formbook | 814c8a7ae9ec48b7a455cdf15b8c520fc9d7695e24f31afd5ff72cbc25e08704

General

Target

ab830be5e48f1db0f4ebf3a106473a32.exe
Size

685KB
MD5

ab830be5e48f1db0f4ebf3a106473a32
SHA1

3a376a9ad849b778b4ef2235616068f221b2e61e
SHA256

814c8a7ae9ec48b7a455cdf15b8c520fc9d7695e24f31afd5ff72cbc25e08704
SHA512

45f5423da5942a549eabfa948c01adadcc2b8cd2d1971936b23d5d230af26986b7fb6e833d68f54ea967f902fec4eacb7a7e6efa37961910c62333ca6ffa17c6

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.waverunner-fan.com/pp2/

Decoy

meredithridenhour.com

foundationsseniormanagement.com

sallyta.com

msmonlinellc.com

entreprisesfr.com

neadclunlounge.com

lexuscarbonfiber.com

electroglas-probers.com

investedgefinancialinc.com

blm.healthcare

workoutmagazinemx.com

edmondsagent.com

rodrigzart.com

standardstripcurtains.com

carrier.email

hifan.info

fhcqtravel.com

legacycream.com

topfurnity.com

solids-development.net

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2236-11-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral2/memory/2236-12-0x000000000041EBE0-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

ab830be5e48f1db0f4ebf3a106473a32.exe

description pid process target process

PID 4052 set thread context of 2236 4052 ab830be5e48f1db0f4ebf3a106473a32.exe ab830be5e48f1db0f4ebf3a106473a32.exe

description	pid	process	target process
PID 4052 set thread context of 2236	4052	ab830be5e48f1db0f4ebf3a106473a32.exe	ab830be5e48f1db0f4ebf3a106473a32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

ab830be5e48f1db0f4ebf3a106473a32.exeab830be5e48f1db0f4ebf3a106473a32.exe

pid	process
4052	ab830be5e48f1db0f4ebf3a106473a32.exe
4052	ab830be5e48f1db0f4ebf3a106473a32.exe
2236	ab830be5e48f1db0f4ebf3a106473a32.exe
2236	ab830be5e48f1db0f4ebf3a106473a32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ab830be5e48f1db0f4ebf3a106473a32.exe

description pid process

Token: SeDebugPrivilege 4052 ab830be5e48f1db0f4ebf3a106473a32.exe

description	pid	process
Token: SeDebugPrivilege	4052	ab830be5e48f1db0f4ebf3a106473a32.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

ab830be5e48f1db0f4ebf3a106473a32.exe

description	pid	process	target process
PID 4052 wrote to memory of 3292	4052	ab830be5e48f1db0f4ebf3a106473a32.exe	ab830be5e48f1db0f4ebf3a106473a32.exe
PID 4052 wrote to memory of 3292	4052	ab830be5e48f1db0f4ebf3a106473a32.exe	ab830be5e48f1db0f4ebf3a106473a32.exe
PID 4052 wrote to memory of 3292	4052	ab830be5e48f1db0f4ebf3a106473a32.exe	ab830be5e48f1db0f4ebf3a106473a32.exe
PID 4052 wrote to memory of 2236	4052	ab830be5e48f1db0f4ebf3a106473a32.exe	ab830be5e48f1db0f4ebf3a106473a32.exe
PID 4052 wrote to memory of 2236	4052	ab830be5e48f1db0f4ebf3a106473a32.exe	ab830be5e48f1db0f4ebf3a106473a32.exe
PID 4052 wrote to memory of 2236	4052	ab830be5e48f1db0f4ebf3a106473a32.exe	ab830be5e48f1db0f4ebf3a106473a32.exe
PID 4052 wrote to memory of 2236	4052	ab830be5e48f1db0f4ebf3a106473a32.exe	ab830be5e48f1db0f4ebf3a106473a32.exe
PID 4052 wrote to memory of 2236	4052	ab830be5e48f1db0f4ebf3a106473a32.exe	ab830be5e48f1db0f4ebf3a106473a32.exe
PID 4052 wrote to memory of 2236	4052	ab830be5e48f1db0f4ebf3a106473a32.exe	ab830be5e48f1db0f4ebf3a106473a32.exe

C:\Users\Admin\AppData\Local\Temp\ab830be5e48f1db0f4ebf3a106473a32.exe
"C:\Users\Admin\AppData\Local\Temp\ab830be5e48f1db0f4ebf3a106473a32.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4052

C:\Users\Admin\AppData\Local\Temp\ab830be5e48f1db0f4ebf3a106473a32.exe
"{path}"
2⤵
PID:3292

C:\Users\Admin\AppData\Local\Temp\ab830be5e48f1db0f4ebf3a106473a32.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2236

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2236-11-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2236-12-0x000000000041EBE0-mapping.dmp

Download
memory/4052-2-0x0000000073820000-0x0000000073F0E000-memory.dmp

Filesize
6.9MB

Download
memory/4052-3-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download
memory/4052-5-0x0000000004F90000-0x0000000004F91000-memory.dmp

Filesize
4KB

Download
memory/4052-6-0x0000000004B30000-0x0000000004B31000-memory.dmp

Filesize
4KB

Download
memory/4052-7-0x0000000004AA0000-0x0000000004AA1000-memory.dmp

Filesize
4KB

Download
memory/4052-8-0x0000000004D80000-0x0000000004D8E000-memory.dmp

Filesize
56KB

Download
memory/4052-9-0x0000000007050000-0x00000000070E5000-memory.dmp

Filesize
596KB

Download
memory/4052-10-0x0000000007190000-0x0000000007191000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads