formbook | 7b40c9c16df4b35ae04076a8afd38c4fe4bf5525bb388ea3871ec2371fa9e049

General

Target

77e9f5464c103f8fedf6ae500d87dd32.exe
Size

654KB
MD5

77e9f5464c103f8fedf6ae500d87dd32
SHA1

63ac44a904971f265decc404583bd3912c31cf02
SHA256

7b40c9c16df4b35ae04076a8afd38c4fe4bf5525bb388ea3871ec2371fa9e049
SHA512

4488ffcb12abd71d0e25ba10655085d5c876ea047a85cb8d02f1280442b998b85e3b8adadcd3a5e835b062fd27953fb05dc9a4c96e7f4cbe7869812a65fa2f6e

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

C2

http://www.yjhlgg.com/grve/

Decoy

jrvinganimalexterminator.com

smallsyalls.com

po1c3.com

mencg.com

aussieenjoyment.today

espace22.com

aanmelding-desk.info

gallopshoes.com

nftsexy.com

ricosdulcesmexicanos.com

riseswift.com

thechicthirty.com

matdcg.com

alternet.today

creativehuesdesigns.com

rjkcrafts.com

lowdosemortgage.com

adoptahamster.com

wellness-sense.com

jacardcapital.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

Processes:

resource	yara_rule
behavioral2/memory/3224-121-0x00000000053C0000-0x00000000053CB000-memory.dmp	CustAttr

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1272-124-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral2/memory/1272-125-0x000000000041EAF0-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

77e9f5464c103f8fedf6ae500d87dd32.exe

description pid process target process

PID 3224 set thread context of 1272 3224 77e9f5464c103f8fedf6ae500d87dd32.exe 77e9f5464c103f8fedf6ae500d87dd32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

77e9f5464c103f8fedf6ae500d87dd32.exe

pid process

1272 77e9f5464c103f8fedf6ae500d87dd32.exe
1272 77e9f5464c103f8fedf6ae500d87dd32.exe

description	pid	process	target process
PID 3224 set thread context of 1272	3224	77e9f5464c103f8fedf6ae500d87dd32.exe	77e9f5464c103f8fedf6ae500d87dd32.exe

pid	process
1272	77e9f5464c103f8fedf6ae500d87dd32.exe
1272	77e9f5464c103f8fedf6ae500d87dd32.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

77e9f5464c103f8fedf6ae500d87dd32.exe

description	pid	process	target process
PID 3224 wrote to memory of 1272	3224	77e9f5464c103f8fedf6ae500d87dd32.exe	77e9f5464c103f8fedf6ae500d87dd32.exe
PID 3224 wrote to memory of 1272	3224	77e9f5464c103f8fedf6ae500d87dd32.exe	77e9f5464c103f8fedf6ae500d87dd32.exe
PID 3224 wrote to memory of 1272	3224	77e9f5464c103f8fedf6ae500d87dd32.exe	77e9f5464c103f8fedf6ae500d87dd32.exe
PID 3224 wrote to memory of 1272	3224	77e9f5464c103f8fedf6ae500d87dd32.exe	77e9f5464c103f8fedf6ae500d87dd32.exe
PID 3224 wrote to memory of 1272	3224	77e9f5464c103f8fedf6ae500d87dd32.exe	77e9f5464c103f8fedf6ae500d87dd32.exe
PID 3224 wrote to memory of 1272	3224	77e9f5464c103f8fedf6ae500d87dd32.exe	77e9f5464c103f8fedf6ae500d87dd32.exe

C:\Users\Admin\AppData\Local\Temp\77e9f5464c103f8fedf6ae500d87dd32.exe
"C:\Users\Admin\AppData\Local\Temp\77e9f5464c103f8fedf6ae500d87dd32.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3224

C:\Users\Admin\AppData\Local\Temp\77e9f5464c103f8fedf6ae500d87dd32.exe
"C:\Users\Admin\AppData\Local\Temp\77e9f5464c103f8fedf6ae500d87dd32.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1272

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1272-124-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1272-125-0x000000000041EAF0-mapping.dmp

Download
memory/1272-126-0x0000000000F50000-0x0000000001270000-memory.dmp

Filesize
3.1MB

Download
memory/3224-114-0x00000000007C0000-0x00000000007C1000-memory.dmp

Filesize
4KB

Download
memory/3224-116-0x0000000005760000-0x0000000005761000-memory.dmp

Filesize
4KB

Download
memory/3224-117-0x0000000005160000-0x0000000005161000-memory.dmp

Filesize
4KB

Download
memory/3224-118-0x0000000005260000-0x0000000005261000-memory.dmp

Filesize
4KB

Download
memory/3224-119-0x0000000002C30000-0x0000000002C31000-memory.dmp

Filesize
4KB

Download
memory/3224-120-0x0000000005260000-0x000000000575E000-memory.dmp

Filesize
5.0MB

Download
memory/3224-121-0x00000000053C0000-0x00000000053CB000-memory.dmp

Filesize
44KB

Download
memory/3224-122-0x0000000007620000-0x000000000769B000-memory.dmp

Filesize
492KB

Download
memory/3224-123-0x00000000076E0000-0x0000000007716000-memory.dmp

Filesize
216KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads