formbook | d4dc8610837799abecadc4d3db1f6a8cbbce340de07b90e9868603f50c7fe762

General

Target

4310b5640ee8ea88007a978540a32129.exe
Size

1.4MB
MD5

4310b5640ee8ea88007a978540a32129
SHA1

35f274fd4675267afb9c29c38896cc7ea9f10e34
SHA256

d4dc8610837799abecadc4d3db1f6a8cbbce340de07b90e9868603f50c7fe762
SHA512

eeddf53ea3a22ca9e4fc6ee8cf451a3cc70ffb58026ef3b97bf13fb1b101f0b603bf7987bd84873f467ab0f976af95b77170a78abbde410dc44a3fdb727d485d

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.thedilleyo.com/kb8/

Decoy

goodsforbuilders.com

dafuhe.com

parapharmacity.com

montclairymcamotionvibe.com

jamesmccloudart.com

reignfallentertainment.com

couplesforequality.com

pitchbop.com

minipresspaperco.com

venoam.com

so-paradise.com

surgeryprovider.com

donaldscareers.com

disney-funlife.com

biosolo.net

themodsmith.net

grandhawaiian.com

11mountains.com

immatesearch.com

stochastichq.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1396-13-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral2/memory/1396-14-0x000000000041EB70-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

4310b5640ee8ea88007a978540a32129.exe

description pid process target process

PID 1308 set thread context of 1396 1308 4310b5640ee8ea88007a978540a32129.exe 4310b5640ee8ea88007a978540a32129.exe

description	pid	process	target process
PID 1308 set thread context of 1396	1308	4310b5640ee8ea88007a978540a32129.exe	4310b5640ee8ea88007a978540a32129.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

4310b5640ee8ea88007a978540a32129.exe4310b5640ee8ea88007a978540a32129.exe

pid	process
1308	4310b5640ee8ea88007a978540a32129.exe
1308	4310b5640ee8ea88007a978540a32129.exe
1308	4310b5640ee8ea88007a978540a32129.exe
1396	4310b5640ee8ea88007a978540a32129.exe
1396	4310b5640ee8ea88007a978540a32129.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

4310b5640ee8ea88007a978540a32129.exe

description pid process

Token: SeDebugPrivilege 1308 4310b5640ee8ea88007a978540a32129.exe

description	pid	process
Token: SeDebugPrivilege	1308	4310b5640ee8ea88007a978540a32129.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

4310b5640ee8ea88007a978540a32129.exe

description	pid	process	target process
PID 1308 wrote to memory of 1396	1308	4310b5640ee8ea88007a978540a32129.exe	4310b5640ee8ea88007a978540a32129.exe
PID 1308 wrote to memory of 1396	1308	4310b5640ee8ea88007a978540a32129.exe	4310b5640ee8ea88007a978540a32129.exe
PID 1308 wrote to memory of 1396	1308	4310b5640ee8ea88007a978540a32129.exe	4310b5640ee8ea88007a978540a32129.exe
PID 1308 wrote to memory of 1396	1308	4310b5640ee8ea88007a978540a32129.exe	4310b5640ee8ea88007a978540a32129.exe
PID 1308 wrote to memory of 1396	1308	4310b5640ee8ea88007a978540a32129.exe	4310b5640ee8ea88007a978540a32129.exe
PID 1308 wrote to memory of 1396	1308	4310b5640ee8ea88007a978540a32129.exe	4310b5640ee8ea88007a978540a32129.exe

C:\Users\Admin\AppData\Local\Temp\4310b5640ee8ea88007a978540a32129.exe
"C:\Users\Admin\AppData\Local\Temp\4310b5640ee8ea88007a978540a32129.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1308

C:\Users\Admin\AppData\Local\Temp\4310b5640ee8ea88007a978540a32129.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1396

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1308-2-0x0000000073C50000-0x000000007433E000-memory.dmp

Filesize
6.9MB

Download
memory/1308-3-0x0000000000D80000-0x0000000000D81000-memory.dmp

Filesize
4KB

Download
memory/1308-5-0x0000000003260000-0x00000000032E9000-memory.dmp

Filesize
548KB

Download
memory/1308-6-0x000000000B540000-0x000000000B541000-memory.dmp

Filesize
4KB

Download
memory/1308-7-0x000000000B0E0000-0x000000000B0E1000-memory.dmp

Filesize
4KB

Download
memory/1308-8-0x000000000B070000-0x000000000B071000-memory.dmp

Filesize
4KB

Download
memory/1308-9-0x00000000059B0000-0x00000000059B1000-memory.dmp

Filesize
4KB

Download
memory/1308-10-0x000000000B4F0000-0x000000000B4FE000-memory.dmp

Filesize
56KB

Download
memory/1308-11-0x00000000059D0000-0x0000000005A1C000-memory.dmp

Filesize
304KB

Download
memory/1308-12-0x0000000005AD0000-0x0000000005AD1000-memory.dmp

Filesize
4KB

Download
memory/1396-13-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1396-14-0x000000000041EB70-mapping.dmp

Download
memory/1396-16-0x0000000001830000-0x0000000001B50000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads