formbook | 6b44ff9b8963adb4cd20ea744317da9774bc1bb90f2c9692419ee28d38740826

Analysis

Target
order.exe
Size 239KB
Sample210108-e4v67w9s9e
SHA256 6b44ff9b8963adb4cd20ea744317da9774bc1bb90f2c9692419ee28d38740826
MD5 0cdef98f5ed0ab013820bf4d87fa337a
SHA1 ab724aee2548377cd06bf76464b81762bdcffafb
SHA512 cf29c70511432682eacec77019e3f71c38f409be4819dcf3c00dab9c7a2f681bc2c94e1d0a55f931c00a7d90e84a6caa93e69e447ee7f43f62983d03a9f5cd0d
MD5 SHA1 SHA512

Score

10^/10

Family

Decoy

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/1816-2-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral2/memory/1816-3-0x000000000041ECF0-mapping.dmp	formbook
behavioral2/memory/784-5-0x0000000000000000-mapping.dmp	formbook

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 508 set thread context of 1816	508	order.exe	75
PID 1816 set thread context of 3016	1816	order.exe	21
PID 784 set thread context of 3016	784	control.exe	21

Suspicious behavior: EnumeratesProcesses 60 IoCs

Suspicious behavior: MapViewOfSection 6 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1816	order.exe
Token: SeDebugPrivilege	784	control.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3016	Explorer.EXE

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 508 wrote to memory of 1816	508	order.exe	75
PID 508 wrote to memory of 1816	508	order.exe	75
PID 508 wrote to memory of 1816	508	order.exe	75
PID 508 wrote to memory of 1816	508	order.exe	75
PID 3016 wrote to memory of 784	3016	Explorer.EXE	77
PID 3016 wrote to memory of 784	3016	Explorer.EXE	77
PID 3016 wrote to memory of 784	3016	Explorer.EXE	77
PID 784 wrote to memory of 60	784	control.exe	80
PID 784 wrote to memory of 60	784	control.exe	80
PID 784 wrote to memory of 60	784	control.exe	80

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Users\Admin\AppData\Local\Temp\order.exe
  "C:\Users\Admin\AppData\Local\Temp\order.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:508
- - C:\Users\Admin\AppData\Local\Temp\order.exe
    "C:\Users\Admin\AppData\Local\Temp\order.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:1816
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:3096
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\SysWOW64\control.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:784
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\order.exe"
    3⤵
    PID:60

memory/784-6-0x0000000001090000-0x00000000010B0000-memory.dmp

Download

memory/784-7-0x0000000001090000-0x00000000010B0000-memory.dmp

Download

memory/784-9-0x0000000005EE0000-0x0000000005FDC000-memory.dmp

Download

memory/1816-2-0x0000000000400000-0x000000000042E000-memory.dmp

Download