formbook | ddf35d45c7f1257634905c047c8ddfd40e75dcda9ca39a658c00698e25f3db22

General

Target

14ebcbc69653d3257eb42c91734bcf2a1ca5dff12c31c06cf955279ea4af5bfd.exe
Size

884KB
MD5

1b415a56616a9f7c2e37fc2ce570664f
SHA1

2e7a5b8378e9a0e5fd7f5a8321af4d128ef2a1a3
SHA256

14ebcbc69653d3257eb42c91734bcf2a1ca5dff12c31c06cf955279ea4af5bfd
SHA512

e77e25ffeae630cc2413fd969462a7fd019738f2981b4304ab6ba4cc5bb9530db3f1210c5cb90665529f6c25c03f6a63362362a18e6bb801edeccc979a0f711b

Score

10^/10

formbook vn3b rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

vn3b

C2

http://www.lifeafterbobby.com/vn3b/

Decoy

rowenglobal.com

abrirumaempresa.com

videosbet.xyz

blackbettyxt.com

trust-red.net

sonyalpharunors.com

shiqichaoji.com

allex-ru.com

totalpowerpc.store

ptocom.com

quantumsai.club

toughcookie.love

nivafitness.com

bioskopmovie21.com

giatsaygiare.com

xiongmaojingxuan.com

zjjly88.com

trampmotorsports.com

pibblekibble.com

mymounntnittanyhealth.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/676-67-0x000000000041EB70-mapping.dmp	formbook
behavioral1/memory/676-66-0x0000000000400000-0x000000000042E000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

14ebcbc69653d3257eb42c91734bcf2a1ca5dff12c31c06cf955279ea4af5bfd.exe

description	pid	process	target process
PID 1932 set thread context of 676	1932	14ebcbc69653d3257eb42c91734bcf2a1ca5dff12c31c06cf955279ea4af5bfd.exe	14ebcbc69653d3257eb42c91734bcf2a1ca5dff12c31c06cf955279ea4af5bfd.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

14ebcbc69653d3257eb42c91734bcf2a1ca5dff12c31c06cf955279ea4af5bfd.exe

pid process

676 14ebcbc69653d3257eb42c91734bcf2a1ca5dff12c31c06cf955279ea4af5bfd.exe

pid	process
676	14ebcbc69653d3257eb42c91734bcf2a1ca5dff12c31c06cf955279ea4af5bfd.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

14ebcbc69653d3257eb42c91734bcf2a1ca5dff12c31c06cf955279ea4af5bfd.exe

description	pid	process	target process
PID 1932 wrote to memory of 676	1932	14ebcbc69653d3257eb42c91734bcf2a1ca5dff12c31c06cf955279ea4af5bfd.exe	14ebcbc69653d3257eb42c91734bcf2a1ca5dff12c31c06cf955279ea4af5bfd.exe
PID 1932 wrote to memory of 676	1932	14ebcbc69653d3257eb42c91734bcf2a1ca5dff12c31c06cf955279ea4af5bfd.exe	14ebcbc69653d3257eb42c91734bcf2a1ca5dff12c31c06cf955279ea4af5bfd.exe
PID 1932 wrote to memory of 676	1932	14ebcbc69653d3257eb42c91734bcf2a1ca5dff12c31c06cf955279ea4af5bfd.exe	14ebcbc69653d3257eb42c91734bcf2a1ca5dff12c31c06cf955279ea4af5bfd.exe
PID 1932 wrote to memory of 676	1932	14ebcbc69653d3257eb42c91734bcf2a1ca5dff12c31c06cf955279ea4af5bfd.exe	14ebcbc69653d3257eb42c91734bcf2a1ca5dff12c31c06cf955279ea4af5bfd.exe
PID 1932 wrote to memory of 676	1932	14ebcbc69653d3257eb42c91734bcf2a1ca5dff12c31c06cf955279ea4af5bfd.exe	14ebcbc69653d3257eb42c91734bcf2a1ca5dff12c31c06cf955279ea4af5bfd.exe
PID 1932 wrote to memory of 676	1932	14ebcbc69653d3257eb42c91734bcf2a1ca5dff12c31c06cf955279ea4af5bfd.exe	14ebcbc69653d3257eb42c91734bcf2a1ca5dff12c31c06cf955279ea4af5bfd.exe
PID 1932 wrote to memory of 676	1932	14ebcbc69653d3257eb42c91734bcf2a1ca5dff12c31c06cf955279ea4af5bfd.exe	14ebcbc69653d3257eb42c91734bcf2a1ca5dff12c31c06cf955279ea4af5bfd.exe

C:\Users\Admin\AppData\Local\Temp\14ebcbc69653d3257eb42c91734bcf2a1ca5dff12c31c06cf955279ea4af5bfd.exe
"C:\Users\Admin\AppData\Local\Temp\14ebcbc69653d3257eb42c91734bcf2a1ca5dff12c31c06cf955279ea4af5bfd.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1932

C:\Users\Admin\AppData\Local\Temp\14ebcbc69653d3257eb42c91734bcf2a1ca5dff12c31c06cf955279ea4af5bfd.exe
"C:\Users\Admin\AppData\Local\Temp\14ebcbc69653d3257eb42c91734bcf2a1ca5dff12c31c06cf955279ea4af5bfd.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/676-67-0x000000000041EB70-mapping.dmp

Download
memory/676-66-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/676-68-0x0000000000CF0000-0x0000000000FF3000-memory.dmp

Filesize
3.0MB

Download
memory/1932-60-0x0000000000C00000-0x0000000000C01000-memory.dmp

Filesize
4KB

Download
memory/1932-62-0x0000000004C10000-0x0000000004C11000-memory.dmp

Filesize
4KB

Download
memory/1932-63-0x0000000000490000-0x000000000049F000-memory.dmp

Filesize
60KB

Download
memory/1932-64-0x0000000007E30000-0x0000000007EAA000-memory.dmp

Filesize
488KB

Download
memory/1932-65-0x0000000004BC0000-0x0000000004C01000-memory.dmp

Filesize
260KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads