formbook | 5adeb6184ee1dffad88ac180f1e7dcbd6f451fc8dcd5e868906fca11d98476ef

General

Target

f958e1e18b67ac9edc2668bac133b64a.exe
Size

1.4MB
MD5

f958e1e18b67ac9edc2668bac133b64a
SHA1

d92e70bac00a8c0d3067f5ae8589f8a5edd8270a
SHA256

5adeb6184ee1dffad88ac180f1e7dcbd6f451fc8dcd5e868906fca11d98476ef
SHA512

fc601ddf117a61160baa8b04ef9e70d577168abfdb65913eea5897a47f9b858e699f86e11908da476d27021eefaa3e253773b9107e658c883adda6bbfbcb50fb

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.embracingmyjourney.net/p7t/

Decoy

crosvudigital.com

airgreenllc.com

epochryphal.com

handy-domain-listing.com

espaceideecreation.com

3sleeves.com

alotrooms.com

luttelion.com

efekaleci.xyz

allpapas.com

alverazricardez.com

meghandoria.com

deicorp-community.com

877nz.com

bahmanhochmetalwerks.com

teppeisugaya.com

kitrablog.digital

theatermoviebuying.com

ptlycloudy.com

ablehed.pro

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2236-13-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral2/memory/2236-14-0x000000000041EBB0-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

f958e1e18b67ac9edc2668bac133b64a.exe

description pid process target process

PID 3152 set thread context of 2236 3152 f958e1e18b67ac9edc2668bac133b64a.exe f958e1e18b67ac9edc2668bac133b64a.exe

description	pid	process	target process
PID 3152 set thread context of 2236	3152	f958e1e18b67ac9edc2668bac133b64a.exe	f958e1e18b67ac9edc2668bac133b64a.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

f958e1e18b67ac9edc2668bac133b64a.exef958e1e18b67ac9edc2668bac133b64a.exe

pid	process
3152	f958e1e18b67ac9edc2668bac133b64a.exe
3152	f958e1e18b67ac9edc2668bac133b64a.exe
3152	f958e1e18b67ac9edc2668bac133b64a.exe
3152	f958e1e18b67ac9edc2668bac133b64a.exe
3152	f958e1e18b67ac9edc2668bac133b64a.exe
2236	f958e1e18b67ac9edc2668bac133b64a.exe
2236	f958e1e18b67ac9edc2668bac133b64a.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

f958e1e18b67ac9edc2668bac133b64a.exe

description pid process

Token: SeDebugPrivilege 3152 f958e1e18b67ac9edc2668bac133b64a.exe

description	pid	process
Token: SeDebugPrivilege	3152	f958e1e18b67ac9edc2668bac133b64a.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

f958e1e18b67ac9edc2668bac133b64a.exe

description	pid	process	target process
PID 3152 wrote to memory of 3312	3152	f958e1e18b67ac9edc2668bac133b64a.exe	f958e1e18b67ac9edc2668bac133b64a.exe
PID 3152 wrote to memory of 3312	3152	f958e1e18b67ac9edc2668bac133b64a.exe	f958e1e18b67ac9edc2668bac133b64a.exe
PID 3152 wrote to memory of 3312	3152	f958e1e18b67ac9edc2668bac133b64a.exe	f958e1e18b67ac9edc2668bac133b64a.exe
PID 3152 wrote to memory of 2236	3152	f958e1e18b67ac9edc2668bac133b64a.exe	f958e1e18b67ac9edc2668bac133b64a.exe
PID 3152 wrote to memory of 2236	3152	f958e1e18b67ac9edc2668bac133b64a.exe	f958e1e18b67ac9edc2668bac133b64a.exe
PID 3152 wrote to memory of 2236	3152	f958e1e18b67ac9edc2668bac133b64a.exe	f958e1e18b67ac9edc2668bac133b64a.exe
PID 3152 wrote to memory of 2236	3152	f958e1e18b67ac9edc2668bac133b64a.exe	f958e1e18b67ac9edc2668bac133b64a.exe
PID 3152 wrote to memory of 2236	3152	f958e1e18b67ac9edc2668bac133b64a.exe	f958e1e18b67ac9edc2668bac133b64a.exe
PID 3152 wrote to memory of 2236	3152	f958e1e18b67ac9edc2668bac133b64a.exe	f958e1e18b67ac9edc2668bac133b64a.exe

C:\Users\Admin\AppData\Local\Temp\f958e1e18b67ac9edc2668bac133b64a.exe
"C:\Users\Admin\AppData\Local\Temp\f958e1e18b67ac9edc2668bac133b64a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3152

C:\Users\Admin\AppData\Local\Temp\f958e1e18b67ac9edc2668bac133b64a.exe
"{path}"
2⤵
PID:3312

C:\Users\Admin\AppData\Local\Temp\f958e1e18b67ac9edc2668bac133b64a.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2236

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2236-13-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2236-16-0x0000000001340000-0x0000000001660000-memory.dmp

Filesize
3.1MB

Download
memory/2236-14-0x000000000041EBB0-mapping.dmp

Download
memory/3152-9-0x000000000B120000-0x000000000B121000-memory.dmp

Filesize
4KB

Download
memory/3152-7-0x00000000059D0000-0x00000000059D1000-memory.dmp

Filesize
4KB

Download
memory/3152-8-0x000000000B180000-0x000000000B181000-memory.dmp

Filesize
4KB

Download
memory/3152-2-0x0000000073820000-0x0000000073F0E000-memory.dmp

Filesize
6.9MB

Download
memory/3152-10-0x000000000B560000-0x000000000B56E000-memory.dmp

Filesize
56KB

Download
memory/3152-11-0x000000000CD10000-0x000000000CD6B000-memory.dmp

Filesize
364KB

Download
memory/3152-12-0x000000000D4B0000-0x000000000D4B1000-memory.dmp

Filesize
4KB

Download
memory/3152-6-0x000000000B5E0000-0x000000000B5E1000-memory.dmp

Filesize
4KB

Download
memory/3152-5-0x0000000007D60000-0x0000000007DDD000-memory.dmp

Filesize
500KB

Download
memory/3152-3-0x0000000000CF0000-0x0000000000CF1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads