formbook | 6444b0f41e6046055462a6b4837fdf509f403e01f3a3c46899548ec0ee9fbfdc

General

Target

5db1b401d54eb87dfe5260ba2f3a4077b692aac3.exe
Size

612KB
MD5

bdc8aab5dc8803a80050a28c39171069
SHA1

5db1b401d54eb87dfe5260ba2f3a4077b692aac3
SHA256

6444b0f41e6046055462a6b4837fdf509f403e01f3a3c46899548ec0ee9fbfdc
SHA512

a1dc7fbfe4009bf5aa44262399dd1caf18f7901e3c5ee70540ad58ab5a668db6040c461ff2debfbfb5edad0fec524193249fbb8313263772be65348369b707eb

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

C2

http://www.containerflippers.com/np0c/

Decoy

spartansurebets.com

threelakestradingco.com

metaspace.global

zjenbao.com

directlyincluded.press

peterchadri.com

learnhousebreaking.com

wonobattle.online

leadate.com

shebafarmscali.com

top4thejob.online

awakeyourfaith.com

bedford-st.com

lolwhats.com

cucurumbel.com

lokalbazaar.com

matter.pro

eastcountyanimalrescue.com

musesgirl.com

noordinarydairy.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1536-69-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/1536-70-0x000000000041EB90-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

5db1b401d54eb87dfe5260ba2f3a4077b692aac3.exe

description	pid	process	target process
PID 1840 set thread context of 1536	1840	5db1b401d54eb87dfe5260ba2f3a4077b692aac3.exe	5db1b401d54eb87dfe5260ba2f3a4077b692aac3.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

5db1b401d54eb87dfe5260ba2f3a4077b692aac3.exe5db1b401d54eb87dfe5260ba2f3a4077b692aac3.exe

pid process

1840 5db1b401d54eb87dfe5260ba2f3a4077b692aac3.exe
1536 5db1b401d54eb87dfe5260ba2f3a4077b692aac3.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

5db1b401d54eb87dfe5260ba2f3a4077b692aac3.exe

description pid process

Token: SeDebugPrivilege 1840 5db1b401d54eb87dfe5260ba2f3a4077b692aac3.exe

pid	process
1840	5db1b401d54eb87dfe5260ba2f3a4077b692aac3.exe
1536	5db1b401d54eb87dfe5260ba2f3a4077b692aac3.exe

description	pid	process
Token: SeDebugPrivilege	1840	5db1b401d54eb87dfe5260ba2f3a4077b692aac3.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

5db1b401d54eb87dfe5260ba2f3a4077b692aac3.exe

description	pid	process	target process
PID 1840 wrote to memory of 1536	1840	5db1b401d54eb87dfe5260ba2f3a4077b692aac3.exe	5db1b401d54eb87dfe5260ba2f3a4077b692aac3.exe
PID 1840 wrote to memory of 1536	1840	5db1b401d54eb87dfe5260ba2f3a4077b692aac3.exe	5db1b401d54eb87dfe5260ba2f3a4077b692aac3.exe
PID 1840 wrote to memory of 1536	1840	5db1b401d54eb87dfe5260ba2f3a4077b692aac3.exe	5db1b401d54eb87dfe5260ba2f3a4077b692aac3.exe
PID 1840 wrote to memory of 1536	1840	5db1b401d54eb87dfe5260ba2f3a4077b692aac3.exe	5db1b401d54eb87dfe5260ba2f3a4077b692aac3.exe
PID 1840 wrote to memory of 1536	1840	5db1b401d54eb87dfe5260ba2f3a4077b692aac3.exe	5db1b401d54eb87dfe5260ba2f3a4077b692aac3.exe
PID 1840 wrote to memory of 1536	1840	5db1b401d54eb87dfe5260ba2f3a4077b692aac3.exe	5db1b401d54eb87dfe5260ba2f3a4077b692aac3.exe
PID 1840 wrote to memory of 1536	1840	5db1b401d54eb87dfe5260ba2f3a4077b692aac3.exe	5db1b401d54eb87dfe5260ba2f3a4077b692aac3.exe

C:\Users\Admin\AppData\Local\Temp\5db1b401d54eb87dfe5260ba2f3a4077b692aac3.exe
"C:\Users\Admin\AppData\Local\Temp\5db1b401d54eb87dfe5260ba2f3a4077b692aac3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1840

C:\Users\Admin\AppData\Local\Temp\5db1b401d54eb87dfe5260ba2f3a4077b692aac3.exe
C:\Users\Admin\AppData\Local\Temp\5db1b401d54eb87dfe5260ba2f3a4077b692aac3.exe VGHBH
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1536

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1536-69-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1536-70-0x000000000041EB90-mapping.dmp

Download
memory/1536-71-0x0000000000990000-0x0000000000C93000-memory.dmp

Filesize
3.0MB

Download
memory/1840-59-0x0000000001380000-0x0000000001381000-memory.dmp

Filesize
4KB

Download
memory/1840-61-0x0000000004C60000-0x0000000004C61000-memory.dmp

Filesize
4KB

Download
memory/1840-62-0x00000000008B0000-0x000000000090C000-memory.dmp

Filesize
368KB

Download
memory/1840-67-0x0000000004FF0000-0x0000000005057000-memory.dmp

Filesize
412KB

Download
memory/1840-68-0x0000000004C65000-0x0000000004C76000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads