formbook | cc26bac0f47c7d3853f301243a6cca755b3eebd571133ddbb247998caa8d8682

General

Target

50f6254a4635d1e5e588d80eb8987f4b.exe
Size

1018KB
MD5

50f6254a4635d1e5e588d80eb8987f4b
SHA1

61143c57867e6799e52bf6d3d456b4efd92ced41
SHA256

cc26bac0f47c7d3853f301243a6cca755b3eebd571133ddbb247998caa8d8682
SHA512

40d5714d0f9c0c5452e08c11b41540ac6e35558fdfcd343b56ac576a29b8a0ad3abb9265ab79a9eb683b9b6d0668aac5116abe441ecf260fea6b2b5f55985ddb

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.bytecommunication.com/aky/

Decoy

jeiksaoeklea.com

sagame-auto.net

soloseriolavoro.com

thecreatorsbook.com

superskritch.com

oroxequipment.com

heart-of-art.online

liwedfg.com

fisherofsouls.com

jota.xyz

nehyam.com

smart-contact-delivery.com

hoom.guru

dgryds.com

thesoakcpd.com

mishv.com

rings-factory.info

bero-craft-beers.com

podcastnamegenerators.com

856379813.xyz

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/884-8-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/884-9-0x000000000041EB60-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

50f6254a4635d1e5e588d80eb8987f4b.exe

description pid process target process

PID 328 set thread context of 884 328 50f6254a4635d1e5e588d80eb8987f4b.exe 50f6254a4635d1e5e588d80eb8987f4b.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

50f6254a4635d1e5e588d80eb8987f4b.exe

pid process

884 50f6254a4635d1e5e588d80eb8987f4b.exe

description	pid	process	target process
PID 328 set thread context of 884	328	50f6254a4635d1e5e588d80eb8987f4b.exe	50f6254a4635d1e5e588d80eb8987f4b.exe

pid	process
884	50f6254a4635d1e5e588d80eb8987f4b.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

50f6254a4635d1e5e588d80eb8987f4b.exe

description	pid	process	target process
PID 328 wrote to memory of 884	328	50f6254a4635d1e5e588d80eb8987f4b.exe	50f6254a4635d1e5e588d80eb8987f4b.exe
PID 328 wrote to memory of 884	328	50f6254a4635d1e5e588d80eb8987f4b.exe	50f6254a4635d1e5e588d80eb8987f4b.exe
PID 328 wrote to memory of 884	328	50f6254a4635d1e5e588d80eb8987f4b.exe	50f6254a4635d1e5e588d80eb8987f4b.exe
PID 328 wrote to memory of 884	328	50f6254a4635d1e5e588d80eb8987f4b.exe	50f6254a4635d1e5e588d80eb8987f4b.exe
PID 328 wrote to memory of 884	328	50f6254a4635d1e5e588d80eb8987f4b.exe	50f6254a4635d1e5e588d80eb8987f4b.exe
PID 328 wrote to memory of 884	328	50f6254a4635d1e5e588d80eb8987f4b.exe	50f6254a4635d1e5e588d80eb8987f4b.exe
PID 328 wrote to memory of 884	328	50f6254a4635d1e5e588d80eb8987f4b.exe	50f6254a4635d1e5e588d80eb8987f4b.exe

C:\Users\Admin\AppData\Local\Temp\50f6254a4635d1e5e588d80eb8987f4b.exe
"C:\Users\Admin\AppData\Local\Temp\50f6254a4635d1e5e588d80eb8987f4b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:328

C:\Users\Admin\AppData\Local\Temp\50f6254a4635d1e5e588d80eb8987f4b.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:884

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/328-2-0x0000000074450000-0x0000000074B3E000-memory.dmp

Filesize
6.9MB

Download
memory/328-3-0x0000000000F40000-0x0000000000F41000-memory.dmp

Filesize
4KB

Download
memory/328-5-0x0000000004F20000-0x0000000004F21000-memory.dmp

Filesize
4KB

Download
memory/328-6-0x00000000008B0000-0x00000000008BE000-memory.dmp

Filesize
56KB

Download
memory/328-7-0x0000000000DE0000-0x0000000000E2D000-memory.dmp

Filesize
308KB

Download
memory/884-8-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/884-9-0x000000000041EB60-mapping.dmp

Download
memory/884-11-0x0000000000910000-0x0000000000C13000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing