formbook | 3cb62c9b4ec92c70df9795f481ccb5b50fd4f260441c23edcaf97c23396bf502

General

Target

dllhost.exe
Size

978KB
MD5

016a2ec587bcda6c0df1e5188bfeca7b
SHA1

fad0fecd43d5fa3c1507551b598177eac236ee7b
SHA256

3cb62c9b4ec92c70df9795f481ccb5b50fd4f260441c23edcaf97c23396bf502
SHA512

6fb607055367e887eb749862bf6bbb6b2f4682bdfb4a695a0d83acd2124bab4b57438c30712ca25e4827f530cf1a5531869c3766725a29cc0fdfbdb31f5a95a0

Score

10^/10

formbook kzk9 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

kzk9

C2

http://www.yourmajordomo.com/kzk9/

Decoy

tianconghuo.club

1996-page.com

ourtownmax.net

conservativetreehose.com

synth.repair

donnachicacreperia.com

tentfull.com

weapp.download

surfersink.com

gattlebusinessservices.com

sebastian249.com

anhphuc.company

betternatureproducts.net

defroplate.com

seattlesquidsquad.com

polarjob.com

lendingadvantage.com

angelsondope.com

goportjitney.com

tiendagrupojagr.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1580-67-0x000000000041EB80-mapping.dmp	formbook
behavioral1/memory/1580-66-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/1464-75-0x0000000000080000-0x00000000000AE000-memory.dmp	formbook

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2040 cmd.exe

pid	process
2040	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

dllhost.exedllhost.exeipconfig.exe

description	pid	process	target process
PID 336 set thread context of 1580	336	dllhost.exe	dllhost.exe
PID 1580 set thread context of 1264	1580	dllhost.exe	Explorer.EXE
PID 1464 set thread context of 1264	1464	ipconfig.exe	Explorer.EXE

Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command-Line Interface
T1059

Processes:

ipconfig.exe

pid process

1464 ipconfig.exe

pid	process
1464	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

Processes:

dllhost.exedllhost.exeipconfig.exe

pid	process
336	dllhost.exe
1580	dllhost.exe
1580	dllhost.exe
1464	ipconfig.exe
1464	ipconfig.exe
1464	ipconfig.exe
1464	ipconfig.exe
1464	ipconfig.exe
1464	ipconfig.exe
1464	ipconfig.exe
1464	ipconfig.exe
1464	ipconfig.exe
1464	ipconfig.exe
1464	ipconfig.exe
1464	ipconfig.exe
1464	ipconfig.exe
1464	ipconfig.exe
1464	ipconfig.exe
1464	ipconfig.exe
1464	ipconfig.exe
1464	ipconfig.exe

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

dllhost.exeipconfig.exe

pid process

1580 dllhost.exe
1580 dllhost.exe
1580 dllhost.exe
1464 ipconfig.exe
1464 ipconfig.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

dllhost.exedllhost.exeipconfig.exe

description pid process

Token: SeDebugPrivilege 336 dllhost.exe
Token: SeDebugPrivilege 1580 dllhost.exe
Token: SeDebugPrivilege 1464 ipconfig.exe
Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

Explorer.EXE

pid process

1264 Explorer.EXE
1264 Explorer.EXE
1264 Explorer.EXE
1264 Explorer.EXE
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

Explorer.EXE

pid process

1264 Explorer.EXE
1264 Explorer.EXE
1264 Explorer.EXE
1264 Explorer.EXE

pid	process
1580	dllhost.exe
1580	dllhost.exe
1580	dllhost.exe
1464	ipconfig.exe
1464	ipconfig.exe

description	pid	process
Token: SeDebugPrivilege	336	dllhost.exe
Token: SeDebugPrivilege	1580	dllhost.exe
Token: SeDebugPrivilege	1464	ipconfig.exe

pid	process
1264	Explorer.EXE
1264	Explorer.EXE
1264	Explorer.EXE
1264	Explorer.EXE

pid	process
1264	Explorer.EXE
1264	Explorer.EXE
1264	Explorer.EXE
1264	Explorer.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

dllhost.exeExplorer.EXEipconfig.exe

description	pid	process	target process
PID 336 wrote to memory of 1580	336	dllhost.exe	dllhost.exe
PID 336 wrote to memory of 1580	336	dllhost.exe	dllhost.exe
PID 336 wrote to memory of 1580	336	dllhost.exe	dllhost.exe
PID 336 wrote to memory of 1580	336	dllhost.exe	dllhost.exe
PID 336 wrote to memory of 1580	336	dllhost.exe	dllhost.exe
PID 336 wrote to memory of 1580	336	dllhost.exe	dllhost.exe
PID 336 wrote to memory of 1580	336	dllhost.exe	dllhost.exe
PID 1264 wrote to memory of 1464	1264	Explorer.EXE	ipconfig.exe
PID 1264 wrote to memory of 1464	1264	Explorer.EXE	ipconfig.exe
PID 1264 wrote to memory of 1464	1264	Explorer.EXE	ipconfig.exe
PID 1264 wrote to memory of 1464	1264	Explorer.EXE	ipconfig.exe
PID 1464 wrote to memory of 2040	1464	ipconfig.exe	cmd.exe
PID 1464 wrote to memory of 2040	1464	ipconfig.exe	cmd.exe
PID 1464 wrote to memory of 2040	1464	ipconfig.exe	cmd.exe
PID 1464 wrote to memory of 2040	1464	ipconfig.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1264

C:\Users\Admin\AppData\Local\Temp\dllhost.exe
"C:\Users\Admin\AppData\Local\Temp\dllhost.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:336

C:\Users\Admin\AppData\Local\Temp\dllhost.exe
"C:\Users\Admin\AppData\Local\Temp\dllhost.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1580

C:\Windows\SysWOW64\ipconfig.exe
"C:\Windows\SysWOW64\ipconfig.exe"
2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1464

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\dllhost.exe"
3⤵
- Deletes itself
PID:2040

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/336-62-0x0000000004E40000-0x0000000004E41000-memory.dmp

Filesize
4KB

Download
memory/336-63-0x00000000003C0000-0x00000000003D1000-memory.dmp

Filesize
68KB

Download
memory/336-64-0x0000000008110000-0x00000000081BD000-memory.dmp

Filesize
692KB

Download
memory/336-65-0x0000000000B70000-0x0000000000BAE000-memory.dmp

Filesize
248KB

Download
memory/336-60-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

Filesize
4KB

Download
memory/1264-70-0x0000000004D80000-0x0000000004EB2000-memory.dmp

Filesize
1.2MB

Download
memory/1464-74-0x0000000000890000-0x000000000089A000-memory.dmp

Filesize
40KB

Download
memory/1464-77-0x00000000022D0000-0x0000000002363000-memory.dmp

Filesize
588KB

Download
memory/1464-76-0x0000000001FC0000-0x00000000022C3000-memory.dmp

Filesize
3.0MB

Download
memory/1464-75-0x0000000000080000-0x00000000000AE000-memory.dmp

Filesize
184KB

Download
memory/1464-71-0x0000000000000000-mapping.dmp

Download
memory/1464-72-0x0000000075551000-0x0000000075553000-memory.dmp

Filesize
8KB

Download
memory/1580-68-0x0000000000930000-0x0000000000C33000-memory.dmp

Filesize
3.0MB

Download
memory/1580-69-0x0000000000280000-0x0000000000294000-memory.dmp

Filesize
80KB

Download
memory/1580-66-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1580-67-0x000000000041EB80-mapping.dmp

Download
memory/2040-73-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads