formbook | 9e98384954932a0a9e5f921f257029bf45f721b0d279c8432c4eb5f1bf507795

General

Target

RFV9099311042.exe
Size

311KB
MD5

eddf5707efb09aae5b194cb84db89374
SHA1

0cdf475a4766967164ffd6b61cbf95ab49b9d6b2
SHA256

9e98384954932a0a9e5f921f257029bf45f721b0d279c8432c4eb5f1bf507795
SHA512

64518ffe185be330d358b077bd0082ba956d7d3aab2b1196c96f4697362f5492de1e670372674b94e457d0e419af1178337a394085fd34bca36ae5d8d54134ac

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.unitvn.com/krc/

Decoy

grayfoxden.com

drupadhyayashomoeopathy.com

coordinatedcare-ok.com

the-legend-update3.com

remoteworkoffer.com

r3dprojects.com

banhuaihangschool.com

7852bigbucktrail.info

villagepizzafloralpark.com

sgtradingusa.com

evolvestephanieperreault.com

timelessbeautylessons.com

monkeytrivia.com

bsf.xyz

canda.design

recetasnutribullet.com

olenfex.com

catatan-matematika.com

roeltecnologiadigital.com

jutoxnatural.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/836-2-0x0000000000070000-0x000000000009E000-memory.dmp	formbook
behavioral1/memory/836-3-0x000000000008EB60-mapping.dmp	formbook
behavioral1/memory/1616-4-0x0000000000130000-0x0000000000155000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

RFV9099311042.exe

description pid process target process

PID 1616 set thread context of 836 1616 RFV9099311042.exe RFV9099311042.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1308 836 WerFault.exe RFV9099311042.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1308 WerFault.exe
1308 WerFault.exe
1308 WerFault.exe
1308 WerFault.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

RFV9099311042.exe

pid process

1616 RFV9099311042.exe
1616 RFV9099311042.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1308 WerFault.exe

description	pid	process	target process
PID 1616 set thread context of 836	1616	RFV9099311042.exe	RFV9099311042.exe

pid	pid_target	process	target process
1308	836	WerFault.exe	RFV9099311042.exe

pid	process
1308	WerFault.exe
1308	WerFault.exe
1308	WerFault.exe
1308	WerFault.exe

pid	process
1616	RFV9099311042.exe
1616	RFV9099311042.exe

description	pid	process
Token: SeDebugPrivilege	1308	WerFault.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

RFV9099311042.exeRFV9099311042.exe

description	pid	process	target process
PID 1616 wrote to memory of 836	1616	RFV9099311042.exe	RFV9099311042.exe
PID 1616 wrote to memory of 836	1616	RFV9099311042.exe	RFV9099311042.exe
PID 1616 wrote to memory of 836	1616	RFV9099311042.exe	RFV9099311042.exe
PID 1616 wrote to memory of 836	1616	RFV9099311042.exe	RFV9099311042.exe
PID 1616 wrote to memory of 836	1616	RFV9099311042.exe	RFV9099311042.exe
PID 836 wrote to memory of 1308	836	RFV9099311042.exe	WerFault.exe
PID 836 wrote to memory of 1308	836	RFV9099311042.exe	WerFault.exe
PID 836 wrote to memory of 1308	836	RFV9099311042.exe	WerFault.exe
PID 836 wrote to memory of 1308	836	RFV9099311042.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\RFV9099311042.exe
"C:\Users\Admin\AppData\Local\Temp\RFV9099311042.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1616

C:\Users\Admin\AppData\Local\Temp\RFV9099311042.exe
"C:\Users\Admin\AppData\Local\Temp\RFV9099311042.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 836 -s 36
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1308

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/836-2-0x0000000000070000-0x000000000009E000-memory.dmp

Filesize
184KB

Download
memory/836-3-0x000000000008EB60-mapping.dmp

Download
memory/1308-5-0x0000000000000000-mapping.dmp

Download
memory/1308-6-0x0000000002230000-0x0000000002241000-memory.dmp

Filesize
68KB

Download
memory/1308-7-0x00000000026B0000-0x00000000026C1000-memory.dmp

Filesize
68KB

Download
memory/1616-4-0x0000000000130000-0x0000000000155000-memory.dmp

Filesize
148KB

Download

Analysis

Sharing