formbook | 147b79677b2a39e7e1b4691e4e8867444253e977813ecc4b49b56af43cfb3433

General

Target

KNNBHBL43590303005084SOB07Dec20TXL15Feb21/KNNBHBL43590303005084SOB07Dec20TXL15Feb21.exe
Size

542KB
MD5

71b8954c01a98f7f9efcd86388cab318
SHA1

fac366fa3660e1db0dfa2473fc805444bbfbb1f5
SHA256

af4150ab77918813e1f16480bac0fae2c80f0d77e7c205da5dc7220c08095890
SHA512

e0a346cd1f643dfe4af6d004aea39c68cdcbfe692cb205352c8be00f1f95324386f43e420b36057eda9ee1f97e9d2cec0dfd2c20afde106e1260ad45adca551e

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

C2

http://www.sportsbooksil.com/css/

Decoy

small-business-credit.com

waypsy.com

azerni.com

netzafe.com

crceg-eldjazair.com

minitruckwiki.com

lensdemy.com

cognitivecorridors.com

foxredart.com

m-groove.com

delevateagency.com

franklyspeakingtheword.com

iplleatheraccessories.com

print-and-ink.com

callpine.com

grydomarmy.com

washfoldndelivery.com

tarapharm.com

adairepalmer.com

jilbabsanaya.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/672-64-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/672-65-0x000000000041EB40-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

KNNBHBL43590303005084SOB07Dec20TXL15Feb21.exe

description	pid	process	target process
PID 1104 set thread context of 672	1104	KNNBHBL43590303005084SOB07Dec20TXL15Feb21.exe	KNNBHBL43590303005084SOB07Dec20TXL15Feb21.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

KNNBHBL43590303005084SOB07Dec20TXL15Feb21.exe

pid process

672 KNNBHBL43590303005084SOB07Dec20TXL15Feb21.exe

pid	process
672	KNNBHBL43590303005084SOB07Dec20TXL15Feb21.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

KNNBHBL43590303005084SOB07Dec20TXL15Feb21.exe

description	pid	process	target process
PID 1104 wrote to memory of 672	1104	KNNBHBL43590303005084SOB07Dec20TXL15Feb21.exe	KNNBHBL43590303005084SOB07Dec20TXL15Feb21.exe
PID 1104 wrote to memory of 672	1104	KNNBHBL43590303005084SOB07Dec20TXL15Feb21.exe	KNNBHBL43590303005084SOB07Dec20TXL15Feb21.exe
PID 1104 wrote to memory of 672	1104	KNNBHBL43590303005084SOB07Dec20TXL15Feb21.exe	KNNBHBL43590303005084SOB07Dec20TXL15Feb21.exe
PID 1104 wrote to memory of 672	1104	KNNBHBL43590303005084SOB07Dec20TXL15Feb21.exe	KNNBHBL43590303005084SOB07Dec20TXL15Feb21.exe
PID 1104 wrote to memory of 672	1104	KNNBHBL43590303005084SOB07Dec20TXL15Feb21.exe	KNNBHBL43590303005084SOB07Dec20TXL15Feb21.exe
PID 1104 wrote to memory of 672	1104	KNNBHBL43590303005084SOB07Dec20TXL15Feb21.exe	KNNBHBL43590303005084SOB07Dec20TXL15Feb21.exe
PID 1104 wrote to memory of 672	1104	KNNBHBL43590303005084SOB07Dec20TXL15Feb21.exe	KNNBHBL43590303005084SOB07Dec20TXL15Feb21.exe

C:\Users\Admin\AppData\Local\Temp\KNNBHBL43590303005084SOB07Dec20TXL15Feb21\KNNBHBL43590303005084SOB07Dec20TXL15Feb21.exe
"C:\Users\Admin\AppData\Local\Temp\KNNBHBL43590303005084SOB07Dec20TXL15Feb21\KNNBHBL43590303005084SOB07Dec20TXL15Feb21.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1104

C:\Users\Admin\AppData\Local\Temp\KNNBHBL43590303005084SOB07Dec20TXL15Feb21\KNNBHBL43590303005084SOB07Dec20TXL15Feb21.exe
"C:\Users\Admin\AppData\Local\Temp\KNNBHBL43590303005084SOB07Dec20TXL15Feb21\KNNBHBL43590303005084SOB07Dec20TXL15Feb21.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:672

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/672-64-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/672-65-0x000000000041EB40-mapping.dmp

Download
memory/672-66-0x0000000000A00000-0x0000000000D03000-memory.dmp

Filesize
3.0MB

Download
memory/1104-59-0x0000000000060000-0x0000000000061000-memory.dmp

Filesize
4KB

Download
memory/1104-61-0x0000000004BD0000-0x0000000004BD1000-memory.dmp

Filesize
4KB

Download
memory/1104-62-0x00000000006B0000-0x00000000006B4000-memory.dmp

Filesize
16KB

Download
memory/1104-63-0x0000000001F90000-0x0000000001FEB000-memory.dmp

Filesize
364KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads