formbook | dbabe793c3c52715587a80d2d5ab900cb3908465873809c244ac926114c17194

General

Target

bdeac23022bd4b5499d23471e51d2c96c2048475f72da65a98064b551d3d72b9.exe
Size

511KB
MD5

bacc243ec00ce90570cde50f458e1d1d
SHA1

bf6c61f77a8e79890f88c1fdb84e640f60a83b13
SHA256

bdeac23022bd4b5499d23471e51d2c96c2048475f72da65a98064b551d3d72b9
SHA512

607043ae17e0432f78bebe32b4e3ab88631795a8981c738c1fa61a721e3ef45f4da1a446482fb9ee39956cf39fc3cfe32b51c7853e7caffd63064290518d0155

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

C2

http://www.orchardviewbostons.com/g65/

Decoy

axsnaplp.icu

hmizat-khouribga.com

dishantnarang.com

ratchakarn.net

seatoskyphotos.com

emodel88.com

rajroyalepromoters.com

lzsfdnrm.com

premierpropertiesms.com

embodimentawareness.com

xn--q3ca0aaec3a1i6ah5eyf5a.com

yc8807.com

communitycouponbook.com

commercialbeach.com

elnurtic.com

edancesportradio.net

forcedir.com

zgzhzm.com

top-specials99.com

redwoodvisitor.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2232-124-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral2/memory/2232-125-0x000000000041EE10-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

bdeac23022bd4b5499d23471e51d2c96c2048475f72da65a98064b551d3d72b9.exe

description	pid	process	target process
PID 900 set thread context of 2232	900	bdeac23022bd4b5499d23471e51d2c96c2048475f72da65a98064b551d3d72b9.exe	bdeac23022bd4b5499d23471e51d2c96c2048475f72da65a98064b551d3d72b9.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

bdeac23022bd4b5499d23471e51d2c96c2048475f72da65a98064b551d3d72b9.exe

pid	process
2232	bdeac23022bd4b5499d23471e51d2c96c2048475f72da65a98064b551d3d72b9.exe
2232	bdeac23022bd4b5499d23471e51d2c96c2048475f72da65a98064b551d3d72b9.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

bdeac23022bd4b5499d23471e51d2c96c2048475f72da65a98064b551d3d72b9.exe

description	pid	process	target process
PID 900 wrote to memory of 2232	900	bdeac23022bd4b5499d23471e51d2c96c2048475f72da65a98064b551d3d72b9.exe	bdeac23022bd4b5499d23471e51d2c96c2048475f72da65a98064b551d3d72b9.exe
PID 900 wrote to memory of 2232	900	bdeac23022bd4b5499d23471e51d2c96c2048475f72da65a98064b551d3d72b9.exe	bdeac23022bd4b5499d23471e51d2c96c2048475f72da65a98064b551d3d72b9.exe
PID 900 wrote to memory of 2232	900	bdeac23022bd4b5499d23471e51d2c96c2048475f72da65a98064b551d3d72b9.exe	bdeac23022bd4b5499d23471e51d2c96c2048475f72da65a98064b551d3d72b9.exe
PID 900 wrote to memory of 2232	900	bdeac23022bd4b5499d23471e51d2c96c2048475f72da65a98064b551d3d72b9.exe	bdeac23022bd4b5499d23471e51d2c96c2048475f72da65a98064b551d3d72b9.exe
PID 900 wrote to memory of 2232	900	bdeac23022bd4b5499d23471e51d2c96c2048475f72da65a98064b551d3d72b9.exe	bdeac23022bd4b5499d23471e51d2c96c2048475f72da65a98064b551d3d72b9.exe
PID 900 wrote to memory of 2232	900	bdeac23022bd4b5499d23471e51d2c96c2048475f72da65a98064b551d3d72b9.exe	bdeac23022bd4b5499d23471e51d2c96c2048475f72da65a98064b551d3d72b9.exe

C:\Users\Admin\AppData\Local\Temp\bdeac23022bd4b5499d23471e51d2c96c2048475f72da65a98064b551d3d72b9.exe
"C:\Users\Admin\AppData\Local\Temp\bdeac23022bd4b5499d23471e51d2c96c2048475f72da65a98064b551d3d72b9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:900

C:\Users\Admin\AppData\Local\Temp\bdeac23022bd4b5499d23471e51d2c96c2048475f72da65a98064b551d3d72b9.exe
"C:\Users\Admin\AppData\Local\Temp\bdeac23022bd4b5499d23471e51d2c96c2048475f72da65a98064b551d3d72b9.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2232

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/900-114-0x0000000000F90000-0x0000000000F91000-memory.dmp

Filesize
4KB

Download
memory/900-116-0x0000000005940000-0x0000000005941000-memory.dmp

Filesize
4KB

Download
memory/900-117-0x0000000005F80000-0x0000000005F81000-memory.dmp

Filesize
4KB

Download
memory/900-118-0x0000000005B20000-0x0000000005B21000-memory.dmp

Filesize
4KB

Download
memory/900-119-0x00000000058A0000-0x000000000593C000-memory.dmp

Filesize
624KB

Download
memory/900-120-0x0000000005A10000-0x0000000005A11000-memory.dmp

Filesize
4KB

Download
memory/900-121-0x0000000005C80000-0x0000000005C81000-memory.dmp

Filesize
4KB

Download
memory/900-122-0x0000000005D30000-0x0000000005D34000-memory.dmp

Filesize
16KB

Download
memory/900-123-0x00000000016C0000-0x000000000171B000-memory.dmp

Filesize
364KB

Download
memory/2232-124-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2232-125-0x000000000041EE10-mapping.dmp

Download
memory/2232-126-0x00000000014E0000-0x0000000001800000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads