formbook | 47031aee7dc67644c841246a50bacd54a31d56603c1305d9966fb56c3b3cb448

General

Target

Bank swift.exe
Size

594KB
MD5

cb045e8eaa8c74a5b79da54d9cb038ea
SHA1

d291b57e8a814e02111b0146687dfb09263ab73c
SHA256

47031aee7dc67644c841246a50bacd54a31d56603c1305d9966fb56c3b3cb448
SHA512

b07ab3643ab4b77829cb89b2c45e0227b018d83050905b7c85bf939f7d99e6e324df3c6aac0700a9622f290ed03d57eb5c864d7778d4ef86537dea443ba49af5

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

C2

http://www.joomlas123.info/3nop/

Decoy

bakecakesandmore.com

shenglisuoye.com

chinapopfactory.com

ynlrhd.com

liqourforyou.com

leonqamil.com

meccafon.com

online-marketing-strategie.biz

rbfxi.com

frseyb.info

leyu91.com

hotsmail.today

beepot.tech

dunaemmetmobility.com

sixpenceworkshop.com

incrediblefavorcoaching.com

pofo.info

yanshudaili.com

yellowbrickwedding.com

paintpartyblueprint.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4012-119-0x0000000000000000-mapping.dmp	formbook
behavioral2/memory/4012-121-0x0000000010410000-0x000000001043D000-memory.dmp	formbook
behavioral2/memory/4012-123-0x0000000000750000-0x00000000007B7000-memory.dmp	formbook
behavioral2/memory/4080-127-0x0000000002900000-0x000000000292D000-memory.dmp	formbook

Suspicious use of SetThreadContext 2 IoCs

Processes:

logagent.exeipconfig.exe

description	pid	process	target process
PID 4012 set thread context of 2416	4012	logagent.exe	Explorer.EXE
PID 4080 set thread context of 2416	4080	ipconfig.exe	Explorer.EXE

Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command-Line Interface
T1059

Processes:

ipconfig.exe

pid process

4080 ipconfig.exe

pid	process
4080	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 52 IoCs

Processes:

logagent.exeipconfig.exe

pid	process
4012	logagent.exe
4012	logagent.exe
4012	logagent.exe
4012	logagent.exe
4080	ipconfig.exe
4080	ipconfig.exe
4080	ipconfig.exe
4080	ipconfig.exe
4080	ipconfig.exe
4080	ipconfig.exe
4080	ipconfig.exe
4080	ipconfig.exe
4080	ipconfig.exe
4080	ipconfig.exe
4080	ipconfig.exe
4080	ipconfig.exe
4080	ipconfig.exe
4080	ipconfig.exe
4080	ipconfig.exe
4080	ipconfig.exe
4080	ipconfig.exe
4080	ipconfig.exe
4080	ipconfig.exe
4080	ipconfig.exe
4080	ipconfig.exe
4080	ipconfig.exe
4080	ipconfig.exe
4080	ipconfig.exe
4080	ipconfig.exe
4080	ipconfig.exe
4080	ipconfig.exe
4080	ipconfig.exe
4080	ipconfig.exe
4080	ipconfig.exe
4080	ipconfig.exe
4080	ipconfig.exe
4080	ipconfig.exe
4080	ipconfig.exe
4080	ipconfig.exe
4080	ipconfig.exe
4080	ipconfig.exe
4080	ipconfig.exe
4080	ipconfig.exe
4080	ipconfig.exe
4080	ipconfig.exe
4080	ipconfig.exe
4080	ipconfig.exe
4080	ipconfig.exe
4080	ipconfig.exe
4080	ipconfig.exe
4080	ipconfig.exe
4080	ipconfig.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

2416 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

logagent.exeipconfig.exe

pid process

4012 logagent.exe
4012 logagent.exe
4012 logagent.exe
4080 ipconfig.exe
4080 ipconfig.exe

pid	process
2416	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

logagent.exeExplorer.EXEipconfig.exe

description	pid	process
Token: SeDebugPrivilege	4012	logagent.exe
Token: SeShutdownPrivilege	2416	Explorer.EXE
Token: SeCreatePagefilePrivilege	2416	Explorer.EXE
Token: SeDebugPrivilege	4080	ipconfig.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Bank swift.exeExplorer.EXEipconfig.exe

description	pid	process	target process
PID 4436 wrote to memory of 4012	4436	Bank swift.exe	logagent.exe
PID 4436 wrote to memory of 4012	4436	Bank swift.exe	logagent.exe
PID 4436 wrote to memory of 4012	4436	Bank swift.exe	logagent.exe
PID 4436 wrote to memory of 4012	4436	Bank swift.exe	logagent.exe
PID 4436 wrote to memory of 4012	4436	Bank swift.exe	logagent.exe
PID 4436 wrote to memory of 4012	4436	Bank swift.exe	logagent.exe
PID 2416 wrote to memory of 4080	2416	Explorer.EXE	ipconfig.exe
PID 2416 wrote to memory of 4080	2416	Explorer.EXE	ipconfig.exe
PID 2416 wrote to memory of 4080	2416	Explorer.EXE	ipconfig.exe
PID 4080 wrote to memory of 4200	4080	ipconfig.exe	cmd.exe
PID 4080 wrote to memory of 4200	4080	ipconfig.exe	cmd.exe
PID 4080 wrote to memory of 4200	4080	ipconfig.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2416

C:\Users\Admin\AppData\Local\Temp\Bank swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank swift.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:4436

C:\Windows\SysWOW64\logagent.exe
C:\Windows\System32\logagent.exe
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4012

C:\Windows\SysWOW64\ipconfig.exe
"C:\Windows\SysWOW64\ipconfig.exe"
2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4080

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Windows\SysWOW64\logagent.exe"
3⤵
PID:4200

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2416-124-0x0000000003260000-0x0000000003348000-memory.dmp

Filesize
928KB

Download
memory/2416-131-0x0000000005860000-0x0000000005946000-memory.dmp

Filesize
920KB

Download
memory/4012-122-0x00000000043B0000-0x00000000046D0000-memory.dmp

Filesize
3.1MB

Download
memory/4012-121-0x0000000010410000-0x000000001043D000-memory.dmp

Filesize
180KB

Download
memory/4012-120-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/4012-123-0x0000000000750000-0x00000000007B7000-memory.dmp

Filesize
412KB

Download
memory/4012-119-0x0000000000000000-mapping.dmp

Download
memory/4080-125-0x0000000000000000-mapping.dmp

Download
memory/4080-127-0x0000000002900000-0x000000000292D000-memory.dmp

Filesize
180KB

Download
memory/4080-126-0x00000000008F0000-0x00000000008FB000-memory.dmp

Filesize
44KB

Download
memory/4080-128-0x0000000003390000-0x00000000036B0000-memory.dmp

Filesize
3.1MB

Download
memory/4080-130-0x0000000003100000-0x0000000003193000-memory.dmp

Filesize
588KB

Download
memory/4200-129-0x0000000000000000-mapping.dmp

Download
memory/4436-114-0x00000000006F0000-0x00000000006F1000-memory.dmp

Filesize
4KB

Download
memory/4436-116-0x0000000002100000-0x000000000211A000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads