formbook | 7fea4608a3f80e3b819a0564f80412183f772fed84f1323bcd7b931d1af4260a

General

Target

df8503902c4c7ed20ed1f9e6f9783e75.exe
Size

901KB
MD5

df8503902c4c7ed20ed1f9e6f9783e75
SHA1

2e81fa37efc74062d61dba361fda88a6f60e19eb
SHA256

7fea4608a3f80e3b819a0564f80412183f772fed84f1323bcd7b931d1af4260a
SHA512

fb1c9933e2d4f6e5a18b23164ef6268cb5f65332544af2256dc2809507ea2153b9ecf20463da70719fef99a8e9e58ab4c19963410f5ab68f57be494c8558f16f

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.theatomicshots.com/xle/

Decoy

tknbr.com

loyaloneconstruction.com

what-where.com

matebacapital.com

marriedandmore.com

qiemfsolutions.com

graececonsulting.com

www7456.com

littlefreecherokeelibrary.com

tailgatepawkinglot.com

musheet.com

tesfamariamtb.com

1728025.com

xceltechuae.com

harperandchloe.com

thepamperedbarber.com

5050alberta.com

supplychainstrainer.com

lacorte.group

ringingbear.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/268-8-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/268-9-0x000000000041EB90-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

df8503902c4c7ed20ed1f9e6f9783e75.exe

description pid process target process

PID 1652 set thread context of 268 1652 df8503902c4c7ed20ed1f9e6f9783e75.exe df8503902c4c7ed20ed1f9e6f9783e75.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

df8503902c4c7ed20ed1f9e6f9783e75.exe

pid process

268 df8503902c4c7ed20ed1f9e6f9783e75.exe

description	pid	process	target process
PID 1652 set thread context of 268	1652	df8503902c4c7ed20ed1f9e6f9783e75.exe	df8503902c4c7ed20ed1f9e6f9783e75.exe

pid	process
268	df8503902c4c7ed20ed1f9e6f9783e75.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

df8503902c4c7ed20ed1f9e6f9783e75.exe

description	pid	process	target process
PID 1652 wrote to memory of 268	1652	df8503902c4c7ed20ed1f9e6f9783e75.exe	df8503902c4c7ed20ed1f9e6f9783e75.exe
PID 1652 wrote to memory of 268	1652	df8503902c4c7ed20ed1f9e6f9783e75.exe	df8503902c4c7ed20ed1f9e6f9783e75.exe
PID 1652 wrote to memory of 268	1652	df8503902c4c7ed20ed1f9e6f9783e75.exe	df8503902c4c7ed20ed1f9e6f9783e75.exe
PID 1652 wrote to memory of 268	1652	df8503902c4c7ed20ed1f9e6f9783e75.exe	df8503902c4c7ed20ed1f9e6f9783e75.exe
PID 1652 wrote to memory of 268	1652	df8503902c4c7ed20ed1f9e6f9783e75.exe	df8503902c4c7ed20ed1f9e6f9783e75.exe
PID 1652 wrote to memory of 268	1652	df8503902c4c7ed20ed1f9e6f9783e75.exe	df8503902c4c7ed20ed1f9e6f9783e75.exe
PID 1652 wrote to memory of 268	1652	df8503902c4c7ed20ed1f9e6f9783e75.exe	df8503902c4c7ed20ed1f9e6f9783e75.exe

C:\Users\Admin\AppData\Local\Temp\df8503902c4c7ed20ed1f9e6f9783e75.exe
"C:\Users\Admin\AppData\Local\Temp\df8503902c4c7ed20ed1f9e6f9783e75.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1652

C:\Users\Admin\AppData\Local\Temp\df8503902c4c7ed20ed1f9e6f9783e75.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:268

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/268-8-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/268-9-0x000000000041EB90-mapping.dmp

Download
memory/268-11-0x0000000000930000-0x0000000000C33000-memory.dmp

Filesize
3.0MB

Download
memory/1652-2-0x0000000074710000-0x0000000074DFE000-memory.dmp

Filesize
6.9MB

Download
memory/1652-3-0x00000000013D0000-0x00000000013D1000-memory.dmp

Filesize
4KB

Download
memory/1652-5-0x0000000004D10000-0x0000000004D11000-memory.dmp

Filesize
4KB

Download
memory/1652-6-0x0000000000530000-0x000000000053E000-memory.dmp

Filesize
56KB

Download
memory/1652-7-0x0000000000E90000-0x0000000000EE9000-memory.dmp

Filesize
356KB

Download

Analysis

Sharing