formbook | f8e8f64bb17ffb2fea18b7671602a76a8b5734607c7a7ae035dce8eed8381a74

General

Target

INv02938727.exe
Size

702KB
MD5

a3b74acf9723e53d6caea736faae9708
SHA1

2714e0ec97d81921312f0db6470dc40f55d16b96
SHA256

f8e8f64bb17ffb2fea18b7671602a76a8b5734607c7a7ae035dce8eed8381a74
SHA512

e468c5146e35f8aae5536c7ce6c490b68588af0f71fd5d85d0b1dfe9b1831be55a2d9b8787035fc95e288f41c7ab7c4cf73965d6707bbfbe4685655ffbe4fa6b

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

C2

http://www.hometowncashbuyersgroup.com/kkt/

Decoy

inspirafutebol.com

customgiftshouston.com

mycreativelending.com

psplaystore.com

newlivingsolutionshop.com

dechefamsterdam.com

servicingl0ans.com

atsdholdings.com

manifestarz.com

sequenceanalytica.com

gethealthcaresmart.com

theartofsurprises.com

pirateequitypatrick.com

alliance-ce.com

wingrushusa.com

funtimespheres.com

solevux.com

antimasathya.com

profitexcavator.com

lankeboxshop.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3984-125-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral2/memory/3984-126-0x000000000041EBD0-mapping.dmp	formbook
behavioral2/memory/3908-134-0x0000000001190000-0x00000000011BE000-memory.dmp	formbook

Suspicious use of SetThreadContext 3 IoCs

Processes:

INv02938727.exeINv02938727.exenetsh.exe

description	pid	process	target process
PID 4660 set thread context of 3984	4660	INv02938727.exe	INv02938727.exe
PID 3984 set thread context of 3048	3984	INv02938727.exe	Explorer.EXE
PID 3908 set thread context of 3048	3908	netsh.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

INv02938727.exenetsh.exe

pid	process
3984	INv02938727.exe
3984	INv02938727.exe
3984	INv02938727.exe
3984	INv02938727.exe
3908	netsh.exe
3908	netsh.exe
3908	netsh.exe
3908	netsh.exe
3908	netsh.exe
3908	netsh.exe
3908	netsh.exe
3908	netsh.exe
3908	netsh.exe
3908	netsh.exe

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

INv02938727.exenetsh.exe

pid process

3984 INv02938727.exe
3984 INv02938727.exe
3984 INv02938727.exe
3908 netsh.exe
3908 netsh.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

INv02938727.exenetsh.exe

description pid process

Token: SeDebugPrivilege 3984 INv02938727.exe
Token: SeDebugPrivilege 3908 netsh.exe

description	pid	process
Token: SeDebugPrivilege	3984	INv02938727.exe
Token: SeDebugPrivilege	3908	netsh.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

INv02938727.exeExplorer.EXEnetsh.exe

description	pid	process	target process
PID 4660 wrote to memory of 3984	4660	INv02938727.exe	INv02938727.exe
PID 4660 wrote to memory of 3984	4660	INv02938727.exe	INv02938727.exe
PID 4660 wrote to memory of 3984	4660	INv02938727.exe	INv02938727.exe
PID 4660 wrote to memory of 3984	4660	INv02938727.exe	INv02938727.exe
PID 4660 wrote to memory of 3984	4660	INv02938727.exe	INv02938727.exe
PID 4660 wrote to memory of 3984	4660	INv02938727.exe	INv02938727.exe
PID 3048 wrote to memory of 3908	3048	Explorer.EXE	netsh.exe
PID 3048 wrote to memory of 3908	3048	Explorer.EXE	netsh.exe
PID 3048 wrote to memory of 3908	3048	Explorer.EXE	netsh.exe
PID 3908 wrote to memory of 4188	3908	netsh.exe	cmd.exe
PID 3908 wrote to memory of 4188	3908	netsh.exe	cmd.exe
PID 3908 wrote to memory of 4188	3908	netsh.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:3048

C:\Users\Admin\AppData\Local\Temp\INv02938727.exe
"C:\Users\Admin\AppData\Local\Temp\INv02938727.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4660

C:\Users\Admin\AppData\Local\Temp\INv02938727.exe
"C:\Users\Admin\AppData\Local\Temp\INv02938727.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3984

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\SysWOW64\netsh.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3908

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\INv02938727.exe"
3⤵
PID:4188

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3048-130-0x0000000006150000-0x00000000062D8000-memory.dmp

Filesize
1.5MB

Download
memory/3048-137-0x00000000029B0000-0x0000000002A54000-memory.dmp

Filesize
656KB

Download
memory/3908-136-0x0000000003940000-0x00000000039D3000-memory.dmp

Filesize
588KB

Download
memory/3908-133-0x0000000001630000-0x000000000164E000-memory.dmp

Filesize
120KB

Download
memory/3908-135-0x00000000039E0000-0x0000000003D00000-memory.dmp

Filesize
3.1MB

Download
memory/3908-134-0x0000000001190000-0x00000000011BE000-memory.dmp

Filesize
184KB

Download
memory/3908-131-0x0000000000000000-mapping.dmp

Download
memory/3984-125-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3984-128-0x00000000011D0000-0x00000000014F0000-memory.dmp

Filesize
3.1MB

Download
memory/3984-129-0x00000000014F0000-0x0000000001504000-memory.dmp

Filesize
80KB

Download
memory/3984-126-0x000000000041EBD0-mapping.dmp

Download
memory/4188-132-0x0000000000000000-mapping.dmp

Download
memory/4660-122-0x0000000005E30000-0x0000000005E3E000-memory.dmp

Filesize
56KB

Download
memory/4660-114-0x0000000000FA0000-0x0000000000FA1000-memory.dmp

Filesize
4KB

Download
memory/4660-123-0x00000000031F0000-0x0000000003277000-memory.dmp

Filesize
540KB

Download
memory/4660-121-0x0000000005B20000-0x000000000601E000-memory.dmp

Filesize
5.0MB

Download
memory/4660-124-0x0000000001580000-0x00000000015BF000-memory.dmp

Filesize
252KB

Download
memory/4660-120-0x0000000005B20000-0x0000000005B21000-memory.dmp

Filesize
4KB

Download
memory/4660-119-0x00000000059A0000-0x00000000059A1000-memory.dmp

Filesize
4KB

Download
memory/4660-118-0x0000000005BC0000-0x0000000005BC1000-memory.dmp

Filesize
4KB

Download
memory/4660-117-0x0000000006020000-0x0000000006021000-memory.dmp

Filesize
4KB

Download
memory/4660-116-0x00000000059E0000-0x00000000059E1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads