formbook | 3cb62c9b4ec92c70df9795f481ccb5b50fd4f260441c23edcaf97c23396bf502

General

Target

dllhost.exe
Size

978KB
MD5

016a2ec587bcda6c0df1e5188bfeca7b
SHA1

fad0fecd43d5fa3c1507551b598177eac236ee7b
SHA256

3cb62c9b4ec92c70df9795f481ccb5b50fd4f260441c23edcaf97c23396bf502
SHA512

6fb607055367e887eb749862bf6bbb6b2f4682bdfb4a695a0d83acd2124bab4b57438c30712ca25e4827f530cf1a5531869c3766725a29cc0fdfbdb31f5a95a0

Score

10^/10

formbook kzk9 rat spyware stealer suricata trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

kzk9

C2

http://www.yourmajordomo.com/kzk9/

Decoy

tianconghuo.club

1996-page.com

ourtownmax.net

conservativetreehose.com

synth.repair

donnachicacreperia.com

tentfull.com

weapp.download

surfersink.com

gattlebusinessservices.com

sebastian249.com

anhphuc.company

betternatureproducts.net

defroplate.com

seattlesquidsquad.com

polarjob.com

lendingadvantage.com

angelsondope.com

goportjitney.com

tiendagrupojagr.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2692-125-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral2/memory/2692-126-0x000000000041EB80-mapping.dmp	formbook
behavioral2/memory/3172-133-0x0000000000C00000-0x0000000000C2E000-memory.dmp	formbook

Suspicious use of SetThreadContext 3 IoCs

Processes:

dllhost.exedllhost.execolorcpl.exe

description	pid	process	target process
PID 3896 set thread context of 2692	3896	dllhost.exe	dllhost.exe
PID 2692 set thread context of 2824	2692	dllhost.exe	Explorer.EXE
PID 3172 set thread context of 2824	3172	colorcpl.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 41 IoCs

Processes:

dllhost.exedllhost.execolorcpl.exe

pid	process
3896	dllhost.exe
2692	dllhost.exe
2692	dllhost.exe
2692	dllhost.exe
2692	dllhost.exe
3172	colorcpl.exe
3172	colorcpl.exe
3172	colorcpl.exe
3172	colorcpl.exe
3172	colorcpl.exe
3172	colorcpl.exe
3172	colorcpl.exe
3172	colorcpl.exe
3172	colorcpl.exe
3172	colorcpl.exe
3172	colorcpl.exe
3172	colorcpl.exe
3172	colorcpl.exe
3172	colorcpl.exe
3172	colorcpl.exe
3172	colorcpl.exe
3172	colorcpl.exe
3172	colorcpl.exe
3172	colorcpl.exe
3172	colorcpl.exe
3172	colorcpl.exe
3172	colorcpl.exe
3172	colorcpl.exe
3172	colorcpl.exe
3172	colorcpl.exe
3172	colorcpl.exe
3172	colorcpl.exe
3172	colorcpl.exe
3172	colorcpl.exe
3172	colorcpl.exe
3172	colorcpl.exe
3172	colorcpl.exe
3172	colorcpl.exe
3172	colorcpl.exe
3172	colorcpl.exe
3172	colorcpl.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

2824 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

dllhost.execolorcpl.exe

pid process

2692 dllhost.exe
2692 dllhost.exe
2692 dllhost.exe
3172 colorcpl.exe
3172 colorcpl.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

dllhost.exedllhost.execolorcpl.exe

description pid process

Token: SeDebugPrivilege 3896 dllhost.exe
Token: SeDebugPrivilege 2692 dllhost.exe
Token: SeDebugPrivilege 3172 colorcpl.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

2824 Explorer.EXE

pid	process
2824	Explorer.EXE

pid	process
2692	dllhost.exe
2692	dllhost.exe
2692	dllhost.exe
3172	colorcpl.exe
3172	colorcpl.exe

description	pid	process
Token: SeDebugPrivilege	3896	dllhost.exe
Token: SeDebugPrivilege	2692	dllhost.exe
Token: SeDebugPrivilege	3172	colorcpl.exe

pid	process
2824	Explorer.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

dllhost.exeExplorer.EXEcolorcpl.exe

description	pid	process	target process
PID 3896 wrote to memory of 2692	3896	dllhost.exe	dllhost.exe
PID 3896 wrote to memory of 2692	3896	dllhost.exe	dllhost.exe
PID 3896 wrote to memory of 2692	3896	dllhost.exe	dllhost.exe
PID 3896 wrote to memory of 2692	3896	dllhost.exe	dllhost.exe
PID 3896 wrote to memory of 2692	3896	dllhost.exe	dllhost.exe
PID 3896 wrote to memory of 2692	3896	dllhost.exe	dllhost.exe
PID 2824 wrote to memory of 3172	2824	Explorer.EXE	colorcpl.exe
PID 2824 wrote to memory of 3172	2824	Explorer.EXE	colorcpl.exe
PID 2824 wrote to memory of 3172	2824	Explorer.EXE	colorcpl.exe
PID 3172 wrote to memory of 1284	3172	colorcpl.exe	cmd.exe
PID 3172 wrote to memory of 1284	3172	colorcpl.exe	cmd.exe
PID 3172 wrote to memory of 1284	3172	colorcpl.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2824

C:\Users\Admin\AppData\Local\Temp\dllhost.exe
"C:\Users\Admin\AppData\Local\Temp\dllhost.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3896

C:\Users\Admin\AppData\Local\Temp\dllhost.exe
"C:\Users\Admin\AppData\Local\Temp\dllhost.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2692

C:\Windows\SysWOW64\colorcpl.exe
"C:\Windows\SysWOW64\colorcpl.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3172

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\dllhost.exe"
3⤵
PID:1284

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1284-131-0x0000000000000000-mapping.dmp

Download
memory/2692-125-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2692-127-0x0000000001880000-0x0000000001BA0000-memory.dmp

Filesize
3.1MB

Download
memory/2692-128-0x0000000001820000-0x0000000001834000-memory.dmp

Filesize
80KB

Download
memory/2692-126-0x000000000041EB80-mapping.dmp

Download
memory/2824-136-0x0000000002D70000-0x0000000002E9A000-memory.dmp

Filesize
1.2MB

Download
memory/2824-129-0x0000000003020000-0x00000000030E1000-memory.dmp

Filesize
772KB

Download
memory/3172-130-0x0000000000000000-mapping.dmp

Download
memory/3172-132-0x0000000001070000-0x0000000001089000-memory.dmp

Filesize
100KB

Download
memory/3172-135-0x0000000000E90000-0x0000000000F23000-memory.dmp

Filesize
588KB

Download
memory/3172-134-0x0000000004490000-0x00000000047B0000-memory.dmp

Filesize
3.1MB

Download
memory/3172-133-0x0000000000C00000-0x0000000000C2E000-memory.dmp

Filesize
184KB

Download
memory/3896-121-0x0000000005280000-0x000000000577E000-memory.dmp

Filesize
5.0MB

Download
memory/3896-119-0x0000000005210000-0x0000000005211000-memory.dmp

Filesize
4KB

Download
memory/3896-118-0x0000000005320000-0x0000000005321000-memory.dmp

Filesize
4KB

Download
memory/3896-114-0x0000000000860000-0x0000000000861000-memory.dmp

Filesize
4KB

Download
memory/3896-117-0x0000000005780000-0x0000000005781000-memory.dmp

Filesize
4KB

Download
memory/3896-120-0x0000000005480000-0x0000000005481000-memory.dmp

Filesize
4KB

Download
memory/3896-123-0x0000000008970000-0x0000000008A1D000-memory.dmp

Filesize
692KB

Download
memory/3896-122-0x00000000054E0000-0x00000000054F1000-memory.dmp

Filesize
68KB

Download
memory/3896-116-0x0000000005150000-0x0000000005151000-memory.dmp

Filesize
4KB

Download
memory/3896-124-0x000000000B150000-0x000000000B18E000-memory.dmp

Filesize
248KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads