formbook | 814c8a7ae9ec48b7a455cdf15b8c520fc9d7695e24f31afd5ff72cbc25e08704

General

Target

ab830be5e48f1db0f4ebf3a106473a32.exe
Size

685KB
MD5

ab830be5e48f1db0f4ebf3a106473a32
SHA1

3a376a9ad849b778b4ef2235616068f221b2e61e
SHA256

814c8a7ae9ec48b7a455cdf15b8c520fc9d7695e24f31afd5ff72cbc25e08704
SHA512

45f5423da5942a549eabfa948c01adadcc2b8cd2d1971936b23d5d230af26986b7fb6e833d68f54ea967f902fec4eacb7a7e6efa37961910c62333ca6ffa17c6

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.waverunner-fan.com/pp2/

Decoy

meredithridenhour.com

foundationsseniormanagement.com

sallyta.com

msmonlinellc.com

entreprisesfr.com

neadclunlounge.com

lexuscarbonfiber.com

electroglas-probers.com

investedgefinancialinc.com

blm.healthcare

workoutmagazinemx.com

edmondsagent.com

rodrigzart.com

standardstripcurtains.com

carrier.email

hifan.info

fhcqtravel.com

legacycream.com

topfurnity.com

solids-development.net

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1660-7-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/1660-8-0x000000000041EBE0-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

ab830be5e48f1db0f4ebf3a106473a32.exe

description pid process target process

PID 648 set thread context of 1660 648 ab830be5e48f1db0f4ebf3a106473a32.exe ab830be5e48f1db0f4ebf3a106473a32.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

ab830be5e48f1db0f4ebf3a106473a32.exe

pid process

1660 ab830be5e48f1db0f4ebf3a106473a32.exe

description	pid	process	target process
PID 648 set thread context of 1660	648	ab830be5e48f1db0f4ebf3a106473a32.exe	ab830be5e48f1db0f4ebf3a106473a32.exe

pid	process
1660	ab830be5e48f1db0f4ebf3a106473a32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

ab830be5e48f1db0f4ebf3a106473a32.exe

description	pid	process	target process
PID 648 wrote to memory of 1660	648	ab830be5e48f1db0f4ebf3a106473a32.exe	ab830be5e48f1db0f4ebf3a106473a32.exe
PID 648 wrote to memory of 1660	648	ab830be5e48f1db0f4ebf3a106473a32.exe	ab830be5e48f1db0f4ebf3a106473a32.exe
PID 648 wrote to memory of 1660	648	ab830be5e48f1db0f4ebf3a106473a32.exe	ab830be5e48f1db0f4ebf3a106473a32.exe
PID 648 wrote to memory of 1660	648	ab830be5e48f1db0f4ebf3a106473a32.exe	ab830be5e48f1db0f4ebf3a106473a32.exe
PID 648 wrote to memory of 1660	648	ab830be5e48f1db0f4ebf3a106473a32.exe	ab830be5e48f1db0f4ebf3a106473a32.exe
PID 648 wrote to memory of 1660	648	ab830be5e48f1db0f4ebf3a106473a32.exe	ab830be5e48f1db0f4ebf3a106473a32.exe
PID 648 wrote to memory of 1660	648	ab830be5e48f1db0f4ebf3a106473a32.exe	ab830be5e48f1db0f4ebf3a106473a32.exe

C:\Users\Admin\AppData\Local\Temp\ab830be5e48f1db0f4ebf3a106473a32.exe
"C:\Users\Admin\AppData\Local\Temp\ab830be5e48f1db0f4ebf3a106473a32.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:648

C:\Users\Admin\AppData\Local\Temp\ab830be5e48f1db0f4ebf3a106473a32.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1660

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/648-2-0x00000000746F0000-0x0000000074DDE000-memory.dmp

Filesize
6.9MB

Download
memory/648-3-0x0000000000800000-0x0000000000801000-memory.dmp

Filesize
4KB

Download
memory/648-5-0x0000000000360000-0x000000000036E000-memory.dmp

Filesize
56KB

Download
memory/648-6-0x0000000005270000-0x0000000005305000-memory.dmp

Filesize
596KB

Download
memory/1660-7-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1660-8-0x000000000041EBE0-mapping.dmp

Download

Analysis

Sharing