formbook | 7a0468a1843e1d6b3e6ad5bdb9f3e1ad2131349fbaf0ac9737f212bca59ce783

General

Target

Paid Invoices_pdf.exe
Size

738KB
MD5

0326b2ad0ec402ad9421d6dbb1d4b93e
SHA1

f52d2a7b483499334ce084671b874ee3ad921511
SHA256

7a0468a1843e1d6b3e6ad5bdb9f3e1ad2131349fbaf0ac9737f212bca59ce783
SHA512

fee6512b00c39a93f5aeb88d9fa6ccd96c2d8bdf6d1bfb53924e5dc002e2b450dd9028dcd9633ae0aa58bab036834d70ae74f1913009e8e092fe0ef02474a159

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.transparentpetcrate.com/lnb/

Decoy

sauschwein.info

ywpntv.com

gironbeautysalon.online

cryptogeekstuff.com

leosrock.com

sistersv.space

ilss.life

vshuzi.com

europeanculinarymagic.com

mdtlalab.com

boletasenorden.com

eebushe11.com

sms8888.com

arrogantjerxs.com

aboudmotors.com

vzuels.com

searko.com

thathealthysoul.com

365wt38493984284.com

solarpanelsystemflorida.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/452-12-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral2/memory/452-13-0x000000000041EBA0-mapping.dmp	formbook
behavioral2/memory/680-15-0x0000000000000000-mapping.dmp	formbook

Suspicious use of SetThreadContext 3 IoCs

Processes:

Paid Invoices_pdf.exePaid Invoices_pdf.execolorcpl.exe

description	pid	process	target process
PID 4804 set thread context of 452	4804	Paid Invoices_pdf.exe	Paid Invoices_pdf.exe
PID 452 set thread context of 3152	452	Paid Invoices_pdf.exe	Explorer.EXE
PID 680 set thread context of 3152	680	colorcpl.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 42 IoCs

Processes:

Paid Invoices_pdf.exePaid Invoices_pdf.execolorcpl.exe

pid	process
4804	Paid Invoices_pdf.exe
4804	Paid Invoices_pdf.exe
452	Paid Invoices_pdf.exe
452	Paid Invoices_pdf.exe
452	Paid Invoices_pdf.exe
452	Paid Invoices_pdf.exe
680	colorcpl.exe
680	colorcpl.exe
680	colorcpl.exe
680	colorcpl.exe
680	colorcpl.exe
680	colorcpl.exe
680	colorcpl.exe
680	colorcpl.exe
680	colorcpl.exe
680	colorcpl.exe
680	colorcpl.exe
680	colorcpl.exe
680	colorcpl.exe
680	colorcpl.exe
680	colorcpl.exe
680	colorcpl.exe
680	colorcpl.exe
680	colorcpl.exe
680	colorcpl.exe
680	colorcpl.exe
680	colorcpl.exe
680	colorcpl.exe
680	colorcpl.exe
680	colorcpl.exe
680	colorcpl.exe
680	colorcpl.exe
680	colorcpl.exe
680	colorcpl.exe
680	colorcpl.exe
680	colorcpl.exe
680	colorcpl.exe
680	colorcpl.exe
680	colorcpl.exe
680	colorcpl.exe
680	colorcpl.exe
680	colorcpl.exe

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

Paid Invoices_pdf.execolorcpl.exe

pid process

452 Paid Invoices_pdf.exe
452 Paid Invoices_pdf.exe
452 Paid Invoices_pdf.exe
680 colorcpl.exe
680 colorcpl.exe

pid	process
452	Paid Invoices_pdf.exe
452	Paid Invoices_pdf.exe
452	Paid Invoices_pdf.exe
680	colorcpl.exe
680	colorcpl.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

Paid Invoices_pdf.exePaid Invoices_pdf.execolorcpl.exe

description	pid	process
Token: SeDebugPrivilege	4804	Paid Invoices_pdf.exe
Token: SeDebugPrivilege	452	Paid Invoices_pdf.exe
Token: SeDebugPrivilege	680	colorcpl.exe

Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

3152 Explorer.EXE

pid	process
3152	Explorer.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

Paid Invoices_pdf.exeExplorer.EXEcolorcpl.exe

description	pid	process	target process
PID 4804 wrote to memory of 2604	4804	Paid Invoices_pdf.exe	Paid Invoices_pdf.exe
PID 4804 wrote to memory of 2604	4804	Paid Invoices_pdf.exe	Paid Invoices_pdf.exe
PID 4804 wrote to memory of 2604	4804	Paid Invoices_pdf.exe	Paid Invoices_pdf.exe
PID 4804 wrote to memory of 452	4804	Paid Invoices_pdf.exe	Paid Invoices_pdf.exe
PID 4804 wrote to memory of 452	4804	Paid Invoices_pdf.exe	Paid Invoices_pdf.exe
PID 4804 wrote to memory of 452	4804	Paid Invoices_pdf.exe	Paid Invoices_pdf.exe
PID 4804 wrote to memory of 452	4804	Paid Invoices_pdf.exe	Paid Invoices_pdf.exe
PID 4804 wrote to memory of 452	4804	Paid Invoices_pdf.exe	Paid Invoices_pdf.exe
PID 4804 wrote to memory of 452	4804	Paid Invoices_pdf.exe	Paid Invoices_pdf.exe
PID 3152 wrote to memory of 680	3152	Explorer.EXE	colorcpl.exe
PID 3152 wrote to memory of 680	3152	Explorer.EXE	colorcpl.exe
PID 3152 wrote to memory of 680	3152	Explorer.EXE	colorcpl.exe
PID 680 wrote to memory of 1008	680	colorcpl.exe	cmd.exe
PID 680 wrote to memory of 1008	680	colorcpl.exe	cmd.exe
PID 680 wrote to memory of 1008	680	colorcpl.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3152

C:\Users\Admin\AppData\Local\Temp\Paid Invoices_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Paid Invoices_pdf.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4804

C:\Users\Admin\AppData\Local\Temp\Paid Invoices_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Paid Invoices_pdf.exe"
3⤵
PID:2604

C:\Users\Admin\AppData\Local\Temp\Paid Invoices_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Paid Invoices_pdf.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:452

C:\Windows\SysWOW64\colorcpl.exe
"C:\Windows\SysWOW64\colorcpl.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:680

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\Paid Invoices_pdf.exe"
3⤵
PID:1008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/452-12-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/452-13-0x000000000041EBA0-mapping.dmp

Download
memory/680-17-0x0000000000B00000-0x0000000000B19000-memory.dmp

Filesize
100KB

Download
memory/680-16-0x0000000000B00000-0x0000000000B19000-memory.dmp

Filesize
100KB

Download
memory/680-15-0x0000000000000000-mapping.dmp

Download
memory/1008-18-0x0000000000000000-mapping.dmp

Download
memory/4804-6-0x00000000057A0000-0x00000000057A1000-memory.dmp

Filesize
4KB

Download
memory/4804-10-0x00000000054E0000-0x00000000054F2000-memory.dmp

Filesize
72KB

Download
memory/4804-11-0x0000000005F20000-0x0000000005F86000-memory.dmp

Filesize
408KB

Download
memory/4804-9-0x0000000005480000-0x0000000005481000-memory.dmp

Filesize
4KB

Download
memory/4804-8-0x00000000051B0000-0x00000000051B1000-memory.dmp

Filesize
4KB

Download
memory/4804-7-0x00000000052A0000-0x00000000052A1000-memory.dmp

Filesize
4KB

Download
memory/4804-2-0x00000000739D0000-0x00000000740BE000-memory.dmp

Filesize
6.9MB

Download
memory/4804-5-0x0000000005200000-0x0000000005201000-memory.dmp

Filesize
4KB

Download
memory/4804-3-0x00000000008D0000-0x00000000008D1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads