formbook | 54469ace58ddcfdd6d834574d87003857b0cda05e27a0b8e31cb0b58e6ca105d

General

Target

318c866ef078ec6d9597aaebed8bc370.exe
Size

799KB
MD5

318c866ef078ec6d9597aaebed8bc370
SHA1

4d0008cb7d64f6fb5378672bc4a2edba43546e1f
SHA256

54469ace58ddcfdd6d834574d87003857b0cda05e27a0b8e31cb0b58e6ca105d
SHA512

cd32fd72eda19e8a2210a3b646b21cbee5b722672773a49c0e4dc02fdaad9c9fb99a60326eb1a9589e4b02b3e30eb85e2c5a3b5cfd767155f72fa123f9e68985

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

C2

http://www.survivai.com/bsdd/

Decoy

533dh.com

galerisikayet.xyz

tipsyalligator.com

crystalwellnessstudio.com

moovaap.com

lelfie.network

speedy-trips.com

prospectsolucoes.com

24x7customersservice.com

szbinsen.com

shikhardeals.com

totaldenta.com

ayksjx.com

avxrja.online

24kyule888.com

ufaw.net

spinozone.com

castvoicesmsreg.com

lajollawoodworks.com

renetyson.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/596-65-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/596-66-0x000000000041EB30-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

318c866ef078ec6d9597aaebed8bc370.exe

description pid process target process

PID 1088 set thread context of 596 1088 318c866ef078ec6d9597aaebed8bc370.exe 318c866ef078ec6d9597aaebed8bc370.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

318c866ef078ec6d9597aaebed8bc370.exe318c866ef078ec6d9597aaebed8bc370.exe

pid process

1088 318c866ef078ec6d9597aaebed8bc370.exe
596 318c866ef078ec6d9597aaebed8bc370.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

318c866ef078ec6d9597aaebed8bc370.exe

description pid process

Token: SeDebugPrivilege 1088 318c866ef078ec6d9597aaebed8bc370.exe

description	pid	process	target process
PID 1088 set thread context of 596	1088	318c866ef078ec6d9597aaebed8bc370.exe	318c866ef078ec6d9597aaebed8bc370.exe

pid	process
1088	318c866ef078ec6d9597aaebed8bc370.exe
596	318c866ef078ec6d9597aaebed8bc370.exe

description	pid	process
Token: SeDebugPrivilege	1088	318c866ef078ec6d9597aaebed8bc370.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

318c866ef078ec6d9597aaebed8bc370.exe

description	pid	process	target process
PID 1088 wrote to memory of 788	1088	318c866ef078ec6d9597aaebed8bc370.exe	318c866ef078ec6d9597aaebed8bc370.exe
PID 1088 wrote to memory of 788	1088	318c866ef078ec6d9597aaebed8bc370.exe	318c866ef078ec6d9597aaebed8bc370.exe
PID 1088 wrote to memory of 788	1088	318c866ef078ec6d9597aaebed8bc370.exe	318c866ef078ec6d9597aaebed8bc370.exe
PID 1088 wrote to memory of 788	1088	318c866ef078ec6d9597aaebed8bc370.exe	318c866ef078ec6d9597aaebed8bc370.exe
PID 1088 wrote to memory of 596	1088	318c866ef078ec6d9597aaebed8bc370.exe	318c866ef078ec6d9597aaebed8bc370.exe
PID 1088 wrote to memory of 596	1088	318c866ef078ec6d9597aaebed8bc370.exe	318c866ef078ec6d9597aaebed8bc370.exe
PID 1088 wrote to memory of 596	1088	318c866ef078ec6d9597aaebed8bc370.exe	318c866ef078ec6d9597aaebed8bc370.exe
PID 1088 wrote to memory of 596	1088	318c866ef078ec6d9597aaebed8bc370.exe	318c866ef078ec6d9597aaebed8bc370.exe
PID 1088 wrote to memory of 596	1088	318c866ef078ec6d9597aaebed8bc370.exe	318c866ef078ec6d9597aaebed8bc370.exe
PID 1088 wrote to memory of 596	1088	318c866ef078ec6d9597aaebed8bc370.exe	318c866ef078ec6d9597aaebed8bc370.exe
PID 1088 wrote to memory of 596	1088	318c866ef078ec6d9597aaebed8bc370.exe	318c866ef078ec6d9597aaebed8bc370.exe

C:\Users\Admin\AppData\Local\Temp\318c866ef078ec6d9597aaebed8bc370.exe
"C:\Users\Admin\AppData\Local\Temp\318c866ef078ec6d9597aaebed8bc370.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1088

C:\Users\Admin\AppData\Local\Temp\318c866ef078ec6d9597aaebed8bc370.exe
"C:\Users\Admin\AppData\Local\Temp\318c866ef078ec6d9597aaebed8bc370.exe"
2⤵
PID:788

C:\Users\Admin\AppData\Local\Temp\318c866ef078ec6d9597aaebed8bc370.exe
"C:\Users\Admin\AppData\Local\Temp\318c866ef078ec6d9597aaebed8bc370.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:596

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/596-65-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/596-66-0x000000000041EB30-mapping.dmp

Download
memory/596-68-0x0000000000A40000-0x0000000000D43000-memory.dmp

Filesize
3.0MB

Download
memory/1088-59-0x0000000000D70000-0x0000000000D71000-memory.dmp

Filesize
4KB

Download
memory/1088-61-0x0000000004E40000-0x0000000004E41000-memory.dmp

Filesize
4KB

Download
memory/1088-62-0x0000000000520000-0x000000000052F000-memory.dmp

Filesize
60KB

Download
memory/1088-63-0x0000000005BF0000-0x0000000005C6E000-memory.dmp

Filesize
504KB

Download
memory/1088-64-0x0000000004C50000-0x0000000004C94000-memory.dmp

Filesize
272KB

Download

Analysis

Sharing