formbook | f777596fe0fa9c11e6ff244810d6c6d4846f9c03b8840ad88ac8853de8a766db

General

Target

0d6dc87e3f4948bdedf40980ac0f8f30.exe
Size

624KB
MD5

0d6dc87e3f4948bdedf40980ac0f8f30
SHA1

76424fed3a6131f3e49975978343b8836cc11006
SHA256

f777596fe0fa9c11e6ff244810d6c6d4846f9c03b8840ad88ac8853de8a766db
SHA512

e63d837d9345b2d936b223ad2090032af8debb2323b0d2b5c9341041c740a840ccbecc4df79e60cf972fbe5087fcedcfae3bcb1dbcc71c24128fb454d1fc39ab

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.huynhanhdung.com/kna/

Decoy

lawrencefiredepartment.com

executivehomeoffices.com

solfed.world

oshawaexchange.com

webdavlexstore.com

youpieb.com

chiller-master.com

bearstoragetn.com

daf90x16.com

gewhacaalouine.com

simplyezi.com

cstechnologyservices.com

nosyboats.com

thecocomarie.com

vetinaryeco.club

americangoselfilm.com

gdsuhejia.com

verbunden-sein.net

the-minerva.com

loctrantv.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1000-11-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral2/memory/1000-12-0x000000000041EAB0-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

0d6dc87e3f4948bdedf40980ac0f8f30.exe

description pid process target process

PID 3988 set thread context of 1000 3988 0d6dc87e3f4948bdedf40980ac0f8f30.exe 0d6dc87e3f4948bdedf40980ac0f8f30.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

0d6dc87e3f4948bdedf40980ac0f8f30.exe

pid process

1000 0d6dc87e3f4948bdedf40980ac0f8f30.exe
1000 0d6dc87e3f4948bdedf40980ac0f8f30.exe

description	pid	process	target process
PID 3988 set thread context of 1000	3988	0d6dc87e3f4948bdedf40980ac0f8f30.exe	0d6dc87e3f4948bdedf40980ac0f8f30.exe

pid	process
1000	0d6dc87e3f4948bdedf40980ac0f8f30.exe
1000	0d6dc87e3f4948bdedf40980ac0f8f30.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

0d6dc87e3f4948bdedf40980ac0f8f30.exe

description	pid	process	target process
PID 3988 wrote to memory of 1000	3988	0d6dc87e3f4948bdedf40980ac0f8f30.exe	0d6dc87e3f4948bdedf40980ac0f8f30.exe
PID 3988 wrote to memory of 1000	3988	0d6dc87e3f4948bdedf40980ac0f8f30.exe	0d6dc87e3f4948bdedf40980ac0f8f30.exe
PID 3988 wrote to memory of 1000	3988	0d6dc87e3f4948bdedf40980ac0f8f30.exe	0d6dc87e3f4948bdedf40980ac0f8f30.exe
PID 3988 wrote to memory of 1000	3988	0d6dc87e3f4948bdedf40980ac0f8f30.exe	0d6dc87e3f4948bdedf40980ac0f8f30.exe
PID 3988 wrote to memory of 1000	3988	0d6dc87e3f4948bdedf40980ac0f8f30.exe	0d6dc87e3f4948bdedf40980ac0f8f30.exe
PID 3988 wrote to memory of 1000	3988	0d6dc87e3f4948bdedf40980ac0f8f30.exe	0d6dc87e3f4948bdedf40980ac0f8f30.exe

C:\Users\Admin\AppData\Local\Temp\0d6dc87e3f4948bdedf40980ac0f8f30.exe
"C:\Users\Admin\AppData\Local\Temp\0d6dc87e3f4948bdedf40980ac0f8f30.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3988

C:\Users\Admin\AppData\Local\Temp\0d6dc87e3f4948bdedf40980ac0f8f30.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1000

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1000-11-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1000-12-0x000000000041EAB0-mapping.dmp

Download
memory/3988-2-0x00000000738E0000-0x0000000073FCE000-memory.dmp

Filesize
6.9MB

Download
memory/3988-3-0x0000000000900000-0x0000000000901000-memory.dmp

Filesize
4KB

Download
memory/3988-5-0x0000000005650000-0x0000000005651000-memory.dmp

Filesize
4KB

Download
memory/3988-6-0x00000000051F0000-0x00000000051F1000-memory.dmp

Filesize
4KB

Download
memory/3988-7-0x0000000005360000-0x0000000005361000-memory.dmp

Filesize
4KB

Download
memory/3988-8-0x00000000053E0000-0x00000000053EE000-memory.dmp

Filesize
56KB

Download
memory/3988-9-0x0000000005F20000-0x0000000005FA5000-memory.dmp

Filesize
532KB

Download
memory/3988-10-0x0000000006060000-0x0000000006061000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing