formbook | dfe96798a6065c99050d1cb964200874b40e3916f90e3caed35df9ace3dc3198

General

Target

5ee375628c34cd0aa0833e24bc31087a.exe
Size

1.2MB
MD5

5ee375628c34cd0aa0833e24bc31087a
SHA1

1d8c406871a1969850fd31883f23b56cb0bf0380
SHA256

dfe96798a6065c99050d1cb964200874b40e3916f90e3caed35df9ace3dc3198
SHA512

8b2d3401ebdb16d0ccfd7daa80344e1c0970720da2b12899af6482828ab7fc353b462b3b252dc7b0177a320b1a75bb537c439b64ea7c683e299e7a2e48873b70

Score

10^/10

formbook kzk9 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

kzk9

C2

http://www.yourmajordomo.com/kzk9/

Decoy

tianconghuo.club

1996-page.com

ourtownmax.net

conservativetreehose.com

synth.repair

donnachicacreperia.com

tentfull.com

weapp.download

surfersink.com

gattlebusinessservices.com

sebastian249.com

anhphuc.company

betternatureproducts.net

defroplate.com

seattlesquidsquad.com

polarjob.com

lendingadvantage.com

angelsondope.com

goportjitney.com

tiendagrupojagr.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1056-126-0x000000000041EB80-mapping.dmp	formbook
behavioral2/memory/1056-125-0x0000000000400000-0x000000000042E000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

5ee375628c34cd0aa0833e24bc31087a.exe

description pid process target process

PID 3896 set thread context of 1056 3896 5ee375628c34cd0aa0833e24bc31087a.exe 5ee375628c34cd0aa0833e24bc31087a.exe

description	pid	process	target process
PID 3896 set thread context of 1056	3896	5ee375628c34cd0aa0833e24bc31087a.exe	5ee375628c34cd0aa0833e24bc31087a.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

5ee375628c34cd0aa0833e24bc31087a.exe5ee375628c34cd0aa0833e24bc31087a.exe

pid	process
3896	5ee375628c34cd0aa0833e24bc31087a.exe
3896	5ee375628c34cd0aa0833e24bc31087a.exe
3896	5ee375628c34cd0aa0833e24bc31087a.exe
1056	5ee375628c34cd0aa0833e24bc31087a.exe
1056	5ee375628c34cd0aa0833e24bc31087a.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

5ee375628c34cd0aa0833e24bc31087a.exe

description pid process

Token: SeDebugPrivilege 3896 5ee375628c34cd0aa0833e24bc31087a.exe

description	pid	process
Token: SeDebugPrivilege	3896	5ee375628c34cd0aa0833e24bc31087a.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

5ee375628c34cd0aa0833e24bc31087a.exe

description	pid	process	target process
PID 3896 wrote to memory of 2116	3896	5ee375628c34cd0aa0833e24bc31087a.exe	5ee375628c34cd0aa0833e24bc31087a.exe
PID 3896 wrote to memory of 2116	3896	5ee375628c34cd0aa0833e24bc31087a.exe	5ee375628c34cd0aa0833e24bc31087a.exe
PID 3896 wrote to memory of 2116	3896	5ee375628c34cd0aa0833e24bc31087a.exe	5ee375628c34cd0aa0833e24bc31087a.exe
PID 3896 wrote to memory of 1056	3896	5ee375628c34cd0aa0833e24bc31087a.exe	5ee375628c34cd0aa0833e24bc31087a.exe
PID 3896 wrote to memory of 1056	3896	5ee375628c34cd0aa0833e24bc31087a.exe	5ee375628c34cd0aa0833e24bc31087a.exe
PID 3896 wrote to memory of 1056	3896	5ee375628c34cd0aa0833e24bc31087a.exe	5ee375628c34cd0aa0833e24bc31087a.exe
PID 3896 wrote to memory of 1056	3896	5ee375628c34cd0aa0833e24bc31087a.exe	5ee375628c34cd0aa0833e24bc31087a.exe
PID 3896 wrote to memory of 1056	3896	5ee375628c34cd0aa0833e24bc31087a.exe	5ee375628c34cd0aa0833e24bc31087a.exe
PID 3896 wrote to memory of 1056	3896	5ee375628c34cd0aa0833e24bc31087a.exe	5ee375628c34cd0aa0833e24bc31087a.exe

C:\Users\Admin\AppData\Local\Temp\5ee375628c34cd0aa0833e24bc31087a.exe
"C:\Users\Admin\AppData\Local\Temp\5ee375628c34cd0aa0833e24bc31087a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3896

C:\Users\Admin\AppData\Local\Temp\5ee375628c34cd0aa0833e24bc31087a.exe
"C:\Users\Admin\AppData\Local\Temp\5ee375628c34cd0aa0833e24bc31087a.exe"
2⤵
PID:2116

C:\Users\Admin\AppData\Local\Temp\5ee375628c34cd0aa0833e24bc31087a.exe
"C:\Users\Admin\AppData\Local\Temp\5ee375628c34cd0aa0833e24bc31087a.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1056-126-0x000000000041EB80-mapping.dmp

Download
memory/1056-127-0x0000000001500000-0x0000000001820000-memory.dmp

Filesize
3.1MB

Download
memory/1056-125-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3896-121-0x00000000052B0000-0x00000000057AE000-memory.dmp

Filesize
5.0MB

Download
memory/3896-119-0x00000000051B0000-0x00000000051B1000-memory.dmp

Filesize
4KB

Download
memory/3896-120-0x0000000005470000-0x0000000005471000-memory.dmp

Filesize
4KB

Download
memory/3896-114-0x0000000000860000-0x0000000000861000-memory.dmp

Filesize
4KB

Download
memory/3896-122-0x0000000006E00000-0x0000000006E11000-memory.dmp

Filesize
68KB

Download
memory/3896-123-0x0000000008B00000-0x0000000008B9D000-memory.dmp

Filesize
628KB

Download
memory/3896-124-0x000000000B300000-0x000000000B32F000-memory.dmp

Filesize
188KB

Download
memory/3896-118-0x00000000052B0000-0x00000000052B1000-memory.dmp

Filesize
4KB

Download
memory/3896-117-0x00000000057B0000-0x00000000057B1000-memory.dmp

Filesize
4KB

Download
memory/3896-116-0x0000000005210000-0x0000000005211000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads