formbook | 70d759be9f935d289ee1627038a118e9493d45ecebfcd477f0b43a8253afffb4

General

Target

875d520c82087afa19b50355a0df7d50.exe
Size

838KB
MD5

875d520c82087afa19b50355a0df7d50
SHA1

910a982a2ec09f51c6205f2ab585abdb73fb1cda
SHA256

70d759be9f935d289ee1627038a118e9493d45ecebfcd477f0b43a8253afffb4
SHA512

8a53e26bbfc21255c3939ade4fd6b32eabd144874c14654a41e08b7924e2aa7c5cc4a6c7f309b2fd231c94ec31affb7f66aeb2c865e1f8d890883a46b9fb74a2

Score

10^/10

formbook mxwf rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

mxwf

C2

http://www.zahnimplantatangebotede.com/mxwf/

Decoy

orders-cialis.info

auctionorbuy.com

meanmugsamore.com

yachtcrewmark.com

sacredkashilifestudio.net

themintyard.com

bragafoods.com

sierp.com

hausofdeme.com

anthonyjames915.com

bajardepesoencasa.com

marciaroyal.com

earringlifter.com

dsdjfhd9ddksa1as.info

bmzproekt.com

employmentbc.com

ptsdtreatment.space

vrchance.com

cnrongding.com

welovelit.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1132-67-0x000000000041EBA0-mapping.dmp	formbook
behavioral1/memory/1132-66-0x0000000000400000-0x000000000042E000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

875d520c82087afa19b50355a0df7d50.exe

description pid process target process

PID 864 set thread context of 1132 864 875d520c82087afa19b50355a0df7d50.exe 875d520c82087afa19b50355a0df7d50.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

875d520c82087afa19b50355a0df7d50.exe

pid process

1132 875d520c82087afa19b50355a0df7d50.exe

description	pid	process	target process
PID 864 set thread context of 1132	864	875d520c82087afa19b50355a0df7d50.exe	875d520c82087afa19b50355a0df7d50.exe

pid	process
1132	875d520c82087afa19b50355a0df7d50.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

875d520c82087afa19b50355a0df7d50.exe

description	pid	process	target process
PID 864 wrote to memory of 1132	864	875d520c82087afa19b50355a0df7d50.exe	875d520c82087afa19b50355a0df7d50.exe
PID 864 wrote to memory of 1132	864	875d520c82087afa19b50355a0df7d50.exe	875d520c82087afa19b50355a0df7d50.exe
PID 864 wrote to memory of 1132	864	875d520c82087afa19b50355a0df7d50.exe	875d520c82087afa19b50355a0df7d50.exe
PID 864 wrote to memory of 1132	864	875d520c82087afa19b50355a0df7d50.exe	875d520c82087afa19b50355a0df7d50.exe
PID 864 wrote to memory of 1132	864	875d520c82087afa19b50355a0df7d50.exe	875d520c82087afa19b50355a0df7d50.exe
PID 864 wrote to memory of 1132	864	875d520c82087afa19b50355a0df7d50.exe	875d520c82087afa19b50355a0df7d50.exe
PID 864 wrote to memory of 1132	864	875d520c82087afa19b50355a0df7d50.exe	875d520c82087afa19b50355a0df7d50.exe

C:\Users\Admin\AppData\Local\Temp\875d520c82087afa19b50355a0df7d50.exe
"C:\Users\Admin\AppData\Local\Temp\875d520c82087afa19b50355a0df7d50.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:864

C:\Users\Admin\AppData\Local\Temp\875d520c82087afa19b50355a0df7d50.exe
"C:\Users\Admin\AppData\Local\Temp\875d520c82087afa19b50355a0df7d50.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1132

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/864-60-0x00000000008A0000-0x00000000008A1000-memory.dmp

Filesize
4KB

Download
memory/864-62-0x0000000004DE0000-0x0000000004DE1000-memory.dmp

Filesize
4KB

Download
memory/864-63-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/864-64-0x0000000007F60000-0x0000000008004000-memory.dmp

Filesize
656KB

Download
memory/864-65-0x0000000000600000-0x0000000000637000-memory.dmp

Filesize
220KB

Download
memory/1132-67-0x000000000041EBA0-mapping.dmp

Download
memory/1132-66-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1132-68-0x0000000000C50000-0x0000000000F53000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing