formbook | f8e8f64bb17ffb2fea18b7671602a76a8b5734607c7a7ae035dce8eed8381a74

General

Target

INv02938727.exe
Size

702KB
MD5

a3b74acf9723e53d6caea736faae9708
SHA1

2714e0ec97d81921312f0db6470dc40f55d16b96
SHA256

f8e8f64bb17ffb2fea18b7671602a76a8b5734607c7a7ae035dce8eed8381a74
SHA512

e468c5146e35f8aae5536c7ce6c490b68588af0f71fd5d85d0b1dfe9b1831be55a2d9b8787035fc95e288f41c7ab7c4cf73965d6707bbfbe4685655ffbe4fa6b

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

C2

http://www.hometowncashbuyersgroup.com/kkt/

Decoy

inspirafutebol.com

customgiftshouston.com

mycreativelending.com

psplaystore.com

newlivingsolutionshop.com

dechefamsterdam.com

servicingl0ans.com

atsdholdings.com

manifestarz.com

sequenceanalytica.com

gethealthcaresmart.com

theartofsurprises.com

pirateequitypatrick.com

alliance-ce.com

wingrushusa.com

funtimespheres.com

solevux.com

antimasathya.com

profitexcavator.com

lankeboxshop.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1084-67-0x000000000041EBD0-mapping.dmp	formbook
behavioral1/memory/1084-66-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/1480-78-0x00000000000D0000-0x00000000000FE000-memory.dmp	formbook

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

828 cmd.exe

pid	process
828	cmd.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

INv02938727.exeINv02938727.exerundll32.exe

description	pid	process	target process
PID 1420 set thread context of 1084	1420	INv02938727.exe	INv02938727.exe
PID 1084 set thread context of 1288	1084	INv02938727.exe	Explorer.EXE
PID 1084 set thread context of 1288	1084	INv02938727.exe	Explorer.EXE
PID 1480 set thread context of 1288	1480	rundll32.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

INv02938727.exerundll32.exe

pid process

1084 INv02938727.exe
1084 INv02938727.exe
1084 INv02938727.exe
1480 rundll32.exe
1480 rundll32.exe
1480 rundll32.exe
1480 rundll32.exe
1480 rundll32.exe
Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

INv02938727.exerundll32.exe

pid process

1084 INv02938727.exe
1084 INv02938727.exe
1084 INv02938727.exe
1084 INv02938727.exe
1480 rundll32.exe
1480 rundll32.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

INv02938727.exerundll32.exe

description pid process

Token: SeDebugPrivilege 1084 INv02938727.exe
Token: SeDebugPrivilege 1480 rundll32.exe

pid	process
1084	INv02938727.exe
1084	INv02938727.exe
1084	INv02938727.exe
1480	rundll32.exe
1480	rundll32.exe
1480	rundll32.exe
1480	rundll32.exe
1480	rundll32.exe

pid	process
1084	INv02938727.exe
1084	INv02938727.exe
1084	INv02938727.exe
1084	INv02938727.exe
1480	rundll32.exe
1480	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	1084	INv02938727.exe
Token: SeDebugPrivilege	1480	rundll32.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

INv02938727.exeExplorer.EXErundll32.exe

description	pid	process	target process
PID 1420 wrote to memory of 1084	1420	INv02938727.exe	INv02938727.exe
PID 1420 wrote to memory of 1084	1420	INv02938727.exe	INv02938727.exe
PID 1420 wrote to memory of 1084	1420	INv02938727.exe	INv02938727.exe
PID 1420 wrote to memory of 1084	1420	INv02938727.exe	INv02938727.exe
PID 1420 wrote to memory of 1084	1420	INv02938727.exe	INv02938727.exe
PID 1420 wrote to memory of 1084	1420	INv02938727.exe	INv02938727.exe
PID 1420 wrote to memory of 1084	1420	INv02938727.exe	INv02938727.exe
PID 1288 wrote to memory of 1480	1288	Explorer.EXE	rundll32.exe
PID 1288 wrote to memory of 1480	1288	Explorer.EXE	rundll32.exe
PID 1288 wrote to memory of 1480	1288	Explorer.EXE	rundll32.exe
PID 1288 wrote to memory of 1480	1288	Explorer.EXE	rundll32.exe
PID 1288 wrote to memory of 1480	1288	Explorer.EXE	rundll32.exe
PID 1288 wrote to memory of 1480	1288	Explorer.EXE	rundll32.exe
PID 1288 wrote to memory of 1480	1288	Explorer.EXE	rundll32.exe
PID 1480 wrote to memory of 828	1480	rundll32.exe	cmd.exe
PID 1480 wrote to memory of 828	1480	rundll32.exe	cmd.exe
PID 1480 wrote to memory of 828	1480	rundll32.exe	cmd.exe
PID 1480 wrote to memory of 828	1480	rundll32.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:1288

C:\Users\Admin\AppData\Local\Temp\INv02938727.exe
"C:\Users\Admin\AppData\Local\Temp\INv02938727.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1420

C:\Users\Admin\AppData\Local\Temp\INv02938727.exe
"C:\Users\Admin\AppData\Local\Temp\INv02938727.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1084

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\SysWOW64\rundll32.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1480

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\INv02938727.exe"
3⤵
- Deletes itself
PID:828

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/828-76-0x0000000000000000-mapping.dmp

Download
memory/1084-72-0x0000000000270000-0x0000000000284000-memory.dmp

Filesize
80KB

Download
memory/1084-66-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1084-70-0x00000000001D0000-0x00000000001E4000-memory.dmp

Filesize
80KB

Download
memory/1084-69-0x00000000008B0000-0x0000000000BB3000-memory.dmp

Filesize
3.0MB

Download
memory/1084-67-0x000000000041EBD0-mapping.dmp

Download
memory/1288-81-0x0000000007090000-0x00000000071DE000-memory.dmp

Filesize
1.3MB

Download
memory/1288-71-0x0000000004A20000-0x0000000004B03000-memory.dmp

Filesize
908KB

Download
memory/1288-73-0x0000000007350000-0x00000000074D2000-memory.dmp

Filesize
1.5MB

Download
memory/1420-62-0x0000000000560000-0x000000000056E000-memory.dmp

Filesize
56KB

Download
memory/1420-64-0x0000000005050000-0x00000000050D7000-memory.dmp

Filesize
540KB

Download
memory/1420-63-0x00000000011E0000-0x00000000011E1000-memory.dmp

Filesize
4KB

Download
memory/1420-60-0x00000000012D0000-0x00000000012D1000-memory.dmp

Filesize
4KB

Download
memory/1420-65-0x0000000001150000-0x000000000118F000-memory.dmp

Filesize
252KB

Download
memory/1480-75-0x0000000074FB1000-0x0000000074FB3000-memory.dmp

Filesize
8KB

Download
memory/1480-77-0x0000000000310000-0x000000000031E000-memory.dmp

Filesize
56KB

Download
memory/1480-78-0x00000000000D0000-0x00000000000FE000-memory.dmp

Filesize
184KB

Download
memory/1480-79-0x0000000002260000-0x0000000002563000-memory.dmp

Filesize
3.0MB

Download
memory/1480-80-0x00000000004C0000-0x0000000000553000-memory.dmp

Filesize
588KB

Download
memory/1480-74-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads