formbook | a87d0fe01c64e340eb6cb2aa36e4d27dcc5002b85573b0e9933e709e4e388621

General

Target

a47c9823ccdf9e53c683ea1cc9b68caf.exe
Size

636KB
MD5

a47c9823ccdf9e53c683ea1cc9b68caf
SHA1

59b28ad9022478f383b3244ba254d30a3355258d
SHA256

a87d0fe01c64e340eb6cb2aa36e4d27dcc5002b85573b0e9933e709e4e388621
SHA512

9c04637631f58023f123cb2c58eb736b1047bf2c494e70c9c3e4f6395d63898d9cae0281f050b044f21f52ab3eeab9f40b7a1aad9c6621054d833faba3295aa8

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

C2

http://www.contactodirectoseguros.com/x0h/

Decoy

recyclenara.com

digirryte.com

hesora.com

friendnancial.com

togetherepiscopal.com

gabilan.net

caribbeanjewelz.com

innovativeiclass.com

weddingrebels.com

underarmoutteamuniforms.com

buettner-freierede.com

3dxeroxprint.com

nationaltaekwondomuseum.com

specnazshow.com

yongle52844253.com

netacradle.com

tiffany-michellebodywhipt.com

goltrongame.com

yunusenvironmenthub.com

shopbirdbutique.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3972-126-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral2/memory/3972-127-0x000000000041EB90-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

a47c9823ccdf9e53c683ea1cc9b68caf.exe

description pid process target process

PID 3176 set thread context of 3972 3176 a47c9823ccdf9e53c683ea1cc9b68caf.exe a47c9823ccdf9e53c683ea1cc9b68caf.exe

description	pid	process	target process
PID 3176 set thread context of 3972	3176	a47c9823ccdf9e53c683ea1cc9b68caf.exe	a47c9823ccdf9e53c683ea1cc9b68caf.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

a47c9823ccdf9e53c683ea1cc9b68caf.exea47c9823ccdf9e53c683ea1cc9b68caf.exe

pid	process
3176	a47c9823ccdf9e53c683ea1cc9b68caf.exe
3176	a47c9823ccdf9e53c683ea1cc9b68caf.exe
3176	a47c9823ccdf9e53c683ea1cc9b68caf.exe
3176	a47c9823ccdf9e53c683ea1cc9b68caf.exe
3176	a47c9823ccdf9e53c683ea1cc9b68caf.exe
3972	a47c9823ccdf9e53c683ea1cc9b68caf.exe
3972	a47c9823ccdf9e53c683ea1cc9b68caf.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a47c9823ccdf9e53c683ea1cc9b68caf.exe

description pid process

Token: SeDebugPrivilege 3176 a47c9823ccdf9e53c683ea1cc9b68caf.exe

description	pid	process
Token: SeDebugPrivilege	3176	a47c9823ccdf9e53c683ea1cc9b68caf.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

a47c9823ccdf9e53c683ea1cc9b68caf.exe

description	pid	process	target process
PID 3176 wrote to memory of 2680	3176	a47c9823ccdf9e53c683ea1cc9b68caf.exe	a47c9823ccdf9e53c683ea1cc9b68caf.exe
PID 3176 wrote to memory of 2680	3176	a47c9823ccdf9e53c683ea1cc9b68caf.exe	a47c9823ccdf9e53c683ea1cc9b68caf.exe
PID 3176 wrote to memory of 2680	3176	a47c9823ccdf9e53c683ea1cc9b68caf.exe	a47c9823ccdf9e53c683ea1cc9b68caf.exe
PID 3176 wrote to memory of 3972	3176	a47c9823ccdf9e53c683ea1cc9b68caf.exe	a47c9823ccdf9e53c683ea1cc9b68caf.exe
PID 3176 wrote to memory of 3972	3176	a47c9823ccdf9e53c683ea1cc9b68caf.exe	a47c9823ccdf9e53c683ea1cc9b68caf.exe
PID 3176 wrote to memory of 3972	3176	a47c9823ccdf9e53c683ea1cc9b68caf.exe	a47c9823ccdf9e53c683ea1cc9b68caf.exe
PID 3176 wrote to memory of 3972	3176	a47c9823ccdf9e53c683ea1cc9b68caf.exe	a47c9823ccdf9e53c683ea1cc9b68caf.exe
PID 3176 wrote to memory of 3972	3176	a47c9823ccdf9e53c683ea1cc9b68caf.exe	a47c9823ccdf9e53c683ea1cc9b68caf.exe
PID 3176 wrote to memory of 3972	3176	a47c9823ccdf9e53c683ea1cc9b68caf.exe	a47c9823ccdf9e53c683ea1cc9b68caf.exe

C:\Users\Admin\AppData\Local\Temp\a47c9823ccdf9e53c683ea1cc9b68caf.exe
"C:\Users\Admin\AppData\Local\Temp\a47c9823ccdf9e53c683ea1cc9b68caf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3176

C:\Users\Admin\AppData\Local\Temp\a47c9823ccdf9e53c683ea1cc9b68caf.exe
"C:\Users\Admin\AppData\Local\Temp\a47c9823ccdf9e53c683ea1cc9b68caf.exe"
2⤵
PID:2680

C:\Users\Admin\AppData\Local\Temp\a47c9823ccdf9e53c683ea1cc9b68caf.exe
"C:\Users\Admin\AppData\Local\Temp\a47c9823ccdf9e53c683ea1cc9b68caf.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3972

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3176-114-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/3176-116-0x0000000004F10000-0x0000000004F11000-memory.dmp

Filesize
4KB

Download
memory/3176-117-0x00000000054B0000-0x00000000054B1000-memory.dmp

Filesize
4KB

Download
memory/3176-118-0x0000000005050000-0x0000000005051000-memory.dmp

Filesize
4KB

Download
memory/3176-119-0x0000000004FC0000-0x0000000004FC1000-memory.dmp

Filesize
4KB

Download
memory/3176-120-0x0000000005230000-0x0000000005231000-memory.dmp

Filesize
4KB

Download
memory/3176-121-0x0000000005440000-0x0000000005449000-memory.dmp

Filesize
36KB

Download
memory/3176-123-0x000000007FAF0000-0x000000007FAF1000-memory.dmp

Filesize
4KB

Download
memory/3176-122-0x0000000004FB0000-0x00000000054AE000-memory.dmp

Filesize
5.0MB

Download
memory/3176-124-0x0000000005E00000-0x0000000005E87000-memory.dmp

Filesize
540KB

Download
memory/3176-125-0x0000000000FD0000-0x0000000001013000-memory.dmp

Filesize
268KB

Download
memory/3972-126-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3972-127-0x000000000041EB90-mapping.dmp

Download
memory/3972-129-0x00000000016E0000-0x0000000001A00000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads