formbook | dfe96798a6065c99050d1cb964200874b40e3916f90e3caed35df9ace3dc3198

General

Target

5ee375628c34cd0aa0833e24bc31087a.exe
Size

1.2MB
MD5

5ee375628c34cd0aa0833e24bc31087a
SHA1

1d8c406871a1969850fd31883f23b56cb0bf0380
SHA256

dfe96798a6065c99050d1cb964200874b40e3916f90e3caed35df9ace3dc3198
SHA512

8b2d3401ebdb16d0ccfd7daa80344e1c0970720da2b12899af6482828ab7fc353b462b3b252dc7b0177a320b1a75bb537c439b64ea7c683e299e7a2e48873b70

Score

10^/10

formbook kzk9 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

kzk9

C2

http://www.yourmajordomo.com/kzk9/

Decoy

tianconghuo.club

1996-page.com

ourtownmax.net

conservativetreehose.com

synth.repair

donnachicacreperia.com

tentfull.com

weapp.download

surfersink.com

gattlebusinessservices.com

sebastian249.com

anhphuc.company

betternatureproducts.net

defroplate.com

seattlesquidsquad.com

polarjob.com

lendingadvantage.com

angelsondope.com

goportjitney.com

tiendagrupojagr.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/564-66-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/564-67-0x000000000041EB80-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

5ee375628c34cd0aa0833e24bc31087a.exe

description pid process target process

PID 1836 set thread context of 564 1836 5ee375628c34cd0aa0833e24bc31087a.exe 5ee375628c34cd0aa0833e24bc31087a.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

5ee375628c34cd0aa0833e24bc31087a.exe

pid process

564 5ee375628c34cd0aa0833e24bc31087a.exe

description	pid	process	target process
PID 1836 set thread context of 564	1836	5ee375628c34cd0aa0833e24bc31087a.exe	5ee375628c34cd0aa0833e24bc31087a.exe

pid	process
564	5ee375628c34cd0aa0833e24bc31087a.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

5ee375628c34cd0aa0833e24bc31087a.exe

description	pid	process	target process
PID 1836 wrote to memory of 564	1836	5ee375628c34cd0aa0833e24bc31087a.exe	5ee375628c34cd0aa0833e24bc31087a.exe
PID 1836 wrote to memory of 564	1836	5ee375628c34cd0aa0833e24bc31087a.exe	5ee375628c34cd0aa0833e24bc31087a.exe
PID 1836 wrote to memory of 564	1836	5ee375628c34cd0aa0833e24bc31087a.exe	5ee375628c34cd0aa0833e24bc31087a.exe
PID 1836 wrote to memory of 564	1836	5ee375628c34cd0aa0833e24bc31087a.exe	5ee375628c34cd0aa0833e24bc31087a.exe
PID 1836 wrote to memory of 564	1836	5ee375628c34cd0aa0833e24bc31087a.exe	5ee375628c34cd0aa0833e24bc31087a.exe
PID 1836 wrote to memory of 564	1836	5ee375628c34cd0aa0833e24bc31087a.exe	5ee375628c34cd0aa0833e24bc31087a.exe
PID 1836 wrote to memory of 564	1836	5ee375628c34cd0aa0833e24bc31087a.exe	5ee375628c34cd0aa0833e24bc31087a.exe

C:\Users\Admin\AppData\Local\Temp\5ee375628c34cd0aa0833e24bc31087a.exe
"C:\Users\Admin\AppData\Local\Temp\5ee375628c34cd0aa0833e24bc31087a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1836

C:\Users\Admin\AppData\Local\Temp\5ee375628c34cd0aa0833e24bc31087a.exe
"C:\Users\Admin\AppData\Local\Temp\5ee375628c34cd0aa0833e24bc31087a.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:564

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/564-66-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/564-67-0x000000000041EB80-mapping.dmp

Download
memory/564-68-0x0000000000770000-0x0000000000A73000-memory.dmp

Filesize
3.0MB

Download
memory/1836-60-0x00000000013C0000-0x00000000013C1000-memory.dmp

Filesize
4KB

Download
memory/1836-62-0x0000000004CB0000-0x0000000004CB1000-memory.dmp

Filesize
4KB

Download
memory/1836-63-0x0000000000500000-0x0000000000511000-memory.dmp

Filesize
68KB

Download
memory/1836-64-0x0000000008080000-0x000000000811D000-memory.dmp

Filesize
628KB

Download
memory/1836-65-0x00000000008E0000-0x000000000090F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing