formbook | 2ba03179153cd1efd2098bf6fc7870efb2b3a5a60f2b516c4c3dace977627289

General

Target

PO-23562#TZ232-DATED19-01-2021.exe
Size

1.5MB
MD5

497a3aba71e4db2cbf7d3746acff93eb
SHA1

2e5a0391fd8024bec52d70d10356caa198c79f64
SHA256

2ba03179153cd1efd2098bf6fc7870efb2b3a5a60f2b516c4c3dace977627289
SHA512

19d819b0809af869a06a8ae2e700135208000b02bc269849aa21bbe94b90ac6fc87e647f0efaf6a58c558bcc143f4fe3c033059f2480182774978410655f5f18

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.styrelseforum.com/p95n/

Decoy

kimberlyrutledge.com

auctus.agency

johnemotions.com

guilt-brilliant.com

wxshangdian.com

theolivetreeonline.com

stellarfranchisebrands.com

every1no1.com

hoangthanhgroup.com

psm-gen.com

kingdomwow.com

digitalksr.com

karynpolitoforlg.com

youthdaycalgary.com

libertyhandymanservicesllc.com

breatheohio.com

allenleather.com

transformafter50.info

hnhsylsb.com

hmtradebd.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2176-13-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral2/memory/2176-14-0x000000000041EDF0-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

PO-23562#TZ232-DATED19-01-2021.exe

description pid process target process

PID 580 set thread context of 2176 580 PO-23562#TZ232-DATED19-01-2021.exe PO-23562#TZ232-DATED19-01-2021.exe

description	pid	process	target process
PID 580 set thread context of 2176	580	PO-23562#TZ232-DATED19-01-2021.exe	PO-23562#TZ232-DATED19-01-2021.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

PO-23562#TZ232-DATED19-01-2021.exePO-23562#TZ232-DATED19-01-2021.exe

pid	process
580	PO-23562#TZ232-DATED19-01-2021.exe
580	PO-23562#TZ232-DATED19-01-2021.exe
580	PO-23562#TZ232-DATED19-01-2021.exe
580	PO-23562#TZ232-DATED19-01-2021.exe
580	PO-23562#TZ232-DATED19-01-2021.exe
580	PO-23562#TZ232-DATED19-01-2021.exe
580	PO-23562#TZ232-DATED19-01-2021.exe
580	PO-23562#TZ232-DATED19-01-2021.exe
580	PO-23562#TZ232-DATED19-01-2021.exe
2176	PO-23562#TZ232-DATED19-01-2021.exe
2176	PO-23562#TZ232-DATED19-01-2021.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

PO-23562#TZ232-DATED19-01-2021.exe

description pid process

Token: SeDebugPrivilege 580 PO-23562#TZ232-DATED19-01-2021.exe

description	pid	process
Token: SeDebugPrivilege	580	PO-23562#TZ232-DATED19-01-2021.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

PO-23562#TZ232-DATED19-01-2021.exe

C:\Users\Admin\AppData\Local\Temp\PO-23562#TZ232-DATED19-01-2021.exe
"C:\Users\Admin\AppData\Local\Temp\PO-23562#TZ232-DATED19-01-2021.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:580

C:\Users\Admin\AppData\Local\Temp\PO-23562#TZ232-DATED19-01-2021.exe
"{path}"
2⤵
PID:3832

C:\Users\Admin\AppData\Local\Temp\PO-23562#TZ232-DATED19-01-2021.exe
"{path}"
2⤵
PID:932

C:\Users\Admin\AppData\Local\Temp\PO-23562#TZ232-DATED19-01-2021.exe
"{path}"
2⤵
PID:2312

C:\Users\Admin\AppData\Local\Temp\PO-23562#TZ232-DATED19-01-2021.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2176

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/580-2-0x0000000073F30000-0x000000007461E000-memory.dmp

Filesize
6.9MB

Download
memory/580-3-0x0000000000930000-0x0000000000931000-memory.dmp

Filesize
4KB

Download
memory/580-5-0x00000000053B0000-0x000000000542C000-memory.dmp

Filesize
496KB

Download
memory/580-6-0x0000000005D70000-0x0000000005D71000-memory.dmp

Filesize
4KB

Download
memory/580-7-0x0000000005460000-0x0000000005461000-memory.dmp

Filesize
4KB

Download
memory/580-8-0x0000000005910000-0x0000000005911000-memory.dmp

Filesize
4KB

Download
memory/580-9-0x00000000058D0000-0x00000000058D1000-memory.dmp

Filesize
4KB

Download
memory/580-10-0x0000000005AC0000-0x0000000005ACE000-memory.dmp

Filesize
56KB

Download
memory/580-11-0x0000000008A90000-0x0000000008AEB000-memory.dmp

Filesize
364KB

Download
memory/580-12-0x0000000008B90000-0x0000000008B91000-memory.dmp

Filesize
4KB

Download
memory/2176-13-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2176-14-0x000000000041EDF0-mapping.dmp

Download
memory/2176-16-0x0000000001440000-0x0000000001760000-memory.dmp

Filesize
3.1MB

Download

description	pid	process	target process
PID 580 wrote to memory of 3832	580	PO-23562#TZ232-DATED19-01-2021.exe	PO-23562#TZ232-DATED19-01-2021.exe
PID 580 wrote to memory of 3832	580	PO-23562#TZ232-DATED19-01-2021.exe	PO-23562#TZ232-DATED19-01-2021.exe
PID 580 wrote to memory of 3832	580	PO-23562#TZ232-DATED19-01-2021.exe	PO-23562#TZ232-DATED19-01-2021.exe
PID 580 wrote to memory of 932	580	PO-23562#TZ232-DATED19-01-2021.exe	PO-23562#TZ232-DATED19-01-2021.exe
PID 580 wrote to memory of 932	580	PO-23562#TZ232-DATED19-01-2021.exe	PO-23562#TZ232-DATED19-01-2021.exe
PID 580 wrote to memory of 932	580	PO-23562#TZ232-DATED19-01-2021.exe	PO-23562#TZ232-DATED19-01-2021.exe
PID 580 wrote to memory of 2312	580	PO-23562#TZ232-DATED19-01-2021.exe	PO-23562#TZ232-DATED19-01-2021.exe
PID 580 wrote to memory of 2312	580	PO-23562#TZ232-DATED19-01-2021.exe	PO-23562#TZ232-DATED19-01-2021.exe
PID 580 wrote to memory of 2312	580	PO-23562#TZ232-DATED19-01-2021.exe	PO-23562#TZ232-DATED19-01-2021.exe
PID 580 wrote to memory of 2176	580	PO-23562#TZ232-DATED19-01-2021.exe	PO-23562#TZ232-DATED19-01-2021.exe
PID 580 wrote to memory of 2176	580	PO-23562#TZ232-DATED19-01-2021.exe	PO-23562#TZ232-DATED19-01-2021.exe
PID 580 wrote to memory of 2176	580	PO-23562#TZ232-DATED19-01-2021.exe	PO-23562#TZ232-DATED19-01-2021.exe
PID 580 wrote to memory of 2176	580	PO-23562#TZ232-DATED19-01-2021.exe	PO-23562#TZ232-DATED19-01-2021.exe
PID 580 wrote to memory of 2176	580	PO-23562#TZ232-DATED19-01-2021.exe	PO-23562#TZ232-DATED19-01-2021.exe
PID 580 wrote to memory of 2176	580	PO-23562#TZ232-DATED19-01-2021.exe	PO-23562#TZ232-DATED19-01-2021.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads