formbook | f8d239a08e27c28f5a5dea56ab895274476ae7360d5d456d89b58d33a392d49c

General

Target

f0f4b5aa6183bbc5265f26e47aaeb579.exe
Size

500KB
MD5

f0f4b5aa6183bbc5265f26e47aaeb579
SHA1

81f06990ec9c83d755d5023f95af114d92e68d45
SHA256

f8d239a08e27c28f5a5dea56ab895274476ae7360d5d456d89b58d33a392d49c
SHA512

3bc8bb2ac4dc15c484aac016b5c09ff55c45f7db2127a10ba5621711d66dc6287ad109906a1707dcbf0f6c8ba0078b8f6b4603e4a6365726ef419aabe7cf02e6

Score

10^/10

formbook m8g0 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

m8g0

C2

http://www.corbvalperu.com/m8g0/

Decoy

exclusivecan.com

junzhesuji.com

acces-credit-mutuel.com

iknitvintage.com

solonmodelun.com

debekia.com

peanutskitchen.com

kamanantzin.com

personalmodeststyle.com

qo49.com

googman.site

maisonshahnaz.com

annaalexandrovich.com

californiacashcars.com

ncafashionboutique.com

nsu0.com

cloudfirstlender.com

allforchildren.net

vn80000.com

restroon.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1588-59-0x000000000041EB70-mapping.dmp	formbook
behavioral1/memory/1588-58-0x0000000000400000-0x000000000042E000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

f0f4b5aa6183bbc5265f26e47aaeb579.exe

description pid process target process

PID 1908 set thread context of 1588 1908 f0f4b5aa6183bbc5265f26e47aaeb579.exe f0f4b5aa6183bbc5265f26e47aaeb579.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

f0f4b5aa6183bbc5265f26e47aaeb579.exe

pid process

1588 f0f4b5aa6183bbc5265f26e47aaeb579.exe

description	pid	process	target process
PID 1908 set thread context of 1588	1908	f0f4b5aa6183bbc5265f26e47aaeb579.exe	f0f4b5aa6183bbc5265f26e47aaeb579.exe

pid	process
1588	f0f4b5aa6183bbc5265f26e47aaeb579.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

f0f4b5aa6183bbc5265f26e47aaeb579.exe

description	pid	process	target process
PID 1908 wrote to memory of 1588	1908	f0f4b5aa6183bbc5265f26e47aaeb579.exe	f0f4b5aa6183bbc5265f26e47aaeb579.exe
PID 1908 wrote to memory of 1588	1908	f0f4b5aa6183bbc5265f26e47aaeb579.exe	f0f4b5aa6183bbc5265f26e47aaeb579.exe
PID 1908 wrote to memory of 1588	1908	f0f4b5aa6183bbc5265f26e47aaeb579.exe	f0f4b5aa6183bbc5265f26e47aaeb579.exe
PID 1908 wrote to memory of 1588	1908	f0f4b5aa6183bbc5265f26e47aaeb579.exe	f0f4b5aa6183bbc5265f26e47aaeb579.exe
PID 1908 wrote to memory of 1588	1908	f0f4b5aa6183bbc5265f26e47aaeb579.exe	f0f4b5aa6183bbc5265f26e47aaeb579.exe
PID 1908 wrote to memory of 1588	1908	f0f4b5aa6183bbc5265f26e47aaeb579.exe	f0f4b5aa6183bbc5265f26e47aaeb579.exe
PID 1908 wrote to memory of 1588	1908	f0f4b5aa6183bbc5265f26e47aaeb579.exe	f0f4b5aa6183bbc5265f26e47aaeb579.exe

C:\Users\Admin\AppData\Local\Temp\f0f4b5aa6183bbc5265f26e47aaeb579.exe
"C:\Users\Admin\AppData\Local\Temp\f0f4b5aa6183bbc5265f26e47aaeb579.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1908

C:\Users\Admin\AppData\Local\Temp\f0f4b5aa6183bbc5265f26e47aaeb579.exe
"C:\Users\Admin\AppData\Local\Temp\f0f4b5aa6183bbc5265f26e47aaeb579.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1588

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1588-59-0x000000000041EB70-mapping.dmp

Download
memory/1588-58-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1588-60-0x0000000000D20000-0x0000000001023000-memory.dmp

Filesize
3.0MB

Download
memory/1908-52-0x0000000000C90000-0x0000000000C91000-memory.dmp

Filesize
4KB

Download
memory/1908-54-0x00000000049B0000-0x00000000049B1000-memory.dmp

Filesize
4KB

Download
memory/1908-55-0x0000000000890000-0x0000000000897000-memory.dmp

Filesize
28KB

Download
memory/1908-56-0x0000000005F30000-0x0000000005F99000-memory.dmp

Filesize
420KB

Download
memory/1908-57-0x0000000000C50000-0x0000000000C83000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing