formbook | 9e98384954932a0a9e5f921f257029bf45f721b0d279c8432c4eb5f1bf507795

General

Target

RFV9099311042.exe
Size

311KB
MD5

eddf5707efb09aae5b194cb84db89374
SHA1

0cdf475a4766967164ffd6b61cbf95ab49b9d6b2
SHA256

9e98384954932a0a9e5f921f257029bf45f721b0d279c8432c4eb5f1bf507795
SHA512

64518ffe185be330d358b077bd0082ba956d7d3aab2b1196c96f4697362f5492de1e670372674b94e457d0e419af1178337a394085fd34bca36ae5d8d54134ac

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.unitvn.com/krc/

Decoy

grayfoxden.com

drupadhyayashomoeopathy.com

coordinatedcare-ok.com

the-legend-update3.com

remoteworkoffer.com

r3dprojects.com

banhuaihangschool.com

7852bigbucktrail.info

villagepizzafloralpark.com

sgtradingusa.com

evolvestephanieperreault.com

timelessbeautylessons.com

monkeytrivia.com

bsf.xyz

canda.design

recetasnutribullet.com

olenfex.com

catatan-matematika.com

roeltecnologiadigital.com

jutoxnatural.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/552-2-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral2/memory/552-3-0x000000000041EB60-mapping.dmp	formbook
behavioral2/memory/3440-5-0x0000000000000000-mapping.dmp	formbook

Suspicious use of SetThreadContext 3 IoCs

Processes:

RFV9099311042.exeRFV9099311042.exewscript.exe

description	pid	process	target process
PID 1316 set thread context of 552	1316	RFV9099311042.exe	RFV9099311042.exe
PID 552 set thread context of 2352	552	RFV9099311042.exe	Explorer.EXE
PID 3440 set thread context of 2352	3440	wscript.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 60 IoCs

Processes:

RFV9099311042.exewscript.exe

pid	process
552	RFV9099311042.exe
552	RFV9099311042.exe
552	RFV9099311042.exe
552	RFV9099311042.exe
3440	wscript.exe
3440	wscript.exe
3440	wscript.exe
3440	wscript.exe
3440	wscript.exe
3440	wscript.exe
3440	wscript.exe
3440	wscript.exe
3440	wscript.exe
3440	wscript.exe
3440	wscript.exe
3440	wscript.exe
3440	wscript.exe
3440	wscript.exe
3440	wscript.exe
3440	wscript.exe
3440	wscript.exe
3440	wscript.exe
3440	wscript.exe
3440	wscript.exe
3440	wscript.exe
3440	wscript.exe
3440	wscript.exe
3440	wscript.exe
3440	wscript.exe
3440	wscript.exe
3440	wscript.exe
3440	wscript.exe
3440	wscript.exe
3440	wscript.exe
3440	wscript.exe
3440	wscript.exe
3440	wscript.exe
3440	wscript.exe
3440	wscript.exe
3440	wscript.exe
3440	wscript.exe
3440	wscript.exe
3440	wscript.exe
3440	wscript.exe
3440	wscript.exe
3440	wscript.exe
3440	wscript.exe
3440	wscript.exe
3440	wscript.exe
3440	wscript.exe
3440	wscript.exe
3440	wscript.exe
3440	wscript.exe
3440	wscript.exe
3440	wscript.exe
3440	wscript.exe
3440	wscript.exe
3440	wscript.exe
3440	wscript.exe
3440	wscript.exe

Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

RFV9099311042.exeRFV9099311042.exewscript.exe

pid process

1316 RFV9099311042.exe
552 RFV9099311042.exe
552 RFV9099311042.exe
552 RFV9099311042.exe
3440 wscript.exe
3440 wscript.exe

pid	process
1316	RFV9099311042.exe
552	RFV9099311042.exe
552	RFV9099311042.exe
552	RFV9099311042.exe
3440	wscript.exe
3440	wscript.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

Processes:

RFV9099311042.exeExplorer.EXEwscript.exe

description	pid	process
Token: SeDebugPrivilege	552	RFV9099311042.exe
Token: SeShutdownPrivilege	2352	Explorer.EXE
Token: SeCreatePagefilePrivilege	2352	Explorer.EXE
Token: SeShutdownPrivilege	2352	Explorer.EXE
Token: SeCreatePagefilePrivilege	2352	Explorer.EXE
Token: SeDebugPrivilege	3440	wscript.exe
Token: SeShutdownPrivilege	2352	Explorer.EXE
Token: SeCreatePagefilePrivilege	2352	Explorer.EXE
Token: SeShutdownPrivilege	2352	Explorer.EXE
Token: SeCreatePagefilePrivilege	2352	Explorer.EXE
Token: SeShutdownPrivilege	2352	Explorer.EXE
Token: SeCreatePagefilePrivilege	2352	Explorer.EXE

Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

2352 Explorer.EXE

pid	process
2352	Explorer.EXE

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

RFV9099311042.exeExplorer.EXEwscript.exe

description	pid	process	target process
PID 1316 wrote to memory of 552	1316	RFV9099311042.exe	RFV9099311042.exe
PID 1316 wrote to memory of 552	1316	RFV9099311042.exe	RFV9099311042.exe
PID 1316 wrote to memory of 552	1316	RFV9099311042.exe	RFV9099311042.exe
PID 1316 wrote to memory of 552	1316	RFV9099311042.exe	RFV9099311042.exe
PID 2352 wrote to memory of 3440	2352	Explorer.EXE	wscript.exe
PID 2352 wrote to memory of 3440	2352	Explorer.EXE	wscript.exe
PID 2352 wrote to memory of 3440	2352	Explorer.EXE	wscript.exe
PID 3440 wrote to memory of 1384	3440	wscript.exe	cmd.exe
PID 3440 wrote to memory of 1384	3440	wscript.exe	cmd.exe
PID 3440 wrote to memory of 1384	3440	wscript.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2352

C:\Users\Admin\AppData\Local\Temp\RFV9099311042.exe
"C:\Users\Admin\AppData\Local\Temp\RFV9099311042.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1316

C:\Users\Admin\AppData\Local\Temp\RFV9099311042.exe
"C:\Users\Admin\AppData\Local\Temp\RFV9099311042.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:552

C:\Windows\SysWOW64\wscript.exe
"C:\Windows\SysWOW64\wscript.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3440

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\RFV9099311042.exe"
3⤵
PID:1384

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/552-2-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/552-3-0x000000000041EB60-mapping.dmp

Download
memory/1384-8-0x0000000000000000-mapping.dmp

Download
memory/3440-5-0x0000000000000000-mapping.dmp

Download
memory/3440-6-0x0000000000C30000-0x0000000000C57000-memory.dmp

Filesize
156KB

Download
memory/3440-7-0x0000000000C30000-0x0000000000C57000-memory.dmp

Filesize
156KB

Download
memory/3440-9-0x0000000005D30000-0x0000000005EAB000-memory.dmp

Filesize
1.5MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads