formbook | 93a1fa9f19e45c921bc4e377c74e666ebcfc5b3dab60efe5e0c7d04438cf1794

General

Target

04d511a27304f93e708f91308d483358.exe
Size

905KB
MD5

04d511a27304f93e708f91308d483358
SHA1

26fe619e23fc98650514b6b032304396860f679b
SHA256

93a1fa9f19e45c921bc4e377c74e666ebcfc5b3dab60efe5e0c7d04438cf1794
SHA512

d24370e0dc9724c9c849a4d25001fe1a75b50d7485c2a1a747041cdcb0c4f622b9abdadbbb5a71aecb1bac0a62d9e0078c680d3e0361e7caa0d397a4f4d1c496

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.theatomicshots.com/xle/

Decoy

tknbr.com

loyaloneconstruction.com

what-where.com

matebacapital.com

marriedandmore.com

qiemfsolutions.com

graececonsulting.com

www7456.com

littlefreecherokeelibrary.com

tailgatepawkinglot.com

musheet.com

tesfamariamtb.com

1728025.com

xceltechuae.com

harperandchloe.com

thepamperedbarber.com

5050alberta.com

supplychainstrainer.com

lacorte.group

ringingbear.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1328-12-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral2/memory/1328-13-0x000000000041EB90-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

04d511a27304f93e708f91308d483358.exe

description pid process target process

PID 4052 set thread context of 1328 4052 04d511a27304f93e708f91308d483358.exe 04d511a27304f93e708f91308d483358.exe

description	pid	process	target process
PID 4052 set thread context of 1328	4052	04d511a27304f93e708f91308d483358.exe	04d511a27304f93e708f91308d483358.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

04d511a27304f93e708f91308d483358.exe04d511a27304f93e708f91308d483358.exe

pid	process
4052	04d511a27304f93e708f91308d483358.exe
4052	04d511a27304f93e708f91308d483358.exe
1328	04d511a27304f93e708f91308d483358.exe
1328	04d511a27304f93e708f91308d483358.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

04d511a27304f93e708f91308d483358.exe

description pid process

Token: SeDebugPrivilege 4052 04d511a27304f93e708f91308d483358.exe

description	pid	process
Token: SeDebugPrivilege	4052	04d511a27304f93e708f91308d483358.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

04d511a27304f93e708f91308d483358.exe

description	pid	process	target process
PID 4052 wrote to memory of 2236	4052	04d511a27304f93e708f91308d483358.exe	04d511a27304f93e708f91308d483358.exe
PID 4052 wrote to memory of 2236	4052	04d511a27304f93e708f91308d483358.exe	04d511a27304f93e708f91308d483358.exe
PID 4052 wrote to memory of 2236	4052	04d511a27304f93e708f91308d483358.exe	04d511a27304f93e708f91308d483358.exe
PID 4052 wrote to memory of 1328	4052	04d511a27304f93e708f91308d483358.exe	04d511a27304f93e708f91308d483358.exe
PID 4052 wrote to memory of 1328	4052	04d511a27304f93e708f91308d483358.exe	04d511a27304f93e708f91308d483358.exe
PID 4052 wrote to memory of 1328	4052	04d511a27304f93e708f91308d483358.exe	04d511a27304f93e708f91308d483358.exe
PID 4052 wrote to memory of 1328	4052	04d511a27304f93e708f91308d483358.exe	04d511a27304f93e708f91308d483358.exe
PID 4052 wrote to memory of 1328	4052	04d511a27304f93e708f91308d483358.exe	04d511a27304f93e708f91308d483358.exe
PID 4052 wrote to memory of 1328	4052	04d511a27304f93e708f91308d483358.exe	04d511a27304f93e708f91308d483358.exe

C:\Users\Admin\AppData\Local\Temp\04d511a27304f93e708f91308d483358.exe
"C:\Users\Admin\AppData\Local\Temp\04d511a27304f93e708f91308d483358.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4052

C:\Users\Admin\AppData\Local\Temp\04d511a27304f93e708f91308d483358.exe
"{path}"
2⤵
PID:2236

C:\Users\Admin\AppData\Local\Temp\04d511a27304f93e708f91308d483358.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1328

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1328-12-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1328-13-0x000000000041EB90-mapping.dmp

Download
memory/1328-15-0x0000000001A80000-0x0000000001DA0000-memory.dmp

Filesize
3.1MB

Download
memory/4052-2-0x0000000073820000-0x0000000073F0E000-memory.dmp

Filesize
6.9MB

Download
memory/4052-3-0x0000000000640000-0x0000000000641000-memory.dmp

Filesize
4KB

Download
memory/4052-5-0x00000000054F0000-0x00000000054F1000-memory.dmp

Filesize
4KB

Download
memory/4052-6-0x0000000004FF0000-0x0000000004FF1000-memory.dmp

Filesize
4KB

Download
memory/4052-7-0x0000000005250000-0x0000000005251000-memory.dmp

Filesize
4KB

Download
memory/4052-8-0x00000000050D0000-0x00000000050D1000-memory.dmp

Filesize
4KB

Download
memory/4052-9-0x00000000053A0000-0x00000000053AE000-memory.dmp

Filesize
56KB

Download
memory/4052-10-0x0000000006D10000-0x0000000006D69000-memory.dmp

Filesize
356KB

Download
memory/4052-11-0x00000000073F0000-0x00000000073F1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads