formbook | 931f6aeff35cea88af521bc2cdca24164113c47ab3153e148e33d5bce66313f4

General

Target

urgent specification request.exe
Size

1.0MB
MD5

72a9c8f82996953e9fa72e5e0b85afca
SHA1

33f74928d66e687c2f981f9219a92d936152cbaf
SHA256

931f6aeff35cea88af521bc2cdca24164113c47ab3153e148e33d5bce66313f4
SHA512

ed85947f1b9f04e1d84646386b635c05dce66f063b3095b9873adbfa5b6c14b7f4bcc385aa14c0a2da4efd772e9278a517f58ff6b31d7f654d325d2efd0fdddd

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.timoniks.com/rbg/

Decoy

fingermode.com

parkplace.finance

hollandgreen2020.com

starbets.site

vehiculesfrigorifiques.com

sydiifinancial.com

rpivuenation.com

freesubdirectory.com

independencepartynyc.com

dogruparti.info

independencecountyclub.com

midnightlashesbykim.com

digitalsept.com

whatilikeabouttoday.com

marktplaatsaccount.info

13400667334.com

xinwei-ge.com

login-appleid.info

momashands.com

kennyxpress.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2236-12-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral2/memory/2236-13-0x000000000041EB40-mapping.dmp	formbook

Suspicious use of SetThreadContext 3 IoCs

Processes:

urgent specification request.exeurgent specification request.exe

description	pid	process	target process
PID 988 set thread context of 2236	988	urgent specification request.exe	urgent specification request.exe
PID 2236 set thread context of 2784	2236	urgent specification request.exe	Explorer.EXE
PID 2236 set thread context of 2784	2236	urgent specification request.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

urgent specification request.exe

pid	process
2236	urgent specification request.exe
2236	urgent specification request.exe
2236	urgent specification request.exe
2236	urgent specification request.exe
2236	urgent specification request.exe
2236	urgent specification request.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

urgent specification request.exe

pid process

2236 urgent specification request.exe
2236 urgent specification request.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

urgent specification request.exe

description pid process

Token: SeDebugPrivilege 2236 urgent specification request.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

2784 Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	2236	urgent specification request.exe

pid	process
2784	Explorer.EXE

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

urgent specification request.exe

description	pid	process	target process
PID 988 wrote to memory of 2236	988	urgent specification request.exe	urgent specification request.exe
PID 988 wrote to memory of 2236	988	urgent specification request.exe	urgent specification request.exe
PID 988 wrote to memory of 2236	988	urgent specification request.exe	urgent specification request.exe
PID 988 wrote to memory of 2236	988	urgent specification request.exe	urgent specification request.exe
PID 988 wrote to memory of 2236	988	urgent specification request.exe	urgent specification request.exe
PID 988 wrote to memory of 2236	988	urgent specification request.exe	urgent specification request.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of UnmapMainImage
PID:2784

C:\Users\Admin\AppData\Local\Temp\urgent specification request.exe
"C:\Users\Admin\AppData\Local\Temp\urgent specification request.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:988

C:\Users\Admin\AppData\Local\Temp\urgent specification request.exe
"C:\Users\Admin\AppData\Local\Temp\urgent specification request.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2236

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/988-2-0x0000000073800000-0x0000000073EEE000-memory.dmp

Filesize
6.9MB

Download
memory/988-3-0x0000000000560000-0x0000000000561000-memory.dmp

Filesize
4KB

Download
memory/988-5-0x0000000004EF0000-0x0000000004EF1000-memory.dmp

Filesize
4KB

Download
memory/988-6-0x00000000054F0000-0x00000000054F1000-memory.dmp

Filesize
4KB

Download
memory/988-7-0x0000000004FF0000-0x0000000004FF1000-memory.dmp

Filesize
4KB

Download
memory/988-8-0x0000000004E70000-0x0000000004E71000-memory.dmp

Filesize
4KB

Download
memory/988-9-0x00000000051C0000-0x00000000051C1000-memory.dmp

Filesize
4KB

Download
memory/988-10-0x0000000004EB0000-0x0000000004EC2000-memory.dmp

Filesize
72KB

Download
memory/988-11-0x0000000005D40000-0x0000000005DAB000-memory.dmp

Filesize
428KB

Download
memory/2236-12-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2236-13-0x000000000041EB40-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads