formbook | dd2e58b3398ea6d274ba7f993a66cd67fbb2654f73012763f50b309c8b56df38

General

Target

LPO PRECISION MESHES 2352104321QQ.pdf.exe
Size

926KB
MD5

23420e3ded198412f33ffa460e601764
SHA1

326f1bb9ea091b0e8d58852512ee08bed517c64b
SHA256

dd2e58b3398ea6d274ba7f993a66cd67fbb2654f73012763f50b309c8b56df38
SHA512

d7d4ba9b58142d75eba44533d0218eb179d4b9492f2c49ab8a5bad23e96330766cf59ed4394fb7f59d1f20385adb0e949015406f40f4677ef06f5d882a59668b

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

C2

http://www.magnumopuspro.com/nyr/

Decoy

anemone-vintage.com

ironcitytools.com

joshandmatthew.com

breathtakingscenery.photos

karabakh-terror.com

micahelgall.com

entretiendesterrasses.com

mhgholdings.com

blewm.com

sidewalknotary.com

ytrs-elec.com

danhpham.com

ma21cle2henz.xyz

lotusforlease.com

shipleyphotoandfilm.com

bulktool.xyz

ouedzmala.com

yichengvpr.com

connectmygames.com

chjcsc.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3860-125-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral2/memory/3860-126-0x000000000041EBA0-mapping.dmp	formbook
behavioral2/memory/1176-133-0x00000000007C0000-0x00000000007EE000-memory.dmp	formbook

Suspicious use of SetThreadContext 3 IoCs

Processes:

LPO PRECISION MESHES 2352104321QQ.pdf.exeLPO PRECISION MESHES 2352104321QQ.pdf.exehelp.exe

description	pid	process	target process
PID 2840 set thread context of 3860	2840	LPO PRECISION MESHES 2352104321QQ.pdf.exe	LPO PRECISION MESHES 2352104321QQ.pdf.exe
PID 3860 set thread context of 3020	3860	LPO PRECISION MESHES 2352104321QQ.pdf.exe	Explorer.EXE
PID 1176 set thread context of 3020	1176	help.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 21 IoCs

Processes:

LPO PRECISION MESHES 2352104321QQ.pdf.exeLPO PRECISION MESHES 2352104321QQ.pdf.exehelp.exe

pid	process
2840	LPO PRECISION MESHES 2352104321QQ.pdf.exe
2840	LPO PRECISION MESHES 2352104321QQ.pdf.exe
2840	LPO PRECISION MESHES 2352104321QQ.pdf.exe
3860	LPO PRECISION MESHES 2352104321QQ.pdf.exe
3860	LPO PRECISION MESHES 2352104321QQ.pdf.exe
3860	LPO PRECISION MESHES 2352104321QQ.pdf.exe
3860	LPO PRECISION MESHES 2352104321QQ.pdf.exe
1176	help.exe
1176	help.exe
1176	help.exe
1176	help.exe
1176	help.exe
1176	help.exe
1176	help.exe
1176	help.exe
1176	help.exe
1176	help.exe
1176	help.exe
1176	help.exe
1176	help.exe
1176	help.exe

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

LPO PRECISION MESHES 2352104321QQ.pdf.exehelp.exe

pid	process
3860	LPO PRECISION MESHES 2352104321QQ.pdf.exe
3860	LPO PRECISION MESHES 2352104321QQ.pdf.exe
3860	LPO PRECISION MESHES 2352104321QQ.pdf.exe
1176	help.exe
1176	help.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

LPO PRECISION MESHES 2352104321QQ.pdf.exeLPO PRECISION MESHES 2352104321QQ.pdf.exehelp.exe

description	pid	process
Token: SeDebugPrivilege	2840	LPO PRECISION MESHES 2352104321QQ.pdf.exe
Token: SeDebugPrivilege	3860	LPO PRECISION MESHES 2352104321QQ.pdf.exe
Token: SeDebugPrivilege	1176	help.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

LPO PRECISION MESHES 2352104321QQ.pdf.exeExplorer.EXEhelp.exe

description	pid	process	target process
PID 2840 wrote to memory of 3860	2840	LPO PRECISION MESHES 2352104321QQ.pdf.exe	LPO PRECISION MESHES 2352104321QQ.pdf.exe
PID 2840 wrote to memory of 3860	2840	LPO PRECISION MESHES 2352104321QQ.pdf.exe	LPO PRECISION MESHES 2352104321QQ.pdf.exe
PID 2840 wrote to memory of 3860	2840	LPO PRECISION MESHES 2352104321QQ.pdf.exe	LPO PRECISION MESHES 2352104321QQ.pdf.exe
PID 2840 wrote to memory of 3860	2840	LPO PRECISION MESHES 2352104321QQ.pdf.exe	LPO PRECISION MESHES 2352104321QQ.pdf.exe
PID 2840 wrote to memory of 3860	2840	LPO PRECISION MESHES 2352104321QQ.pdf.exe	LPO PRECISION MESHES 2352104321QQ.pdf.exe
PID 2840 wrote to memory of 3860	2840	LPO PRECISION MESHES 2352104321QQ.pdf.exe	LPO PRECISION MESHES 2352104321QQ.pdf.exe
PID 3020 wrote to memory of 1176	3020	Explorer.EXE	help.exe
PID 3020 wrote to memory of 1176	3020	Explorer.EXE	help.exe
PID 3020 wrote to memory of 1176	3020	Explorer.EXE	help.exe
PID 1176 wrote to memory of 2996	1176	help.exe	cmd.exe
PID 1176 wrote to memory of 2996	1176	help.exe	cmd.exe
PID 1176 wrote to memory of 2996	1176	help.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:3020

C:\Users\Admin\AppData\Local\Temp\LPO PRECISION MESHES 2352104321QQ.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\LPO PRECISION MESHES 2352104321QQ.pdf.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2840

C:\Users\Admin\AppData\Local\Temp\LPO PRECISION MESHES 2352104321QQ.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\LPO PRECISION MESHES 2352104321QQ.pdf.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3860

C:\Windows\SysWOW64\help.exe
"C:\Windows\SysWOW64\help.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1176

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\LPO PRECISION MESHES 2352104321QQ.pdf.exe"
3⤵
PID:2996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1176-131-0x0000000000000000-mapping.dmp

Download
memory/1176-136-0x0000000003420000-0x00000000034B3000-memory.dmp

Filesize
588KB

Download
memory/1176-135-0x0000000003100000-0x0000000003420000-memory.dmp

Filesize
3.1MB

Download
memory/1176-132-0x0000000000900000-0x0000000000907000-memory.dmp

Filesize
28KB

Download
memory/1176-133-0x00000000007C0000-0x00000000007EE000-memory.dmp

Filesize
184KB

Download
memory/2840-120-0x0000000005620000-0x0000000005621000-memory.dmp

Filesize
4KB

Download
memory/2840-122-0x00000000057E0000-0x00000000057E9000-memory.dmp

Filesize
36KB

Download
memory/2840-123-0x00000000070E0000-0x0000000007167000-memory.dmp

Filesize
540KB

Download
memory/2840-124-0x0000000001360000-0x00000000013A3000-memory.dmp

Filesize
268KB

Download
memory/2840-121-0x0000000005460000-0x000000000595E000-memory.dmp

Filesize
5.0MB

Download
memory/2840-116-0x0000000005310000-0x0000000005311000-memory.dmp

Filesize
4KB

Download
memory/2840-117-0x0000000005960000-0x0000000005961000-memory.dmp

Filesize
4KB

Download
memory/2840-114-0x0000000000A30000-0x0000000000A31000-memory.dmp

Filesize
4KB

Download
memory/2840-119-0x00000000053D0000-0x00000000053D1000-memory.dmp

Filesize
4KB

Download
memory/2840-118-0x0000000005460000-0x0000000005461000-memory.dmp

Filesize
4KB

Download
memory/2996-134-0x0000000000000000-mapping.dmp

Download
memory/3020-137-0x0000000004BD0000-0x0000000004CDE000-memory.dmp

Filesize
1.1MB

Download
memory/3020-129-0x0000000004A30000-0x0000000004BC3000-memory.dmp

Filesize
1.6MB

Download
memory/3860-125-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3860-128-0x0000000001A60000-0x0000000001D80000-memory.dmp

Filesize
3.1MB

Download
memory/3860-130-0x00000000019C0000-0x00000000019D4000-memory.dmp

Filesize
80KB

Download
memory/3860-126-0x000000000041EBA0-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads