formbook | f59df25daa1bbe11f38724ad0b36eebc535f1f36ae3796ce5bebe1049cbb57ed

General

Target

SecuriteInfo.com.generic.ml.29418.exe
Size

999KB
MD5

03bfef72c4d962a223cd051d1fe5bbe6
SHA1

bb7097101b26eadb4af50f6e2bb21c2cad610217
SHA256

f59df25daa1bbe11f38724ad0b36eebc535f1f36ae3796ce5bebe1049cbb57ed
SHA512

23b1a4542eb8f530e6984f51e340699c0bda6e03e2c192ef46f61a04358c261ca1f902f5e1c2e36a081fa286f92c4061768e130f38fdca95f3865d9c8cf06874

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.huynhanhdung.com/kna/

Decoy

lawrencefiredepartment.com

executivehomeoffices.com

solfed.world

oshawaexchange.com

webdavlexstore.com

youpieb.com

chiller-master.com

bearstoragetn.com

daf90x16.com

gewhacaalouine.com

simplyezi.com

cstechnologyservices.com

nosyboats.com

thecocomarie.com

vetinaryeco.club

americangoselfilm.com

gdsuhejia.com

verbunden-sein.net

the-minerva.com

loctrantv.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1668-9-0x000000000041EAB0-mapping.dmp	formbook
behavioral1/memory/1668-8-0x0000000000400000-0x000000000042E000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

SecuriteInfo.com.generic.ml.29418.exe

description pid process target process

PID 1652 set thread context of 1668 1652 SecuriteInfo.com.generic.ml.29418.exe SecuriteInfo.com.generic.ml.29418.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

SecuriteInfo.com.generic.ml.29418.exe

pid process

1668 SecuriteInfo.com.generic.ml.29418.exe

description	pid	process	target process
PID 1652 set thread context of 1668	1652	SecuriteInfo.com.generic.ml.29418.exe	SecuriteInfo.com.generic.ml.29418.exe

pid	process
1668	SecuriteInfo.com.generic.ml.29418.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

SecuriteInfo.com.generic.ml.29418.exe

description	pid	process	target process
PID 1652 wrote to memory of 1668	1652	SecuriteInfo.com.generic.ml.29418.exe	SecuriteInfo.com.generic.ml.29418.exe
PID 1652 wrote to memory of 1668	1652	SecuriteInfo.com.generic.ml.29418.exe	SecuriteInfo.com.generic.ml.29418.exe
PID 1652 wrote to memory of 1668	1652	SecuriteInfo.com.generic.ml.29418.exe	SecuriteInfo.com.generic.ml.29418.exe
PID 1652 wrote to memory of 1668	1652	SecuriteInfo.com.generic.ml.29418.exe	SecuriteInfo.com.generic.ml.29418.exe
PID 1652 wrote to memory of 1668	1652	SecuriteInfo.com.generic.ml.29418.exe	SecuriteInfo.com.generic.ml.29418.exe
PID 1652 wrote to memory of 1668	1652	SecuriteInfo.com.generic.ml.29418.exe	SecuriteInfo.com.generic.ml.29418.exe
PID 1652 wrote to memory of 1668	1652	SecuriteInfo.com.generic.ml.29418.exe	SecuriteInfo.com.generic.ml.29418.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.generic.ml.29418.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.generic.ml.29418.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1652

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.generic.ml.29418.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1668

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1652-2-0x0000000074710000-0x0000000074DFE000-memory.dmp

Filesize
6.9MB

Download
memory/1652-3-0x0000000001040000-0x0000000001041000-memory.dmp

Filesize
4KB

Download
memory/1652-5-0x0000000004D00000-0x0000000004D01000-memory.dmp

Filesize
4KB

Download
memory/1652-6-0x0000000000310000-0x000000000031E000-memory.dmp

Filesize
56KB

Download
memory/1652-7-0x0000000005890000-0x000000000592A000-memory.dmp

Filesize
616KB

Download
memory/1668-9-0x000000000041EAB0-mapping.dmp

Download
memory/1668-8-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1668-11-0x0000000000820000-0x0000000000B23000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing