formbook | c689182f2eb4ca29f372d9c51d15ac878f7cb6a5b0abf6b83a6e53abb5279c95

General

Target

c6f311ade929a6fe981c315577d408b1.exe
Size

875KB
MD5

c6f311ade929a6fe981c315577d408b1
SHA1

c6a7df0141cba6c22f35664e0c7139cb4fe703d1
SHA256

c689182f2eb4ca29f372d9c51d15ac878f7cb6a5b0abf6b83a6e53abb5279c95
SHA512

980d61eb5bf69b1557539437fb400f1648bcb11f7e865122fc2a1b908bac31d4f0290bdd639cb4e76f77dde6e85509f5e69a07faa07f71643aab33f12898b9b1

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.theatomicshots.com/xle/

Decoy

tknbr.com

loyaloneconstruction.com

what-where.com

matebacapital.com

marriedandmore.com

qiemfsolutions.com

graececonsulting.com

www7456.com

littlefreecherokeelibrary.com

tailgatepawkinglot.com

musheet.com

tesfamariamtb.com

1728025.com

xceltechuae.com

harperandchloe.com

thepamperedbarber.com

5050alberta.com

supplychainstrainer.com

lacorte.group

ringingbear.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1664-7-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/1664-8-0x000000000041EB90-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

c6f311ade929a6fe981c315577d408b1.exe

description pid process target process

PID 1056 set thread context of 1664 1056 c6f311ade929a6fe981c315577d408b1.exe c6f311ade929a6fe981c315577d408b1.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

c6f311ade929a6fe981c315577d408b1.exe

pid process

1664 c6f311ade929a6fe981c315577d408b1.exe

description	pid	process	target process
PID 1056 set thread context of 1664	1056	c6f311ade929a6fe981c315577d408b1.exe	c6f311ade929a6fe981c315577d408b1.exe

pid	process
1664	c6f311ade929a6fe981c315577d408b1.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

c6f311ade929a6fe981c315577d408b1.exe

description	pid	process	target process
PID 1056 wrote to memory of 1664	1056	c6f311ade929a6fe981c315577d408b1.exe	c6f311ade929a6fe981c315577d408b1.exe
PID 1056 wrote to memory of 1664	1056	c6f311ade929a6fe981c315577d408b1.exe	c6f311ade929a6fe981c315577d408b1.exe
PID 1056 wrote to memory of 1664	1056	c6f311ade929a6fe981c315577d408b1.exe	c6f311ade929a6fe981c315577d408b1.exe
PID 1056 wrote to memory of 1664	1056	c6f311ade929a6fe981c315577d408b1.exe	c6f311ade929a6fe981c315577d408b1.exe
PID 1056 wrote to memory of 1664	1056	c6f311ade929a6fe981c315577d408b1.exe	c6f311ade929a6fe981c315577d408b1.exe
PID 1056 wrote to memory of 1664	1056	c6f311ade929a6fe981c315577d408b1.exe	c6f311ade929a6fe981c315577d408b1.exe
PID 1056 wrote to memory of 1664	1056	c6f311ade929a6fe981c315577d408b1.exe	c6f311ade929a6fe981c315577d408b1.exe

C:\Users\Admin\AppData\Local\Temp\c6f311ade929a6fe981c315577d408b1.exe
"C:\Users\Admin\AppData\Local\Temp\c6f311ade929a6fe981c315577d408b1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1056

C:\Users\Admin\AppData\Local\Temp\c6f311ade929a6fe981c315577d408b1.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1664

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1056-2-0x0000000073C60000-0x000000007434E000-memory.dmp

Filesize
6.9MB

Download
memory/1056-3-0x0000000000990000-0x0000000000991000-memory.dmp

Filesize
4KB

Download
memory/1056-5-0x0000000000260000-0x000000000026E000-memory.dmp

Filesize
56KB

Download
memory/1056-6-0x0000000005330000-0x00000000053CB000-memory.dmp

Filesize
620KB

Download
memory/1664-7-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1664-8-0x000000000041EB90-mapping.dmp

Download

Analysis

Sharing