formbook | 3ce15be8f0a31d5fa5a176c3abb3729fd834a6af3e8a69b35cc6f2dd54c66fdb

General

Target

0490ab92aedecbbe4fe1ab000dff0410.exe
Size

1.4MB
MD5

0490ab92aedecbbe4fe1ab000dff0410
SHA1

1470aab30084ee6c1e1648c71e46606dfa774658
SHA256

3ce15be8f0a31d5fa5a176c3abb3729fd834a6af3e8a69b35cc6f2dd54c66fdb
SHA512

f020e253faa71652f1385cd8cce2afe79000950a36d8670d69f681fccc19b9f2a0d07abc69628f60e65cf46c88688e7ba189141a9a467230b7da242b7963b71d

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.embracingmyjourney.net/p7t/

Decoy

crosvudigital.com

airgreenllc.com

epochryphal.com

handy-domain-listing.com

espaceideecreation.com

3sleeves.com

alotrooms.com

luttelion.com

efekaleci.xyz

allpapas.com

alverazricardez.com

meghandoria.com

deicorp-community.com

877nz.com

bahmanhochmetalwerks.com

teppeisugaya.com

kitrablog.digital

theatermoviebuying.com

ptlycloudy.com

ablehed.pro

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/904-9-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/904-10-0x000000000041EBB0-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

0490ab92aedecbbe4fe1ab000dff0410.exe

description pid process target process

PID 1012 set thread context of 904 1012 0490ab92aedecbbe4fe1ab000dff0410.exe 0490ab92aedecbbe4fe1ab000dff0410.exe

description	pid	process	target process
PID 1012 set thread context of 904	1012	0490ab92aedecbbe4fe1ab000dff0410.exe	0490ab92aedecbbe4fe1ab000dff0410.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

0490ab92aedecbbe4fe1ab000dff0410.exe0490ab92aedecbbe4fe1ab000dff0410.exe

pid	process
1012	0490ab92aedecbbe4fe1ab000dff0410.exe
1012	0490ab92aedecbbe4fe1ab000dff0410.exe
1012	0490ab92aedecbbe4fe1ab000dff0410.exe
904	0490ab92aedecbbe4fe1ab000dff0410.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0490ab92aedecbbe4fe1ab000dff0410.exe

description pid process

Token: SeDebugPrivilege 1012 0490ab92aedecbbe4fe1ab000dff0410.exe

description	pid	process
Token: SeDebugPrivilege	1012	0490ab92aedecbbe4fe1ab000dff0410.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

0490ab92aedecbbe4fe1ab000dff0410.exe

description	pid	process	target process
PID 1012 wrote to memory of 904	1012	0490ab92aedecbbe4fe1ab000dff0410.exe	0490ab92aedecbbe4fe1ab000dff0410.exe
PID 1012 wrote to memory of 904	1012	0490ab92aedecbbe4fe1ab000dff0410.exe	0490ab92aedecbbe4fe1ab000dff0410.exe
PID 1012 wrote to memory of 904	1012	0490ab92aedecbbe4fe1ab000dff0410.exe	0490ab92aedecbbe4fe1ab000dff0410.exe
PID 1012 wrote to memory of 904	1012	0490ab92aedecbbe4fe1ab000dff0410.exe	0490ab92aedecbbe4fe1ab000dff0410.exe
PID 1012 wrote to memory of 904	1012	0490ab92aedecbbe4fe1ab000dff0410.exe	0490ab92aedecbbe4fe1ab000dff0410.exe
PID 1012 wrote to memory of 904	1012	0490ab92aedecbbe4fe1ab000dff0410.exe	0490ab92aedecbbe4fe1ab000dff0410.exe
PID 1012 wrote to memory of 904	1012	0490ab92aedecbbe4fe1ab000dff0410.exe	0490ab92aedecbbe4fe1ab000dff0410.exe

C:\Users\Admin\AppData\Local\Temp\0490ab92aedecbbe4fe1ab000dff0410.exe
"C:\Users\Admin\AppData\Local\Temp\0490ab92aedecbbe4fe1ab000dff0410.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1012

C:\Users\Admin\AppData\Local\Temp\0490ab92aedecbbe4fe1ab000dff0410.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:904

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/904-9-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/904-10-0x000000000041EBB0-mapping.dmp

Download
memory/904-12-0x0000000000970000-0x0000000000C73000-memory.dmp

Filesize
3.0MB

Download
memory/1012-2-0x0000000074D20000-0x000000007540E000-memory.dmp

Filesize
6.9MB

Download
memory/1012-3-0x0000000000FC0000-0x0000000000FC1000-memory.dmp

Filesize
4KB

Download
memory/1012-5-0x0000000000460000-0x00000000004E9000-memory.dmp

Filesize
548KB

Download
memory/1012-6-0x0000000005D40000-0x0000000005D41000-memory.dmp

Filesize
4KB

Download
memory/1012-7-0x00000000003D0000-0x00000000003DE000-memory.dmp

Filesize
56KB

Download
memory/1012-8-0x0000000004900000-0x000000000494D000-memory.dmp

Filesize
308KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads