formbook | d0b62e121a89ba8e44b4b71a887dd80df1e4fc746dabc200854622e9ed1fa8cb

General

Target

b.exe
Size

3.3MB
MD5

30cb872994e8a0a4a635b06bfbe38006
SHA1

02e502ef79ea251f04fa9e02dd1d7639e59c7ddc
SHA256

d0b62e121a89ba8e44b4b71a887dd80df1e4fc746dabc200854622e9ed1fa8cb
SHA512

57bc48f7c2e77d28f13cd52dadeaa24a50a8eafb0316c2b7894e49cbe17fb16f14efe4f7b7568ef3ae40c7e6ec0a07862ec9bd91541be477795f7c113a4816d1

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.registeredagentfirm.com/jqc/

Decoy

strahlenschutz.digital

soterppe.com

wlw-hnlt.com

topheadlinetowitness-today.info

droriginals.com

baculatechie.online

definity.finance

weddingmustgoon.com

ludisenofloral.com

kenniscourtureconsignments.com

dl888.net

singledynamics.com

internetmarkaching.com

solidconstruct.site

ip-freight.com

11sxsx.com

incomecontent.com

the343radio.com

kimberlygoedhart.net

dgdoughnuts.net

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/968-10-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/968-11-0x000000000041EB50-mapping.dmp	formbook
behavioral1/memory/560-13-0x0000000000000000-mapping.dmp	formbook

Executes dropped EXE 1 IoCs

Processes:

AddInProcess32.exe

pid process

968 AddInProcess32.exe
Loads dropped DLL 1 IoCs

Processes:

b.exe

pid process

1068 b.exe

pid	process
968	AddInProcess32.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

b.exeAddInProcess32.execolorcpl.exe

description	pid	process	target process
PID 1068 set thread context of 968	1068	b.exe	AddInProcess32.exe
PID 968 set thread context of 1236	968	AddInProcess32.exe	Explorer.EXE
PID 560 set thread context of 1236	560	colorcpl.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 25 IoCs

Processes:

b.exeAddInProcess32.execolorcpl.exe

pid	process
1068	b.exe
1068	b.exe
968	AddInProcess32.exe
968	AddInProcess32.exe
560	colorcpl.exe
560	colorcpl.exe
560	colorcpl.exe
560	colorcpl.exe
560	colorcpl.exe
560	colorcpl.exe
560	colorcpl.exe
560	colorcpl.exe
560	colorcpl.exe
560	colorcpl.exe
560	colorcpl.exe
560	colorcpl.exe
560	colorcpl.exe
560	colorcpl.exe
560	colorcpl.exe
560	colorcpl.exe
560	colorcpl.exe
560	colorcpl.exe
560	colorcpl.exe
560	colorcpl.exe
560	colorcpl.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1236 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

AddInProcess32.execolorcpl.exe

pid process

968 AddInProcess32.exe
968 AddInProcess32.exe
968 AddInProcess32.exe
560 colorcpl.exe
560 colorcpl.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

b.exeAddInProcess32.execolorcpl.exe

description pid process

Token: SeDebugPrivilege 1068 b.exe
Token: SeDebugPrivilege 968 AddInProcess32.exe
Token: SeDebugPrivilege 560 colorcpl.exe
Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

Explorer.EXE

pid process

1236 Explorer.EXE
1236 Explorer.EXE
1236 Explorer.EXE
1236 Explorer.EXE
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

Explorer.EXE

pid process

1236 Explorer.EXE
1236 Explorer.EXE
1236 Explorer.EXE
1236 Explorer.EXE

pid	process
1236	Explorer.EXE

pid	process
968	AddInProcess32.exe
968	AddInProcess32.exe
968	AddInProcess32.exe
560	colorcpl.exe
560	colorcpl.exe

description	pid	process
Token: SeDebugPrivilege	1068	b.exe
Token: SeDebugPrivilege	968	AddInProcess32.exe
Token: SeDebugPrivilege	560	colorcpl.exe

pid	process
1236	Explorer.EXE
1236	Explorer.EXE
1236	Explorer.EXE
1236	Explorer.EXE

pid	process
1236	Explorer.EXE
1236	Explorer.EXE
1236	Explorer.EXE
1236	Explorer.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

b.exeExplorer.EXEcolorcpl.exe

description	pid	process	target process
PID 1068 wrote to memory of 968	1068	b.exe	AddInProcess32.exe
PID 1068 wrote to memory of 968	1068	b.exe	AddInProcess32.exe
PID 1068 wrote to memory of 968	1068	b.exe	AddInProcess32.exe
PID 1068 wrote to memory of 968	1068	b.exe	AddInProcess32.exe
PID 1068 wrote to memory of 968	1068	b.exe	AddInProcess32.exe
PID 1068 wrote to memory of 968	1068	b.exe	AddInProcess32.exe
PID 1068 wrote to memory of 968	1068	b.exe	AddInProcess32.exe
PID 1236 wrote to memory of 560	1236	Explorer.EXE	colorcpl.exe
PID 1236 wrote to memory of 560	1236	Explorer.EXE	colorcpl.exe
PID 1236 wrote to memory of 560	1236	Explorer.EXE	colorcpl.exe
PID 1236 wrote to memory of 560	1236	Explorer.EXE	colorcpl.exe
PID 560 wrote to memory of 1632	560	colorcpl.exe	cmd.exe
PID 560 wrote to memory of 1632	560	colorcpl.exe	cmd.exe
PID 560 wrote to memory of 1632	560	colorcpl.exe	cmd.exe
PID 560 wrote to memory of 1632	560	colorcpl.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Users\Admin\AppData\Local\Temp\b.exe
  "C:\Users\Admin\AppData\Local\Temp\b.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1068
- - C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe
    "C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:968
- C:\Windows\SysWOW64\colorcpl.exe
  "C:\Windows\SysWOW64\colorcpl.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:560
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"
    3⤵
    PID:1632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe

MD5
6a673bfc3b67ae9782cb31af2f234c68

SHA1
7544e89566d91e84e3cd437b9a073e5f6b56566e

SHA256
978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e

SHA512
72c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39

Download Submit
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe

MD5
6a673bfc3b67ae9782cb31af2f234c68

SHA1
7544e89566d91e84e3cd437b9a073e5f6b56566e

SHA256
978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e

SHA512
72c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39

Download Submit
\Users\Admin\AppData\Local\Temp\AddInProcess32.exe

MD5
6a673bfc3b67ae9782cb31af2f234c68

SHA1
7544e89566d91e84e3cd437b9a073e5f6b56566e

SHA256
978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e

SHA512
72c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39

Download Submit
memory/560-13-0x0000000000000000-mapping.dmp

Download
memory/560-14-0x0000000000300000-0x0000000000318000-memory.dmp

Filesize
96KB

Download
memory/560-17-0x0000000001E60000-0x0000000001F91000-memory.dmp

Filesize
1.2MB

Download
memory/968-10-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/968-11-0x000000000041EB50-mapping.dmp

Download
memory/1068-6-0x00000000004F0000-0x00000000004F1000-memory.dmp

Filesize
4KB

Download
memory/1068-7-0x0000000000550000-0x000000000055B000-memory.dmp

Filesize
44KB

Download
memory/1068-8-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/1068-2-0x0000000074710000-0x0000000074DFE000-memory.dmp

Filesize
6.9MB

Download
memory/1068-5-0x00000000003E0000-0x00000000003FE000-memory.dmp

Filesize
120KB

Download
memory/1068-3-0x0000000000EF0000-0x0000000000EF1000-memory.dmp

Filesize
4KB

Download
memory/1632-16-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads