formbook | 7a0468a1843e1d6b3e6ad5bdb9f3e1ad2131349fbaf0ac9737f212bca59ce783

General

Target

Paid Invoices_pdf.exe
Size

738KB
MD5

0326b2ad0ec402ad9421d6dbb1d4b93e
SHA1

f52d2a7b483499334ce084671b874ee3ad921511
SHA256

7a0468a1843e1d6b3e6ad5bdb9f3e1ad2131349fbaf0ac9737f212bca59ce783
SHA512

fee6512b00c39a93f5aeb88d9fa6ccd96c2d8bdf6d1bfb53924e5dc002e2b450dd9028dcd9633ae0aa58bab036834d70ae74f1913009e8e092fe0ef02474a159

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.transparentpetcrate.com/lnb/

Decoy

sauschwein.info

ywpntv.com

gironbeautysalon.online

cryptogeekstuff.com

leosrock.com

sistersv.space

ilss.life

vshuzi.com

europeanculinarymagic.com

mdtlalab.com

boletasenorden.com

eebushe11.com

sms8888.com

arrogantjerxs.com

aboudmotors.com

vzuels.com

searko.com

thathealthysoul.com

365wt38493984284.com

solarpanelsystemflorida.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/284-7-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/284-8-0x000000000041EBA0-mapping.dmp	formbook
behavioral1/memory/268-9-0x0000000000000000-mapping.dmp	formbook

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1468 cmd.exe

pid	process
1468	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

Paid Invoices_pdf.exePaid Invoices_pdf.exewuapp.exe

description	pid	process	target process
PID 784 set thread context of 284	784	Paid Invoices_pdf.exe	Paid Invoices_pdf.exe
PID 284 set thread context of 1268	284	Paid Invoices_pdf.exe	Explorer.EXE
PID 268 set thread context of 1268	268	wuapp.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

Paid Invoices_pdf.exewuapp.exe

pid	process
284	Paid Invoices_pdf.exe
284	Paid Invoices_pdf.exe
268	wuapp.exe
268	wuapp.exe
268	wuapp.exe
268	wuapp.exe
268	wuapp.exe
268	wuapp.exe
268	wuapp.exe
268	wuapp.exe
268	wuapp.exe
268	wuapp.exe
268	wuapp.exe
268	wuapp.exe
268	wuapp.exe
268	wuapp.exe
268	wuapp.exe
268	wuapp.exe
268	wuapp.exe
268	wuapp.exe

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

Paid Invoices_pdf.exewuapp.exe

pid process

284 Paid Invoices_pdf.exe
284 Paid Invoices_pdf.exe
284 Paid Invoices_pdf.exe
268 wuapp.exe
268 wuapp.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Paid Invoices_pdf.exewuapp.exe

description pid process

Token: SeDebugPrivilege 284 Paid Invoices_pdf.exe
Token: SeDebugPrivilege 268 wuapp.exe
Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

Explorer.EXE

pid process

1268 Explorer.EXE
1268 Explorer.EXE
1268 Explorer.EXE
1268 Explorer.EXE
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

Explorer.EXE

pid process

1268 Explorer.EXE
1268 Explorer.EXE
1268 Explorer.EXE
1268 Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	284	Paid Invoices_pdf.exe
Token: SeDebugPrivilege	268	wuapp.exe

pid	process
1268	Explorer.EXE
1268	Explorer.EXE
1268	Explorer.EXE
1268	Explorer.EXE

pid	process
1268	Explorer.EXE
1268	Explorer.EXE
1268	Explorer.EXE
1268	Explorer.EXE

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

Paid Invoices_pdf.exeExplorer.EXEwuapp.exe

description	pid	process	target process
PID 784 wrote to memory of 284	784	Paid Invoices_pdf.exe	Paid Invoices_pdf.exe
PID 784 wrote to memory of 284	784	Paid Invoices_pdf.exe	Paid Invoices_pdf.exe
PID 784 wrote to memory of 284	784	Paid Invoices_pdf.exe	Paid Invoices_pdf.exe
PID 784 wrote to memory of 284	784	Paid Invoices_pdf.exe	Paid Invoices_pdf.exe
PID 784 wrote to memory of 284	784	Paid Invoices_pdf.exe	Paid Invoices_pdf.exe
PID 784 wrote to memory of 284	784	Paid Invoices_pdf.exe	Paid Invoices_pdf.exe
PID 784 wrote to memory of 284	784	Paid Invoices_pdf.exe	Paid Invoices_pdf.exe
PID 1268 wrote to memory of 268	1268	Explorer.EXE	wuapp.exe
PID 1268 wrote to memory of 268	1268	Explorer.EXE	wuapp.exe
PID 1268 wrote to memory of 268	1268	Explorer.EXE	wuapp.exe
PID 1268 wrote to memory of 268	1268	Explorer.EXE	wuapp.exe
PID 1268 wrote to memory of 268	1268	Explorer.EXE	wuapp.exe
PID 1268 wrote to memory of 268	1268	Explorer.EXE	wuapp.exe
PID 1268 wrote to memory of 268	1268	Explorer.EXE	wuapp.exe
PID 268 wrote to memory of 1468	268	wuapp.exe	cmd.exe
PID 268 wrote to memory of 1468	268	wuapp.exe	cmd.exe
PID 268 wrote to memory of 1468	268	wuapp.exe	cmd.exe
PID 268 wrote to memory of 1468	268	wuapp.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1268

C:\Users\Admin\AppData\Local\Temp\Paid Invoices_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Paid Invoices_pdf.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:784

C:\Users\Admin\AppData\Local\Temp\Paid Invoices_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Paid Invoices_pdf.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:284

C:\Windows\SysWOW64\wuapp.exe
"C:\Windows\SysWOW64\wuapp.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:268

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\Paid Invoices_pdf.exe"
3⤵
- Deletes itself
PID:1468

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/268-9-0x0000000000000000-mapping.dmp

Download
memory/268-10-0x0000000000EB0000-0x0000000000EBB000-memory.dmp

Filesize
44KB

Download
memory/268-12-0x00000000009B0000-0x0000000000A86000-memory.dmp

Filesize
856KB

Download
memory/284-7-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/284-8-0x000000000041EBA0-mapping.dmp

Download
memory/784-2-0x00000000748A0000-0x0000000074F8E000-memory.dmp

Filesize
6.9MB

Download
memory/784-3-0x00000000000D0000-0x00000000000D1000-memory.dmp

Filesize
4KB

Download
memory/784-5-0x0000000004530000-0x0000000004542000-memory.dmp

Filesize
72KB

Download
memory/784-6-0x0000000005460000-0x00000000054C6000-memory.dmp

Filesize
408KB

Download
memory/1468-11-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads