formbook | 1e978aeca824414a2dc136c53170762a358a51490786861f1f44784b5ff300db

General

Target

file.exe
Size

745KB
MD5

6b96099f44ece58f73e41cea3da9a1d7
SHA1

88a949fae42ad16a2f76231306e8ebbf4973f30c
SHA256

1e978aeca824414a2dc136c53170762a358a51490786861f1f44784b5ff300db
SHA512

947d6e975aecea9914e28f45df5fa5d227f9fe0ad88534806aaada040b5ff6cfa73b02b7c02c442b5c7a0cb146a202d6e89e39638c656bba36086ee9fd03f8ef

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.anuschkaleathers.com/zsh/

Decoy

golos95.club

pickpinz.store

surptalb.xyz

trippingthemuse.com

elizkumas.com

thesilverslipper.club

musicindustrymag.com

newfuzoku.com

2girls1stream.com

thefreebands.com

ayngaranastro.com

urakointiliikeleinonenoy.info

downunder-weddings.com

tictactechnology.net

partnerbudowlany.com

slidementality.com

estudiosobscuros.com

terminalr.com

kkrcreations.com

ahmclinic.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1660-7-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/1660-8-0x000000000041EBC0-mapping.dmp	formbook
behavioral1/memory/1036-9-0x0000000000000000-mapping.dmp	formbook

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1124 cmd.exe

pid	process
1124	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

file.exefile.exeNETSTAT.EXE

description	pid	process	target process
PID 1936 set thread context of 1660	1936	file.exe	file.exe
PID 1660 set thread context of 1260	1660	file.exe	Explorer.EXE
PID 1036 set thread context of 1260	1036	NETSTAT.EXE	Explorer.EXE

Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command-Line Interface
T1059

Processes:

NETSTAT.EXE

pid process

1036 NETSTAT.EXE

pid	process
1036	NETSTAT.EXE

Suspicious behavior: EnumeratesProcesses 19 IoCs

Processes:

file.exeNETSTAT.EXE

pid	process
1660	file.exe
1660	file.exe
1036	NETSTAT.EXE
1036	NETSTAT.EXE
1036	NETSTAT.EXE
1036	NETSTAT.EXE
1036	NETSTAT.EXE
1036	NETSTAT.EXE
1036	NETSTAT.EXE
1036	NETSTAT.EXE
1036	NETSTAT.EXE
1036	NETSTAT.EXE
1036	NETSTAT.EXE
1036	NETSTAT.EXE
1036	NETSTAT.EXE
1036	NETSTAT.EXE
1036	NETSTAT.EXE
1036	NETSTAT.EXE
1036	NETSTAT.EXE

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

file.exeNETSTAT.EXE

pid process

1660 file.exe
1660 file.exe
1660 file.exe
1036 NETSTAT.EXE
1036 NETSTAT.EXE
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

file.exeNETSTAT.EXE

description pid process

Token: SeDebugPrivilege 1660 file.exe
Token: SeDebugPrivilege 1036 NETSTAT.EXE

description	pid	process
Token: SeDebugPrivilege	1660	file.exe
Token: SeDebugPrivilege	1036	NETSTAT.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

file.exeExplorer.EXENETSTAT.EXE

description	pid	process	target process
PID 1936 wrote to memory of 1660	1936	file.exe	file.exe
PID 1936 wrote to memory of 1660	1936	file.exe	file.exe
PID 1936 wrote to memory of 1660	1936	file.exe	file.exe
PID 1936 wrote to memory of 1660	1936	file.exe	file.exe
PID 1936 wrote to memory of 1660	1936	file.exe	file.exe
PID 1936 wrote to memory of 1660	1936	file.exe	file.exe
PID 1936 wrote to memory of 1660	1936	file.exe	file.exe
PID 1260 wrote to memory of 1036	1260	Explorer.EXE	NETSTAT.EXE
PID 1260 wrote to memory of 1036	1260	Explorer.EXE	NETSTAT.EXE
PID 1260 wrote to memory of 1036	1260	Explorer.EXE	NETSTAT.EXE
PID 1260 wrote to memory of 1036	1260	Explorer.EXE	NETSTAT.EXE
PID 1036 wrote to memory of 1124	1036	NETSTAT.EXE	cmd.exe
PID 1036 wrote to memory of 1124	1036	NETSTAT.EXE	cmd.exe
PID 1036 wrote to memory of 1124	1036	NETSTAT.EXE	cmd.exe
PID 1036 wrote to memory of 1124	1036	NETSTAT.EXE	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:1260

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1936

C:\Users\Admin\AppData\Local\Temp\file.exe
"{path}"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1660

C:\Windows\SysWOW64\NETSTAT.EXE
"C:\Windows\SysWOW64\NETSTAT.EXE"
2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1036

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\file.exe"
3⤵
- Deletes itself
PID:1124

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1036-9-0x0000000000000000-mapping.dmp

Download
memory/1036-10-0x00000000000C0000-0x00000000000C9000-memory.dmp

Filesize
36KB

Download
memory/1036-12-0x00000000030E0000-0x0000000003192000-memory.dmp

Filesize
712KB

Download
memory/1124-11-0x0000000000000000-mapping.dmp

Download
memory/1660-7-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1660-8-0x000000000041EBC0-mapping.dmp

Download
memory/1936-2-0x0000000073E00000-0x00000000744EE000-memory.dmp

Filesize
6.9MB

Download
memory/1936-3-0x0000000000A40000-0x0000000000A41000-memory.dmp

Filesize
4KB

Download
memory/1936-5-0x0000000000590000-0x000000000059E000-memory.dmp

Filesize
56KB

Download
memory/1936-6-0x0000000005180000-0x00000000051E1000-memory.dmp

Filesize
388KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads