formbook | 8a8cc0347be5e13c27bbb82822db989e8c47896d8e23944a8f5f419f4b6989ee

General

Target

c71f136a10c7c2f067f0a551a48f8ff6.exe
Size

886KB
MD5

c71f136a10c7c2f067f0a551a48f8ff6
SHA1

a3bfac3f71eb6b1e1519d42ec8e01f4aff4d8d5a
SHA256

8a8cc0347be5e13c27bbb82822db989e8c47896d8e23944a8f5f419f4b6989ee
SHA512

11623a0118b5cb78ae77ec9c5f119e2c530614c295b297d27858b188846555918b8fdf4eec8a5fb04952ffa6af35bdc4c584c2805de9e991bf12fb3ca2db1d90

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

C2

http://www.share-event.info/wlns/

Decoy

travelagentngapali.com

cassandraclub.com

yuanhenghuanwei.com

rellimsewil.com

servingsunshine.com

guniverse.net

livingonresidual.net

fourmid.com

batesandmills.com

produtos-servicos.website

pokemonteambuilder.team

ticeye.com

latituderc.com

xn--ok0bv0wfrj.com

strinix.com

nycmama.com

sljy8888.com

lifeinsurancerd.com

osdbapi.com

xydwnzavp.asia

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/332-65-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/332-66-0x000000000041EB50-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

c71f136a10c7c2f067f0a551a48f8ff6.exe

description pid process target process

PID 1908 set thread context of 332 1908 c71f136a10c7c2f067f0a551a48f8ff6.exe c71f136a10c7c2f067f0a551a48f8ff6.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

c71f136a10c7c2f067f0a551a48f8ff6.exe

pid process

332 c71f136a10c7c2f067f0a551a48f8ff6.exe

description	pid	process	target process
PID 1908 set thread context of 332	1908	c71f136a10c7c2f067f0a551a48f8ff6.exe	c71f136a10c7c2f067f0a551a48f8ff6.exe

pid	process
332	c71f136a10c7c2f067f0a551a48f8ff6.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

c71f136a10c7c2f067f0a551a48f8ff6.exe

description	pid	process	target process
PID 1908 wrote to memory of 332	1908	c71f136a10c7c2f067f0a551a48f8ff6.exe	c71f136a10c7c2f067f0a551a48f8ff6.exe
PID 1908 wrote to memory of 332	1908	c71f136a10c7c2f067f0a551a48f8ff6.exe	c71f136a10c7c2f067f0a551a48f8ff6.exe
PID 1908 wrote to memory of 332	1908	c71f136a10c7c2f067f0a551a48f8ff6.exe	c71f136a10c7c2f067f0a551a48f8ff6.exe
PID 1908 wrote to memory of 332	1908	c71f136a10c7c2f067f0a551a48f8ff6.exe	c71f136a10c7c2f067f0a551a48f8ff6.exe
PID 1908 wrote to memory of 332	1908	c71f136a10c7c2f067f0a551a48f8ff6.exe	c71f136a10c7c2f067f0a551a48f8ff6.exe
PID 1908 wrote to memory of 332	1908	c71f136a10c7c2f067f0a551a48f8ff6.exe	c71f136a10c7c2f067f0a551a48f8ff6.exe
PID 1908 wrote to memory of 332	1908	c71f136a10c7c2f067f0a551a48f8ff6.exe	c71f136a10c7c2f067f0a551a48f8ff6.exe

C:\Users\Admin\AppData\Local\Temp\c71f136a10c7c2f067f0a551a48f8ff6.exe
"C:\Users\Admin\AppData\Local\Temp\c71f136a10c7c2f067f0a551a48f8ff6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1908

C:\Users\Admin\AppData\Local\Temp\c71f136a10c7c2f067f0a551a48f8ff6.exe
"C:\Users\Admin\AppData\Local\Temp\c71f136a10c7c2f067f0a551a48f8ff6.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:332

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/332-65-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/332-66-0x000000000041EB50-mapping.dmp

Download
memory/332-68-0x0000000000930000-0x0000000000C33000-memory.dmp

Filesize
3.0MB

Download
memory/1908-59-0x0000000001170000-0x0000000001171000-memory.dmp

Filesize
4KB

Download
memory/1908-61-0x0000000004D90000-0x0000000004D91000-memory.dmp

Filesize
4KB

Download
memory/1908-62-0x00000000003C0000-0x00000000003CF000-memory.dmp

Filesize
60KB

Download
memory/1908-63-0x00000000050F0000-0x000000000516A000-memory.dmp

Filesize
488KB

Download
memory/1908-64-0x00000000005D0000-0x0000000000611000-memory.dmp

Filesize
260KB

Download

Analysis

Sharing