formbook | 20eb20f9b9fa4186e31943fb30235c77fd0816a5e6b6fc1ac2a9144b46672e3d

General

Target

4b39f9fd4012f4534fb70bb2c2bfc7d9.exe
Size

756KB
MD5

4b39f9fd4012f4534fb70bb2c2bfc7d9
SHA1

65c948abd3024817e30ac66acb9e60ba379da3a3
SHA256

20eb20f9b9fa4186e31943fb30235c77fd0816a5e6b6fc1ac2a9144b46672e3d
SHA512

70f3582553390d2c21c032ecbbc7c196f2edb0165005de65e91dc738bcf9f0a257745b42510b9569ed5a77f1ed8e7cc349c3747e695996fbcac0b079c34cc972

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.theatomicshots.com/xle/

Decoy

tknbr.com

loyaloneconstruction.com

what-where.com

matebacapital.com

marriedandmore.com

qiemfsolutions.com

graececonsulting.com

www7456.com

littlefreecherokeelibrary.com

tailgatepawkinglot.com

musheet.com

tesfamariamtb.com

1728025.com

xceltechuae.com

harperandchloe.com

thepamperedbarber.com

5050alberta.com

supplychainstrainer.com

lacorte.group

ringingbear.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/900-11-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral2/memory/900-12-0x000000000041EB90-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

4b39f9fd4012f4534fb70bb2c2bfc7d9.exe

description pid process target process

PID 1048 set thread context of 900 1048 4b39f9fd4012f4534fb70bb2c2bfc7d9.exe 4b39f9fd4012f4534fb70bb2c2bfc7d9.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

4b39f9fd4012f4534fb70bb2c2bfc7d9.exe

pid process

900 4b39f9fd4012f4534fb70bb2c2bfc7d9.exe
900 4b39f9fd4012f4534fb70bb2c2bfc7d9.exe

description	pid	process	target process
PID 1048 set thread context of 900	1048	4b39f9fd4012f4534fb70bb2c2bfc7d9.exe	4b39f9fd4012f4534fb70bb2c2bfc7d9.exe

pid	process
900	4b39f9fd4012f4534fb70bb2c2bfc7d9.exe
900	4b39f9fd4012f4534fb70bb2c2bfc7d9.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

4b39f9fd4012f4534fb70bb2c2bfc7d9.exe

description	pid	process	target process
PID 1048 wrote to memory of 900	1048	4b39f9fd4012f4534fb70bb2c2bfc7d9.exe	4b39f9fd4012f4534fb70bb2c2bfc7d9.exe
PID 1048 wrote to memory of 900	1048	4b39f9fd4012f4534fb70bb2c2bfc7d9.exe	4b39f9fd4012f4534fb70bb2c2bfc7d9.exe
PID 1048 wrote to memory of 900	1048	4b39f9fd4012f4534fb70bb2c2bfc7d9.exe	4b39f9fd4012f4534fb70bb2c2bfc7d9.exe
PID 1048 wrote to memory of 900	1048	4b39f9fd4012f4534fb70bb2c2bfc7d9.exe	4b39f9fd4012f4534fb70bb2c2bfc7d9.exe
PID 1048 wrote to memory of 900	1048	4b39f9fd4012f4534fb70bb2c2bfc7d9.exe	4b39f9fd4012f4534fb70bb2c2bfc7d9.exe
PID 1048 wrote to memory of 900	1048	4b39f9fd4012f4534fb70bb2c2bfc7d9.exe	4b39f9fd4012f4534fb70bb2c2bfc7d9.exe

C:\Users\Admin\AppData\Local\Temp\4b39f9fd4012f4534fb70bb2c2bfc7d9.exe
"C:\Users\Admin\AppData\Local\Temp\4b39f9fd4012f4534fb70bb2c2bfc7d9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1048

C:\Users\Admin\AppData\Local\Temp\4b39f9fd4012f4534fb70bb2c2bfc7d9.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:900

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/900-11-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/900-12-0x000000000041EB90-mapping.dmp

Download
memory/1048-2-0x0000000073A30000-0x000000007411E000-memory.dmp

Filesize
6.9MB

Download
memory/1048-3-0x0000000000AF0000-0x0000000000AF1000-memory.dmp

Filesize
4KB

Download
memory/1048-5-0x0000000005850000-0x0000000005851000-memory.dmp

Filesize
4KB

Download
memory/1048-6-0x00000000053F0000-0x00000000053F1000-memory.dmp

Filesize
4KB

Download
memory/1048-7-0x0000000005570000-0x0000000005571000-memory.dmp

Filesize
4KB

Download
memory/1048-8-0x00000000077D0000-0x00000000077DE000-memory.dmp

Filesize
56KB

Download
memory/1048-9-0x0000000007A10000-0x0000000007A95000-memory.dmp

Filesize
532KB

Download
memory/1048-10-0x0000000007B40000-0x0000000007B41000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing