formbook | 2ba03179153cd1efd2098bf6fc7870efb2b3a5a60f2b516c4c3dace977627289

General

Target

PO-23562#TZ232-DATED19-01-2021.exe
Size

1.5MB
MD5

497a3aba71e4db2cbf7d3746acff93eb
SHA1

2e5a0391fd8024bec52d70d10356caa198c79f64
SHA256

2ba03179153cd1efd2098bf6fc7870efb2b3a5a60f2b516c4c3dace977627289
SHA512

19d819b0809af869a06a8ae2e700135208000b02bc269849aa21bbe94b90ac6fc87e647f0efaf6a58c558bcc143f4fe3c033059f2480182774978410655f5f18

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.styrelseforum.com/p95n/

Decoy

kimberlyrutledge.com

auctus.agency

johnemotions.com

guilt-brilliant.com

wxshangdian.com

theolivetreeonline.com

stellarfranchisebrands.com

every1no1.com

hoangthanhgroup.com

psm-gen.com

kingdomwow.com

digitalksr.com

karynpolitoforlg.com

youthdaycalgary.com

libertyhandymanservicesllc.com

breatheohio.com

allenleather.com

transformafter50.info

hnhsylsb.com

hmtradebd.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/476-9-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/476-10-0x000000000041EDF0-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

PO-23562#TZ232-DATED19-01-2021.exe

description pid process target process

PID 2028 set thread context of 476 2028 PO-23562#TZ232-DATED19-01-2021.exe PO-23562#TZ232-DATED19-01-2021.exe

description	pid	process	target process
PID 2028 set thread context of 476	2028	PO-23562#TZ232-DATED19-01-2021.exe	PO-23562#TZ232-DATED19-01-2021.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

PO-23562#TZ232-DATED19-01-2021.exePO-23562#TZ232-DATED19-01-2021.exe

pid	process
2028	PO-23562#TZ232-DATED19-01-2021.exe
2028	PO-23562#TZ232-DATED19-01-2021.exe
2028	PO-23562#TZ232-DATED19-01-2021.exe
2028	PO-23562#TZ232-DATED19-01-2021.exe
2028	PO-23562#TZ232-DATED19-01-2021.exe
476	PO-23562#TZ232-DATED19-01-2021.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

PO-23562#TZ232-DATED19-01-2021.exe

description pid process

Token: SeDebugPrivilege 2028 PO-23562#TZ232-DATED19-01-2021.exe

description	pid	process
Token: SeDebugPrivilege	2028	PO-23562#TZ232-DATED19-01-2021.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

PO-23562#TZ232-DATED19-01-2021.exe

description	pid	process	target process
PID 2028 wrote to memory of 2004	2028	PO-23562#TZ232-DATED19-01-2021.exe	PO-23562#TZ232-DATED19-01-2021.exe
PID 2028 wrote to memory of 2004	2028	PO-23562#TZ232-DATED19-01-2021.exe	PO-23562#TZ232-DATED19-01-2021.exe
PID 2028 wrote to memory of 2004	2028	PO-23562#TZ232-DATED19-01-2021.exe	PO-23562#TZ232-DATED19-01-2021.exe
PID 2028 wrote to memory of 2004	2028	PO-23562#TZ232-DATED19-01-2021.exe	PO-23562#TZ232-DATED19-01-2021.exe
PID 2028 wrote to memory of 476	2028	PO-23562#TZ232-DATED19-01-2021.exe	PO-23562#TZ232-DATED19-01-2021.exe
PID 2028 wrote to memory of 476	2028	PO-23562#TZ232-DATED19-01-2021.exe	PO-23562#TZ232-DATED19-01-2021.exe
PID 2028 wrote to memory of 476	2028	PO-23562#TZ232-DATED19-01-2021.exe	PO-23562#TZ232-DATED19-01-2021.exe
PID 2028 wrote to memory of 476	2028	PO-23562#TZ232-DATED19-01-2021.exe	PO-23562#TZ232-DATED19-01-2021.exe
PID 2028 wrote to memory of 476	2028	PO-23562#TZ232-DATED19-01-2021.exe	PO-23562#TZ232-DATED19-01-2021.exe
PID 2028 wrote to memory of 476	2028	PO-23562#TZ232-DATED19-01-2021.exe	PO-23562#TZ232-DATED19-01-2021.exe
PID 2028 wrote to memory of 476	2028	PO-23562#TZ232-DATED19-01-2021.exe	PO-23562#TZ232-DATED19-01-2021.exe

C:\Users\Admin\AppData\Local\Temp\PO-23562#TZ232-DATED19-01-2021.exe
"C:\Users\Admin\AppData\Local\Temp\PO-23562#TZ232-DATED19-01-2021.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2028

C:\Users\Admin\AppData\Local\Temp\PO-23562#TZ232-DATED19-01-2021.exe
"{path}"
2⤵
PID:2004

C:\Users\Admin\AppData\Local\Temp\PO-23562#TZ232-DATED19-01-2021.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:476

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/476-9-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/476-10-0x000000000041EDF0-mapping.dmp

Download
memory/476-12-0x0000000000910000-0x0000000000C13000-memory.dmp

Filesize
3.0MB

Download
memory/2028-2-0x0000000074EE0000-0x00000000755CE000-memory.dmp

Filesize
6.9MB

Download
memory/2028-3-0x0000000000EF0000-0x0000000000EF1000-memory.dmp

Filesize
4KB

Download
memory/2028-5-0x0000000000E40000-0x0000000000EBC000-memory.dmp

Filesize
496KB

Download
memory/2028-6-0x0000000005ED0000-0x0000000005ED1000-memory.dmp

Filesize
4KB

Download
memory/2028-7-0x00000000002C0000-0x00000000002CE000-memory.dmp

Filesize
56KB

Download
memory/2028-8-0x0000000000DA0000-0x0000000000DFB000-memory.dmp

Filesize
364KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads