formbook | 0d07ec342e6af7f5e2b6c600a006cbf03483df901104e3480be6e9c00ed1de1b

General

Target

e4be8ad4a01c3d5a4f9095d98184a15863ebb0c6ad8a23b1f6128ef045e8281f.exe
Size

267KB
MD5

1e5a88fc919f1dde5ce8c69cac45dc94
SHA1

fbbc3ee1afd262a4e02cb85a7efe9576b26edb44
SHA256

e4be8ad4a01c3d5a4f9095d98184a15863ebb0c6ad8a23b1f6128ef045e8281f
SHA512

39cab534fb0f016e0b5192494da67d0020d10df1e98aabe32a73ad6e2965776334070b0b1dd44f4ab773b9292b1209d24153695b21a17aa19d1603c8a6d55ebf

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.beemptty.com/mx/

Decoy

studsociety.net

dinobastiani.com

0i4ninesome.men

azureolive.com

alaskaserviceagency.net

affordablenotes.com

loafund.com

eldelvideo.com

xiaomimi4.com

wokeamerican.net

studietijd.com

szshuaxin.com

integratingfaithandwork.com

scanreg5483.win

takeurpicture.com

ljfuxing.com

vitelstars-firm-india.site

forefrontinspectionservices.com

blacklist.place

charityforlife.life

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3980-2-0x0000000000401000-0x0000000000429A00-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

e4be8ad4a01c3d5a4f9095d98184a15863ebb0c6ad8a23b1f6128ef045e8281f.exe

description	pid	process	target process
PID 4688 set thread context of 3980	4688	e4be8ad4a01c3d5a4f9095d98184a15863ebb0c6ad8a23b1f6128ef045e8281f.exe	e4be8ad4a01c3d5a4f9095d98184a15863ebb0c6ad8a23b1f6128ef045e8281f.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

e4be8ad4a01c3d5a4f9095d98184a15863ebb0c6ad8a23b1f6128ef045e8281f.exe

pid	process
3980	e4be8ad4a01c3d5a4f9095d98184a15863ebb0c6ad8a23b1f6128ef045e8281f.exe
3980	e4be8ad4a01c3d5a4f9095d98184a15863ebb0c6ad8a23b1f6128ef045e8281f.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

e4be8ad4a01c3d5a4f9095d98184a15863ebb0c6ad8a23b1f6128ef045e8281f.exe

description pid process

Token: SeDebugPrivilege 4688 e4be8ad4a01c3d5a4f9095d98184a15863ebb0c6ad8a23b1f6128ef045e8281f.exe

description	pid	process
Token: SeDebugPrivilege	4688	e4be8ad4a01c3d5a4f9095d98184a15863ebb0c6ad8a23b1f6128ef045e8281f.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

e4be8ad4a01c3d5a4f9095d98184a15863ebb0c6ad8a23b1f6128ef045e8281f.exe

description	pid	process	target process
PID 4688 wrote to memory of 3980	4688	e4be8ad4a01c3d5a4f9095d98184a15863ebb0c6ad8a23b1f6128ef045e8281f.exe	e4be8ad4a01c3d5a4f9095d98184a15863ebb0c6ad8a23b1f6128ef045e8281f.exe
PID 4688 wrote to memory of 3980	4688	e4be8ad4a01c3d5a4f9095d98184a15863ebb0c6ad8a23b1f6128ef045e8281f.exe	e4be8ad4a01c3d5a4f9095d98184a15863ebb0c6ad8a23b1f6128ef045e8281f.exe
PID 4688 wrote to memory of 3980	4688	e4be8ad4a01c3d5a4f9095d98184a15863ebb0c6ad8a23b1f6128ef045e8281f.exe	e4be8ad4a01c3d5a4f9095d98184a15863ebb0c6ad8a23b1f6128ef045e8281f.exe
PID 4688 wrote to memory of 3980	4688	e4be8ad4a01c3d5a4f9095d98184a15863ebb0c6ad8a23b1f6128ef045e8281f.exe	e4be8ad4a01c3d5a4f9095d98184a15863ebb0c6ad8a23b1f6128ef045e8281f.exe
PID 4688 wrote to memory of 3980	4688	e4be8ad4a01c3d5a4f9095d98184a15863ebb0c6ad8a23b1f6128ef045e8281f.exe	e4be8ad4a01c3d5a4f9095d98184a15863ebb0c6ad8a23b1f6128ef045e8281f.exe
PID 4688 wrote to memory of 3980	4688	e4be8ad4a01c3d5a4f9095d98184a15863ebb0c6ad8a23b1f6128ef045e8281f.exe	e4be8ad4a01c3d5a4f9095d98184a15863ebb0c6ad8a23b1f6128ef045e8281f.exe

C:\Users\Admin\AppData\Local\Temp\e4be8ad4a01c3d5a4f9095d98184a15863ebb0c6ad8a23b1f6128ef045e8281f.exe
"C:\Users\Admin\AppData\Local\Temp\e4be8ad4a01c3d5a4f9095d98184a15863ebb0c6ad8a23b1f6128ef045e8281f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4688

C:\Users\Admin\AppData\Local\Temp\e4be8ad4a01c3d5a4f9095d98184a15863ebb0c6ad8a23b1f6128ef045e8281f.exe
"C:\Users\Admin\AppData\Local\Temp\e4be8ad4a01c3d5a4f9095d98184a15863ebb0c6ad8a23b1f6128ef045e8281f.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3980

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3980-2-0x0000000000401000-0x0000000000429A00-memory.dmp

Filesize
162KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads