formbook | d0b62e121a89ba8e44b4b71a887dd80df1e4fc746dabc200854622e9ed1fa8cb

General

Target

b.exe
Size

3.3MB
MD5

30cb872994e8a0a4a635b06bfbe38006
SHA1

02e502ef79ea251f04fa9e02dd1d7639e59c7ddc
SHA256

d0b62e121a89ba8e44b4b71a887dd80df1e4fc746dabc200854622e9ed1fa8cb
SHA512

57bc48f7c2e77d28f13cd52dadeaa24a50a8eafb0316c2b7894e49cbe17fb16f14efe4f7b7568ef3ae40c7e6ec0a07862ec9bd91541be477795f7c113a4816d1

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.registeredagentfirm.com/jqc/

Decoy

strahlenschutz.digital

soterppe.com

wlw-hnlt.com

topheadlinetowitness-today.info

droriginals.com

baculatechie.online

definity.finance

weddingmustgoon.com

ludisenofloral.com

kenniscourtureconsignments.com

dl888.net

singledynamics.com

internetmarkaching.com

solidconstruct.site

ip-freight.com

11sxsx.com

incomecontent.com

the343radio.com

kimberlygoedhart.net

dgdoughnuts.net

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1504-12-0x000000000041EB50-mapping.dmp	formbook
behavioral2/memory/1504-14-0x0000000000700000-0x000000000072E000-memory.dmp	formbook

Executes dropped EXE 1 IoCs

Processes:

AddInProcess32.exe

pid process

1504 AddInProcess32.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

b.exe

description pid process target process

PID 744 set thread context of 1504 744 b.exe AddInProcess32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3940 1504 WerFault.exe AddInProcess32.exe

pid	process
1504	AddInProcess32.exe

description	pid	process	target process
PID 744 set thread context of 1504	744	b.exe	AddInProcess32.exe

pid	pid_target	process	target process
3940	1504	WerFault.exe	AddInProcess32.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

b.exeWerFault.exe

pid	process
744	b.exe
744	b.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

b.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	744	b.exe
Token: SeRestorePrivilege	3940	WerFault.exe
Token: SeBackupPrivilege	3940	WerFault.exe
Token: SeDebugPrivilege	3940	WerFault.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

b.exe

description	pid	process	target process
PID 744 wrote to memory of 1504	744	b.exe	AddInProcess32.exe
PID 744 wrote to memory of 1504	744	b.exe	AddInProcess32.exe
PID 744 wrote to memory of 1504	744	b.exe	AddInProcess32.exe
PID 744 wrote to memory of 1504	744	b.exe	AddInProcess32.exe
PID 744 wrote to memory of 1504	744	b.exe	AddInProcess32.exe
PID 744 wrote to memory of 1504	744	b.exe	AddInProcess32.exe

C:\Users\Admin\AppData\Local\Temp\b.exe
"C:\Users\Admin\AppData\Local\Temp\b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:744
- C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe
  "C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"
  2⤵
  - Executes dropped EXE
  PID:1504
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 188
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe

MD5
6a673bfc3b67ae9782cb31af2f234c68

SHA1
7544e89566d91e84e3cd437b9a073e5f6b56566e

SHA256
978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e

SHA512
72c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39

Download Submit
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe

MD5
6a673bfc3b67ae9782cb31af2f234c68

SHA1
7544e89566d91e84e3cd437b9a073e5f6b56566e

SHA256
978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e

SHA512
72c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39

Download Submit
memory/744-9-0x0000000005040000-0x000000000504B000-memory.dmp

Filesize
44KB

Download
memory/744-6-0x00000000028E0000-0x00000000028FE000-memory.dmp

Filesize
120KB

Download
memory/744-7-0x0000000004EA0000-0x0000000004EA1000-memory.dmp

Filesize
4KB

Download
memory/744-8-0x00000000078A0000-0x00000000078A1000-memory.dmp

Filesize
4KB

Download
memory/744-2-0x0000000073A20000-0x000000007410E000-memory.dmp

Filesize
6.9MB

Download
memory/744-10-0x0000000005060000-0x0000000005061000-memory.dmp

Filesize
4KB

Download
memory/744-5-0x0000000004EF0000-0x0000000004EF1000-memory.dmp

Filesize
4KB

Download
memory/744-3-0x0000000000390000-0x0000000000391000-memory.dmp

Filesize
4KB

Download
memory/1504-12-0x000000000041EB50-mapping.dmp

Download
memory/1504-14-0x0000000000700000-0x000000000072E000-memory.dmp

Filesize
184KB

Download
memory/3940-15-0x0000000004200000-0x0000000004201000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads