formbook | 41e1b66a7d9ba85d2edb67eb3adf1ba8dd251ded73925d82f98bfdda5b34511b

General

Target

41e1b66a7d9ba85d2edb67eb3adf1ba8dd251ded73925d82f98bfdda5b34511b.exe
Size

300KB
MD5

fd8cd7d2e66f83b52c4a5f23e8eb5c40
SHA1

ba16c9148e6ee8e70962eb60d629a28902befe74
SHA256

41e1b66a7d9ba85d2edb67eb3adf1ba8dd251ded73925d82f98bfdda5b34511b
SHA512

6ef5c4aa2b9cdc80089ab8f188e9744aa65c27dd539bb1c2c55e89b24e9f17d29c8b4fad803ac444ce3300aa547fc93c8aa42155a038ebc64caeb84f1a0f4b14

Score

10^/10

formbook rat rezer0 spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.joomlas123.com/m92q/

Decoy

marychrisantonettenina.com

orozcosantillanabogados.com

nikeairmax-shop.com

sugarride.com

bobevanseggs.com

everyremedy.com

taascoin.com

curve-arch.com

seowebdirectory.biz

airplanes.international

hrzwum.info

sjqaf.com

mjhcommunications.com

kobigrinberg.com

hhh573.com

elite-titleagency.com

onitsukasally.info

onosouvenir.com

tianyezhushu.com

taizhoutongyuan.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1660-8-0x000000000041E320-mapping.dmp	formbook
behavioral1/memory/1660-7-0x0000000000400000-0x000000000042D000-memory.dmp	formbook

rezer0 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

Processes:

resource	yara_rule
behavioral1/memory/1836-6-0x00000000005B0000-0x00000000005E4000-memory.dmp	rezer0

Suspicious use of SetThreadContext 1 IoCs

Processes:

41e1b66a7d9ba85d2edb67eb3adf1ba8dd251ded73925d82f98bfdda5b34511b.exe

description	pid	process	target process
PID 1836 set thread context of 1660	1836	41e1b66a7d9ba85d2edb67eb3adf1ba8dd251ded73925d82f98bfdda5b34511b.exe	41e1b66a7d9ba85d2edb67eb3adf1ba8dd251ded73925d82f98bfdda5b34511b.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

41e1b66a7d9ba85d2edb67eb3adf1ba8dd251ded73925d82f98bfdda5b34511b.exe

pid process

1660 41e1b66a7d9ba85d2edb67eb3adf1ba8dd251ded73925d82f98bfdda5b34511b.exe

pid	process
1660	41e1b66a7d9ba85d2edb67eb3adf1ba8dd251ded73925d82f98bfdda5b34511b.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

41e1b66a7d9ba85d2edb67eb3adf1ba8dd251ded73925d82f98bfdda5b34511b.exe

description	pid	process	target process
PID 1836 wrote to memory of 1660	1836	41e1b66a7d9ba85d2edb67eb3adf1ba8dd251ded73925d82f98bfdda5b34511b.exe	41e1b66a7d9ba85d2edb67eb3adf1ba8dd251ded73925d82f98bfdda5b34511b.exe
PID 1836 wrote to memory of 1660	1836	41e1b66a7d9ba85d2edb67eb3adf1ba8dd251ded73925d82f98bfdda5b34511b.exe	41e1b66a7d9ba85d2edb67eb3adf1ba8dd251ded73925d82f98bfdda5b34511b.exe
PID 1836 wrote to memory of 1660	1836	41e1b66a7d9ba85d2edb67eb3adf1ba8dd251ded73925d82f98bfdda5b34511b.exe	41e1b66a7d9ba85d2edb67eb3adf1ba8dd251ded73925d82f98bfdda5b34511b.exe
PID 1836 wrote to memory of 1660	1836	41e1b66a7d9ba85d2edb67eb3adf1ba8dd251ded73925d82f98bfdda5b34511b.exe	41e1b66a7d9ba85d2edb67eb3adf1ba8dd251ded73925d82f98bfdda5b34511b.exe
PID 1836 wrote to memory of 1660	1836	41e1b66a7d9ba85d2edb67eb3adf1ba8dd251ded73925d82f98bfdda5b34511b.exe	41e1b66a7d9ba85d2edb67eb3adf1ba8dd251ded73925d82f98bfdda5b34511b.exe
PID 1836 wrote to memory of 1660	1836	41e1b66a7d9ba85d2edb67eb3adf1ba8dd251ded73925d82f98bfdda5b34511b.exe	41e1b66a7d9ba85d2edb67eb3adf1ba8dd251ded73925d82f98bfdda5b34511b.exe
PID 1836 wrote to memory of 1660	1836	41e1b66a7d9ba85d2edb67eb3adf1ba8dd251ded73925d82f98bfdda5b34511b.exe	41e1b66a7d9ba85d2edb67eb3adf1ba8dd251ded73925d82f98bfdda5b34511b.exe

C:\Users\Admin\AppData\Local\Temp\41e1b66a7d9ba85d2edb67eb3adf1ba8dd251ded73925d82f98bfdda5b34511b.exe
"C:\Users\Admin\AppData\Local\Temp\41e1b66a7d9ba85d2edb67eb3adf1ba8dd251ded73925d82f98bfdda5b34511b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1836

C:\Users\Admin\AppData\Local\Temp\41e1b66a7d9ba85d2edb67eb3adf1ba8dd251ded73925d82f98bfdda5b34511b.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1660

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1660-8-0x000000000041E320-mapping.dmp

Download
memory/1660-7-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1836-2-0x00000000749E0000-0x00000000750CE000-memory.dmp

Filesize
6.9MB

Download
memory/1836-3-0x0000000000A50000-0x0000000000A51000-memory.dmp

Filesize
4KB

Download
memory/1836-5-0x0000000000300000-0x000000000030B000-memory.dmp

Filesize
44KB

Download
memory/1836-6-0x00000000005B0000-0x00000000005E4000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads