formbook | f8e8f64bb17ffb2fea18b7671602a76a8b5734607c7a7ae035dce8eed8381a74

General

Target

INv02938727.exe
Size

702KB
MD5

a3b74acf9723e53d6caea736faae9708
SHA1

2714e0ec97d81921312f0db6470dc40f55d16b96
SHA256

f8e8f64bb17ffb2fea18b7671602a76a8b5734607c7a7ae035dce8eed8381a74
SHA512

e468c5146e35f8aae5536c7ce6c490b68588af0f71fd5d85d0b1dfe9b1831be55a2d9b8787035fc95e288f41c7ab7c4cf73965d6707bbfbe4685655ffbe4fa6b

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

C2

http://www.hometowncashbuyersgroup.com/kkt/

Decoy

inspirafutebol.com

customgiftshouston.com

mycreativelending.com

psplaystore.com

newlivingsolutionshop.com

dechefamsterdam.com

servicingl0ans.com

atsdholdings.com

manifestarz.com

sequenceanalytica.com

gethealthcaresmart.com

theartofsurprises.com

pirateequitypatrick.com

alliance-ce.com

wingrushusa.com

funtimespheres.com

solevux.com

antimasathya.com

profitexcavator.com

lankeboxshop.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/540-66-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/540-67-0x000000000041EBD0-mapping.dmp	formbook
behavioral1/memory/336-77-0x00000000000D0000-0x00000000000FE000-memory.dmp	formbook

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

440 cmd.exe

pid	process
440	cmd.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

INv02938727.exeINv02938727.exesystray.exe

description	pid	process	target process
PID 1796 set thread context of 540	1796	INv02938727.exe	INv02938727.exe
PID 540 set thread context of 1212	540	INv02938727.exe	Explorer.EXE
PID 540 set thread context of 1212	540	INv02938727.exe	Explorer.EXE
PID 336 set thread context of 1212	336	systray.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

INv02938727.exesystray.exe

pid process

540 INv02938727.exe
540 INv02938727.exe
540 INv02938727.exe
336 systray.exe
336 systray.exe
336 systray.exe
336 systray.exe
Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

INv02938727.exesystray.exe

pid process

540 INv02938727.exe
540 INv02938727.exe
540 INv02938727.exe
540 INv02938727.exe
336 systray.exe
336 systray.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

INv02938727.exesystray.exe

description pid process

Token: SeDebugPrivilege 540 INv02938727.exe
Token: SeDebugPrivilege 336 systray.exe

pid	process
540	INv02938727.exe
540	INv02938727.exe
540	INv02938727.exe
336	systray.exe
336	systray.exe
336	systray.exe
336	systray.exe

pid	process
540	INv02938727.exe
540	INv02938727.exe
540	INv02938727.exe
540	INv02938727.exe
336	systray.exe
336	systray.exe

description	pid	process
Token: SeDebugPrivilege	540	INv02938727.exe
Token: SeDebugPrivilege	336	systray.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

INv02938727.exeINv02938727.exesystray.exe

description	pid	process	target process
PID 1796 wrote to memory of 540	1796	INv02938727.exe	INv02938727.exe
PID 1796 wrote to memory of 540	1796	INv02938727.exe	INv02938727.exe
PID 1796 wrote to memory of 540	1796	INv02938727.exe	INv02938727.exe
PID 1796 wrote to memory of 540	1796	INv02938727.exe	INv02938727.exe
PID 1796 wrote to memory of 540	1796	INv02938727.exe	INv02938727.exe
PID 1796 wrote to memory of 540	1796	INv02938727.exe	INv02938727.exe
PID 1796 wrote to memory of 540	1796	INv02938727.exe	INv02938727.exe
PID 540 wrote to memory of 336	540	INv02938727.exe	systray.exe
PID 540 wrote to memory of 336	540	INv02938727.exe	systray.exe
PID 540 wrote to memory of 336	540	INv02938727.exe	systray.exe
PID 540 wrote to memory of 336	540	INv02938727.exe	systray.exe
PID 336 wrote to memory of 440	336	systray.exe	cmd.exe
PID 336 wrote to memory of 440	336	systray.exe	cmd.exe
PID 336 wrote to memory of 440	336	systray.exe	cmd.exe
PID 336 wrote to memory of 440	336	systray.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1212

C:\Users\Admin\AppData\Local\Temp\INv02938727.exe
"C:\Users\Admin\AppData\Local\Temp\INv02938727.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1796

C:\Users\Admin\AppData\Local\Temp\INv02938727.exe
"C:\Users\Admin\AppData\Local\Temp\INv02938727.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:540

C:\Windows\SysWOW64\systray.exe
"C:\Windows\SysWOW64\systray.exe"
4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:336

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\INv02938727.exe"
5⤵
- Deletes itself
PID:440

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/336-74-0x0000000000000000-mapping.dmp

Download
memory/336-79-0x00000000020D0000-0x0000000002163000-memory.dmp

Filesize
588KB

Download
memory/336-78-0x0000000001DC0000-0x00000000020C3000-memory.dmp

Filesize
3.0MB

Download
memory/336-77-0x00000000000D0000-0x00000000000FE000-memory.dmp

Filesize
184KB

Download
memory/336-76-0x0000000000310000-0x0000000000315000-memory.dmp

Filesize
20KB

Download
memory/440-75-0x0000000000000000-mapping.dmp

Download
memory/540-70-0x0000000000290000-0x00000000002A4000-memory.dmp

Filesize
80KB

Download
memory/540-69-0x0000000000C00000-0x0000000000F03000-memory.dmp

Filesize
3.0MB

Download
memory/540-72-0x0000000000530000-0x0000000000544000-memory.dmp

Filesize
80KB

Download
memory/540-67-0x000000000041EBD0-mapping.dmp

Download
memory/540-66-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1212-71-0x0000000002A90000-0x0000000002B4A000-memory.dmp

Filesize
744KB

Download
memory/1212-73-0x0000000004C60000-0x0000000004DB2000-memory.dmp

Filesize
1.3MB

Download
memory/1212-80-0x0000000004DC0000-0x0000000004ECC000-memory.dmp

Filesize
1.0MB

Download
memory/1796-60-0x0000000000B40000-0x0000000000B41000-memory.dmp

Filesize
4KB

Download
memory/1796-65-0x00000000020E0000-0x000000000211F000-memory.dmp

Filesize
252KB

Download
memory/1796-64-0x0000000004EA0000-0x0000000004F27000-memory.dmp

Filesize
540KB

Download
memory/1796-63-0x0000000000280000-0x000000000028E000-memory.dmp

Filesize
56KB

Download
memory/1796-62-0x0000000004C60000-0x0000000004C61000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads