formbook | cf5a2454c16d739c04939e84f71d62772620f7d0f90df49266e8493393da7167

General

Target

15012021546.exe
Size

893KB
MD5

85c2653a529637c000fa5ac67665dcb3
SHA1

a04c8cf5f68a0f2e5f40f5632fbbbcdaf6811cb1
SHA256

cf5a2454c16d739c04939e84f71d62772620f7d0f90df49266e8493393da7167
SHA512

79d5783b74389ded2c2189f93be15d897794978637ef124c6ab7f12e9c72a1f4a84f48853f24d4f06afc23660c79ea1adf683c7d770fa697e6adc00933ab0ff6

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.southsideflooringcreations.com/dkk/

Decoy

goldenfarmm.com

miproper.com

theutahan.com

efeteenerji.com

wellfarehealth.com

setricoo.com

enjoyablephotobooths.com

semaindustrial.com

jennywet.com

jackhughesart.com

cantgetryte.com

searko.com

zxrxhuny.icu

exoticorganicwine.com

fordexplorerproblems.com

locationwebtv.net

elinvoimainenperhe.com

mundoclik.com

nouvellenormale.com

talasnakliyat.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/524-7-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/524-8-0x000000000041EC00-mapping.dmp	formbook
behavioral1/memory/344-9-0x0000000000000000-mapping.dmp	formbook

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

568 cmd.exe

pid	process
568	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

15012021546.exe15012021546.execolorcpl.exe

description	pid	process	target process
PID 108 set thread context of 524	108	15012021546.exe	15012021546.exe
PID 524 set thread context of 1232	524	15012021546.exe	Explorer.EXE
PID 344 set thread context of 1232	344	colorcpl.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 17 IoCs

Processes:

15012021546.execolorcpl.exe

pid	process
524	15012021546.exe
524	15012021546.exe
344	colorcpl.exe
344	colorcpl.exe
344	colorcpl.exe
344	colorcpl.exe
344	colorcpl.exe
344	colorcpl.exe
344	colorcpl.exe
344	colorcpl.exe
344	colorcpl.exe
344	colorcpl.exe
344	colorcpl.exe
344	colorcpl.exe
344	colorcpl.exe
344	colorcpl.exe
344	colorcpl.exe

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

15012021546.execolorcpl.exe

pid process

524 15012021546.exe
524 15012021546.exe
524 15012021546.exe
344 colorcpl.exe
344 colorcpl.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

15012021546.execolorcpl.exe

description pid process

Token: SeDebugPrivilege 524 15012021546.exe
Token: SeDebugPrivilege 344 colorcpl.exe

description	pid	process
Token: SeDebugPrivilege	524	15012021546.exe
Token: SeDebugPrivilege	344	colorcpl.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

15012021546.exeExplorer.EXEcolorcpl.exe

description	pid	process	target process
PID 108 wrote to memory of 524	108	15012021546.exe	15012021546.exe
PID 108 wrote to memory of 524	108	15012021546.exe	15012021546.exe
PID 108 wrote to memory of 524	108	15012021546.exe	15012021546.exe
PID 108 wrote to memory of 524	108	15012021546.exe	15012021546.exe
PID 108 wrote to memory of 524	108	15012021546.exe	15012021546.exe
PID 108 wrote to memory of 524	108	15012021546.exe	15012021546.exe
PID 108 wrote to memory of 524	108	15012021546.exe	15012021546.exe
PID 1232 wrote to memory of 344	1232	Explorer.EXE	colorcpl.exe
PID 1232 wrote to memory of 344	1232	Explorer.EXE	colorcpl.exe
PID 1232 wrote to memory of 344	1232	Explorer.EXE	colorcpl.exe
PID 1232 wrote to memory of 344	1232	Explorer.EXE	colorcpl.exe
PID 344 wrote to memory of 568	344	colorcpl.exe	cmd.exe
PID 344 wrote to memory of 568	344	colorcpl.exe	cmd.exe
PID 344 wrote to memory of 568	344	colorcpl.exe	cmd.exe
PID 344 wrote to memory of 568	344	colorcpl.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:1232

C:\Users\Admin\AppData\Local\Temp\15012021546.exe
"C:\Users\Admin\AppData\Local\Temp\15012021546.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:108

C:\Users\Admin\AppData\Local\Temp\15012021546.exe
"C:\Users\Admin\AppData\Local\Temp\15012021546.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:524

C:\Windows\SysWOW64\colorcpl.exe
"C:\Windows\SysWOW64\colorcpl.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:344

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\15012021546.exe"
3⤵
- Deletes itself
PID:568

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/108-2-0x00000000740C0000-0x00000000747AE000-memory.dmp

Filesize
6.9MB

Download
memory/108-3-0x0000000000E30000-0x0000000000E31000-memory.dmp

Filesize
4KB

Download
memory/108-5-0x0000000000390000-0x00000000003A2000-memory.dmp

Filesize
72KB

Download
memory/108-6-0x0000000004E80000-0x0000000004EE6000-memory.dmp

Filesize
408KB

Download
memory/344-9-0x0000000000000000-mapping.dmp

Download
memory/344-10-0x0000000000B20000-0x0000000000B38000-memory.dmp

Filesize
96KB

Download
memory/344-12-0x0000000001F40000-0x0000000002058000-memory.dmp

Filesize
1.1MB

Download
memory/524-7-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/524-8-0x000000000041EC00-mapping.dmp

Download
memory/568-11-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads