formbook | c3d490568e73f61c86d2d4c01e170bdcf3c0d3eb5e309ff3d3fb808a4a867a54

General

Target

payment advice00000789_pdf.exe
Size

866KB
MD5

a08fc6065952b6625893e48a8bc72106
SHA1

7b4baec718caa9c5a3aa7cbe1d85121af68f810b
SHA256

c3d490568e73f61c86d2d4c01e170bdcf3c0d3eb5e309ff3d3fb808a4a867a54
SHA512

2edcf7922cdd41d2b30ef3abb734a79a21ace178f8ea100067077be7ff5aca470e2000f869b839aca27b86ea4da9bdefcbc408de19e4e461a082fe5c7c916974

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.aftabzahur.com/wgn/

Decoy

kokokara-life-blog.com

faswear.com

futureleadershiptoday.com

date4done.xyz

thecouponinn.com

bbeycarpetsf.com

propolisnasalspray.com

jinjudiamond.com

goodevectors.com

nehyam.com

evalinkapuppets.com

what-if-statistics.com

rateofrisk.com

impacttestonlinne.com

servis-kaydet.info

coloniacafe.com

marcemarketing.com

aarigging.com

goddesswitchery.com

jasqblo.icu

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1196-7-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/1196-8-0x000000000041EAC0-mapping.dmp	formbook
behavioral1/memory/1236-9-0x0000000000000000-mapping.dmp	formbook

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1456 cmd.exe

pid	process
1456	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

payment advice00000789_pdf.exepayment advice00000789_pdf.execontrol.exe

description	pid	process	target process
PID 1200 set thread context of 1196	1200	payment advice00000789_pdf.exe	payment advice00000789_pdf.exe
PID 1196 set thread context of 1252	1196	payment advice00000789_pdf.exe	Explorer.EXE
PID 1236 set thread context of 1252	1236	control.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 22 IoCs

Processes:

payment advice00000789_pdf.execontrol.exe

pid	process
1196	payment advice00000789_pdf.exe
1196	payment advice00000789_pdf.exe
1236	control.exe
1236	control.exe
1236	control.exe
1236	control.exe
1236	control.exe
1236	control.exe
1236	control.exe
1236	control.exe
1236	control.exe
1236	control.exe
1236	control.exe
1236	control.exe
1236	control.exe
1236	control.exe
1236	control.exe
1236	control.exe
1236	control.exe
1236	control.exe
1236	control.exe
1236	control.exe

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

payment advice00000789_pdf.execontrol.exe

pid process

1196 payment advice00000789_pdf.exe
1196 payment advice00000789_pdf.exe
1196 payment advice00000789_pdf.exe
1236 control.exe
1236 control.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

payment advice00000789_pdf.execontrol.exe

description pid process

Token: SeDebugPrivilege 1196 payment advice00000789_pdf.exe
Token: SeDebugPrivilege 1236 control.exe
Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

Explorer.EXE

pid process

1252 Explorer.EXE
1252 Explorer.EXE
1252 Explorer.EXE
1252 Explorer.EXE
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

Explorer.EXE

pid process

1252 Explorer.EXE
1252 Explorer.EXE
1252 Explorer.EXE
1252 Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	1196	payment advice00000789_pdf.exe
Token: SeDebugPrivilege	1236	control.exe

pid	process
1252	Explorer.EXE
1252	Explorer.EXE
1252	Explorer.EXE
1252	Explorer.EXE

pid	process
1252	Explorer.EXE
1252	Explorer.EXE
1252	Explorer.EXE
1252	Explorer.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

payment advice00000789_pdf.exeExplorer.EXEcontrol.exe

description	pid	process	target process
PID 1200 wrote to memory of 1196	1200	payment advice00000789_pdf.exe	payment advice00000789_pdf.exe
PID 1200 wrote to memory of 1196	1200	payment advice00000789_pdf.exe	payment advice00000789_pdf.exe
PID 1200 wrote to memory of 1196	1200	payment advice00000789_pdf.exe	payment advice00000789_pdf.exe
PID 1200 wrote to memory of 1196	1200	payment advice00000789_pdf.exe	payment advice00000789_pdf.exe
PID 1200 wrote to memory of 1196	1200	payment advice00000789_pdf.exe	payment advice00000789_pdf.exe
PID 1200 wrote to memory of 1196	1200	payment advice00000789_pdf.exe	payment advice00000789_pdf.exe
PID 1200 wrote to memory of 1196	1200	payment advice00000789_pdf.exe	payment advice00000789_pdf.exe
PID 1252 wrote to memory of 1236	1252	Explorer.EXE	control.exe
PID 1252 wrote to memory of 1236	1252	Explorer.EXE	control.exe
PID 1252 wrote to memory of 1236	1252	Explorer.EXE	control.exe
PID 1252 wrote to memory of 1236	1252	Explorer.EXE	control.exe
PID 1236 wrote to memory of 1456	1236	control.exe	cmd.exe
PID 1236 wrote to memory of 1456	1236	control.exe	cmd.exe
PID 1236 wrote to memory of 1456	1236	control.exe	cmd.exe
PID 1236 wrote to memory of 1456	1236	control.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1252

C:\Users\Admin\AppData\Local\Temp\payment advice00000789_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\payment advice00000789_pdf.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1200

C:\Users\Admin\AppData\Local\Temp\payment advice00000789_pdf.exe
"{path}"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1196

C:\Windows\SysWOW64\control.exe
"C:\Windows\SysWOW64\control.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1236

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\payment advice00000789_pdf.exe"
3⤵
- Deletes itself
PID:1456

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1196-7-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1196-8-0x000000000041EAC0-mapping.dmp

Download
memory/1200-2-0x0000000074580000-0x0000000074C6E000-memory.dmp

Filesize
6.9MB

Download
memory/1200-3-0x0000000000C70000-0x0000000000C71000-memory.dmp

Filesize
4KB

Download
memory/1200-5-0x00000000002A0000-0x00000000002AE000-memory.dmp

Filesize
56KB

Download
memory/1200-6-0x0000000005760000-0x00000000057FD000-memory.dmp

Filesize
628KB

Download
memory/1236-9-0x0000000000000000-mapping.dmp

Download
memory/1236-10-0x00000000007D0000-0x00000000007EF000-memory.dmp

Filesize
124KB

Download
memory/1236-12-0x0000000001EC0000-0x0000000002007000-memory.dmp

Filesize
1.3MB

Download
memory/1456-11-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads