formbook | 9c9dfbf8c44bbe594498ebf93efd84fcf73d66d9c6d5b86e9979afe5e9e9330c

General

Target

SecuriteInfo.com.Trojan.Win32.Save.a.1760.6134.exe
Size

2.4MB
MD5

6da8e0e9d3f4d31afc310050825cea27
SHA1

47512cec2a0608c17b01e9fdf40776ec99743cf0
SHA256

9c9dfbf8c44bbe594498ebf93efd84fcf73d66d9c6d5b86e9979afe5e9e9330c
SHA512

bb45fadb068eb2e2aaec99c609ebd3256ac038a506a548085d24191d1d9a993d627c0791e190aef561344bcb1897511e90f4bac96707e5099d07ec218af8871b

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

C2

http://www.intelliedgeclinical.net/god/

Decoy

aprendiz.digital

baby-rosy.com

buzzstreetnews.com

restoredscore.com

fullbeingphysician.com

gameonaustralia.com

famdns.com

compassionatecare-llc.com

yureb.com

bike-abruzzo.com

hibiskuricity.site

hindusetu.com

searchingkitsapcountyhomes.com

trespal.com

forenvid.com

gangnamstationithacany.com

roshan-prime.com

fsmstudio.com

bilecikvinckiralama.com

cash4urhousekeys.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/868-67-0x000000000041EBD0-mapping.dmp	formbook
behavioral1/memory/868-66-0x0000000000400000-0x000000000042E000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

SecuriteInfo.com.Trojan.Win32.Save.a.1760.6134.exe

description	pid	process	target process
PID 1200 set thread context of 868	1200	SecuriteInfo.com.Trojan.Win32.Save.a.1760.6134.exe	SecuriteInfo.com.Trojan.Win32.Save.a.1760.6134.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

SecuriteInfo.com.Trojan.Win32.Save.a.1760.6134.exe

pid process

868 SecuriteInfo.com.Trojan.Win32.Save.a.1760.6134.exe

pid	process
868	SecuriteInfo.com.Trojan.Win32.Save.a.1760.6134.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

SecuriteInfo.com.Trojan.Win32.Save.a.1760.6134.exe

description	pid	process	target process
PID 1200 wrote to memory of 868	1200	SecuriteInfo.com.Trojan.Win32.Save.a.1760.6134.exe	SecuriteInfo.com.Trojan.Win32.Save.a.1760.6134.exe
PID 1200 wrote to memory of 868	1200	SecuriteInfo.com.Trojan.Win32.Save.a.1760.6134.exe	SecuriteInfo.com.Trojan.Win32.Save.a.1760.6134.exe
PID 1200 wrote to memory of 868	1200	SecuriteInfo.com.Trojan.Win32.Save.a.1760.6134.exe	SecuriteInfo.com.Trojan.Win32.Save.a.1760.6134.exe
PID 1200 wrote to memory of 868	1200	SecuriteInfo.com.Trojan.Win32.Save.a.1760.6134.exe	SecuriteInfo.com.Trojan.Win32.Save.a.1760.6134.exe
PID 1200 wrote to memory of 868	1200	SecuriteInfo.com.Trojan.Win32.Save.a.1760.6134.exe	SecuriteInfo.com.Trojan.Win32.Save.a.1760.6134.exe
PID 1200 wrote to memory of 868	1200	SecuriteInfo.com.Trojan.Win32.Save.a.1760.6134.exe	SecuriteInfo.com.Trojan.Win32.Save.a.1760.6134.exe
PID 1200 wrote to memory of 868	1200	SecuriteInfo.com.Trojan.Win32.Save.a.1760.6134.exe	SecuriteInfo.com.Trojan.Win32.Save.a.1760.6134.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Win32.Save.a.1760.6134.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Win32.Save.a.1760.6134.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Win32.Save.a.1760.6134.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Win32.Save.a.1760.6134.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/868-67-0x000000000041EBD0-mapping.dmp

Download
memory/868-66-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/868-69-0x0000000000860000-0x0000000000B63000-memory.dmp

Filesize
3.0MB

Download
memory/1200-60-0x0000000000B80000-0x0000000000B81000-memory.dmp

Filesize
4KB

Download
memory/1200-62-0x0000000000590000-0x000000000059E000-memory.dmp

Filesize
56KB

Download
memory/1200-63-0x0000000004EB0000-0x0000000004EB1000-memory.dmp

Filesize
4KB

Download
memory/1200-64-0x00000000051F0000-0x000000000526E000-memory.dmp

Filesize
504KB

Download
memory/1200-65-0x00000000043D0000-0x0000000004405000-memory.dmp

Filesize
212KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads