formbook | 6c63e68f6d116d78c115e15d1c1bdaeb1064cb562de15c4f5d46142e637f26e3

General

Target

inz.exe
Size

411KB
MD5

ab87bb7551411aec9c0b27cb4dcca79e
SHA1

e689e98a99d1d2a6e9a67a6adbd7fba737ed2d6b
SHA256

6c63e68f6d116d78c115e15d1c1bdaeb1064cb562de15c4f5d46142e637f26e3
SHA512

5a0ef5f90cd43534e2043dbe4fae17c9b1a1197be9e1acd29c1c069f710732bd8f6c3aad59b5ff16e4c65ac43b4e23e8a2c8c7f5fc27a74638c150b319234f4f

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.nationshiphop.com/hko6/

Decoy

apartmentsineverettwa.com

forritcu.net

hotroodes.com

skinnerttc.com

royaltrustmyanmar.com

adreslog.com

kaysbridalboutiques.com

multitask-improvements.com

geniiforum.com

smarthomehatinh.asia

banglikeaboss.com

javlover.club

affiliateclubindia.com

mycapecoralhomevalue.com

comparamuebles.online

newrochellenissan.com

nairobi-paris.com

fwk.xyz

downdepot.com

nextgenmemorabilia.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1904-3-0x000000000040188B-mapping.dmp	formbook
behavioral1/memory/1904-4-0x0000000000400000-0x0000000000443000-memory.dmp	formbook
behavioral1/memory/1904-2-0x0000000000400000-0x0000000000443000-memory.dmp	formbook
behavioral1/memory/1904-6-0x0000000000190000-0x00000000001BE000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

inz.exe

description pid process target process

PID 932 set thread context of 1904 932 inz.exe inz.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2012 1904 WerFault.exe inz.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

2012 WerFault.exe
2012 WerFault.exe
2012 WerFault.exe
2012 WerFault.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

inz.exe

pid process

932 inz.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 2012 WerFault.exe

description	pid	process	target process
PID 932 set thread context of 1904	932	inz.exe	inz.exe

pid	pid_target	process	target process
2012	1904	WerFault.exe	inz.exe

pid	process
2012	WerFault.exe
2012	WerFault.exe
2012	WerFault.exe
2012	WerFault.exe

pid	process
932	inz.exe

description	pid	process
Token: SeDebugPrivilege	2012	WerFault.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

inz.exeinz.exe

description	pid	process	target process
PID 932 wrote to memory of 1904	932	inz.exe	inz.exe
PID 932 wrote to memory of 1904	932	inz.exe	inz.exe
PID 932 wrote to memory of 1904	932	inz.exe	inz.exe
PID 932 wrote to memory of 1904	932	inz.exe	inz.exe
PID 932 wrote to memory of 1904	932	inz.exe	inz.exe
PID 1904 wrote to memory of 2012	1904	inz.exe	WerFault.exe
PID 1904 wrote to memory of 2012	1904	inz.exe	WerFault.exe
PID 1904 wrote to memory of 2012	1904	inz.exe	WerFault.exe
PID 1904 wrote to memory of 2012	1904	inz.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\inz.exe
"C:\Users\Admin\AppData\Local\Temp\inz.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:932
- C:\Users\Admin\AppData\Local\Temp\inz.exe
  "C:\Users\Admin\AppData\Local\Temp\inz.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1904
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1904 -s 524
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1904-3-0x000000000040188B-mapping.dmp

Download
memory/1904-4-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1904-2-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1904-5-0x0000000074120000-0x000000007480E000-memory.dmp

Filesize
6.9MB

Download
memory/1904-6-0x0000000000190000-0x00000000001BE000-memory.dmp

Filesize
184KB

Download
memory/2012-7-0x0000000000000000-mapping.dmp

Download
memory/2012-8-0x0000000001FC0000-0x0000000001FD1000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing