formbook | 6444b0f41e6046055462a6b4837fdf509f403e01f3a3c46899548ec0ee9fbfdc

General

Target

5db1b401d54eb87dfe5260ba2f3a4077b692aac3.exe
Size

612KB
MD5

bdc8aab5dc8803a80050a28c39171069
SHA1

5db1b401d54eb87dfe5260ba2f3a4077b692aac3
SHA256

6444b0f41e6046055462a6b4837fdf509f403e01f3a3c46899548ec0ee9fbfdc
SHA512

a1dc7fbfe4009bf5aa44262399dd1caf18f7901e3c5ee70540ad58ab5a668db6040c461ff2debfbfb5edad0fec524193249fbb8313263772be65348369b707eb

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

C2

http://www.containerflippers.com/np0c/

Decoy

spartansurebets.com

threelakestradingco.com

metaspace.global

zjenbao.com

directlyincluded.press

peterchadri.com

learnhousebreaking.com

wonobattle.online

leadate.com

shebafarmscali.com

top4thejob.online

awakeyourfaith.com

bedford-st.com

lolwhats.com

cucurumbel.com

lokalbazaar.com

matter.pro

eastcountyanimalrescue.com

musesgirl.com

noordinarydairy.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3296-128-0x000000000041EB90-mapping.dmp	formbook
behavioral2/memory/3296-127-0x0000000000400000-0x000000000042E000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

5db1b401d54eb87dfe5260ba2f3a4077b692aac3.exe

description	pid	process	target process
PID 4060 set thread context of 3296	4060	5db1b401d54eb87dfe5260ba2f3a4077b692aac3.exe	5db1b401d54eb87dfe5260ba2f3a4077b692aac3.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

5db1b401d54eb87dfe5260ba2f3a4077b692aac3.exe5db1b401d54eb87dfe5260ba2f3a4077b692aac3.exe

pid	process
4060	5db1b401d54eb87dfe5260ba2f3a4077b692aac3.exe
4060	5db1b401d54eb87dfe5260ba2f3a4077b692aac3.exe
3296	5db1b401d54eb87dfe5260ba2f3a4077b692aac3.exe
3296	5db1b401d54eb87dfe5260ba2f3a4077b692aac3.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

5db1b401d54eb87dfe5260ba2f3a4077b692aac3.exe

description pid process

Token: SeDebugPrivilege 4060 5db1b401d54eb87dfe5260ba2f3a4077b692aac3.exe

description	pid	process
Token: SeDebugPrivilege	4060	5db1b401d54eb87dfe5260ba2f3a4077b692aac3.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

5db1b401d54eb87dfe5260ba2f3a4077b692aac3.exe

description	pid	process	target process
PID 4060 wrote to memory of 3296	4060	5db1b401d54eb87dfe5260ba2f3a4077b692aac3.exe	5db1b401d54eb87dfe5260ba2f3a4077b692aac3.exe
PID 4060 wrote to memory of 3296	4060	5db1b401d54eb87dfe5260ba2f3a4077b692aac3.exe	5db1b401d54eb87dfe5260ba2f3a4077b692aac3.exe
PID 4060 wrote to memory of 3296	4060	5db1b401d54eb87dfe5260ba2f3a4077b692aac3.exe	5db1b401d54eb87dfe5260ba2f3a4077b692aac3.exe
PID 4060 wrote to memory of 3296	4060	5db1b401d54eb87dfe5260ba2f3a4077b692aac3.exe	5db1b401d54eb87dfe5260ba2f3a4077b692aac3.exe
PID 4060 wrote to memory of 3296	4060	5db1b401d54eb87dfe5260ba2f3a4077b692aac3.exe	5db1b401d54eb87dfe5260ba2f3a4077b692aac3.exe
PID 4060 wrote to memory of 3296	4060	5db1b401d54eb87dfe5260ba2f3a4077b692aac3.exe	5db1b401d54eb87dfe5260ba2f3a4077b692aac3.exe

C:\Users\Admin\AppData\Local\Temp\5db1b401d54eb87dfe5260ba2f3a4077b692aac3.exe
"C:\Users\Admin\AppData\Local\Temp\5db1b401d54eb87dfe5260ba2f3a4077b692aac3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4060

C:\Users\Admin\AppData\Local\Temp\5db1b401d54eb87dfe5260ba2f3a4077b692aac3.exe
C:\Users\Admin\AppData\Local\Temp\5db1b401d54eb87dfe5260ba2f3a4077b692aac3.exe VGHBH
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3296

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3296-128-0x000000000041EB90-mapping.dmp

Download
memory/3296-127-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3296-129-0x0000000001850000-0x0000000001B70000-memory.dmp

Filesize
3.1MB

Download
memory/4060-114-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/4060-116-0x0000000005140000-0x0000000005141000-memory.dmp

Filesize
4KB

Download
memory/4060-117-0x0000000004C40000-0x0000000004C41000-memory.dmp

Filesize
4KB

Download
memory/4060-118-0x0000000004CE0000-0x0000000004CE1000-memory.dmp

Filesize
4KB

Download
memory/4060-119-0x0000000004C40000-0x000000000513E000-memory.dmp

Filesize
5.0MB

Download
memory/4060-120-0x00000000066B0000-0x000000000670C000-memory.dmp

Filesize
368KB

Download
memory/4060-125-0x0000000007000000-0x0000000007067000-memory.dmp

Filesize
412KB

Download
memory/4060-126-0x0000000004C40000-0x000000000513E000-memory.dmp

Filesize
5.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads