download
memory/3160-7-0x0000000007780000-0x0000000007781000-memory.dmp

Filesize
4KB

Download
memory/3160-5-0x0000000002900000-0x000000000291F000-memory.dmp

Filesize
124KB

Download
memory/3160-6-0x0000000007B90000-0x0000000007B91000-memory.dmp

Filesize
4KB

Download
memory/3160-0-0x00000000733D0000-0x0000000073ABE000-memory.dmp

Filesize
6.9MB

Download
memory/3160-8-0x0000000007760000-0x000000000776A000-memory.dmp

Filesize
40KB

Download
memory/3160-9-0x0000000007990000-0x0000000007991000-memory.dmp

Filesize
4KB

Download
memory/3160-4-0x0000000002840000-0x0000000002857000-memory.dmp

Filesize
92KB

Download
memory/3160-3-0x0000000004ED0000-0x0000000004ED1000-memory.dmp

Filesize
4KB

Download
memory/3160-1-0x00000000005E0000-0x00000000005E1000-memory.dmp

Filesize
4KB

Download
memory/3860-11-0x000000000041EB50-mapping.dmp

Download
memory/3860-12-0x0000000000280000-0x00000000002AE000-memory.dmp

Filesize
184KB

Download
memory/3860-15-0x000000000041EB50-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads