formbook | 561bedc1d6d589037ade015eb53f01c045fbd770982e04dc1b7a2acc677d67f4

General

Target

1.exe
Size

184KB
MD5

b40cb0308a54ac1d3b997a74afa5d760
SHA1

d114b90c7838201624a3faf512d00c74095baa16
SHA256

561bedc1d6d589037ade015eb53f01c045fbd770982e04dc1b7a2acc677d67f4
SHA512

e7e47000809d41cfcb9f82976fbf8972c1c3f6783f39a44234d6e4c519709e3bf82abddd072128630734d5297a0bca1471fb7a1377b9340b4e0b438c86b598a4

Score

10^/10

formbook 3nop rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

3nop

C2

http://www.jakesplacebarbers.com/3nop/

Decoy

videohm.com

panache-rose.com

alnooncars-kw.com

trueblue2u.com

brussels-cafe.com

ip2c.net

influenzerr.com

rbcoq.com

zzful.com

drainthe.com

sumaholesson.com

cursosaprovados.com

genotecinc.com

dbrulhart.com

theapiarystudios.com

kensyu-kan.com

dkku88.com

tikhyper.com

aztecnort.com

homebrim.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/368-60-0x0000000000080000-0x00000000000AE000-memory.dmp	formbook

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

676 cmd.exe
Suspicious use of SetThreadContext 2 IoCs

Processes:

1.exemstsc.exe

description pid process target process

PID 980 set thread context of 1204 980 1.exe Explorer.EXE
PID 368 set thread context of 1204 368 mstsc.exe Explorer.EXE

pid	process
676	cmd.exe

description	pid	process	target process
PID 980 set thread context of 1204	980	1.exe	Explorer.EXE
PID 368 set thread context of 1204	368	mstsc.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 31 IoCs

Processes:

1.exemstsc.exe

pid	process
980	1.exe
980	1.exe
368	mstsc.exe
368	mstsc.exe
368	mstsc.exe
368	mstsc.exe
368	mstsc.exe
368	mstsc.exe
368	mstsc.exe
368	mstsc.exe
368	mstsc.exe
368	mstsc.exe
368	mstsc.exe
368	mstsc.exe
368	mstsc.exe
368	mstsc.exe
368	mstsc.exe
368	mstsc.exe
368	mstsc.exe
368	mstsc.exe
368	mstsc.exe
368	mstsc.exe
368	mstsc.exe
368	mstsc.exe
368	mstsc.exe
368	mstsc.exe
368	mstsc.exe
368	mstsc.exe
368	mstsc.exe
368	mstsc.exe
368	mstsc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1204 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

1.exemstsc.exe

pid process

980 1.exe
980 1.exe
980 1.exe
368 mstsc.exe
368 mstsc.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

1.exemstsc.exe

description pid process

Token: SeDebugPrivilege 980 1.exe
Token: SeDebugPrivilege 368 mstsc.exe
Suspicious use of FindShellTrayWindow 6 IoCs

Processes:

Explorer.EXE

pid process

1204 Explorer.EXE
1204 Explorer.EXE
1204 Explorer.EXE
1204 Explorer.EXE
1204 Explorer.EXE
1204 Explorer.EXE
Suspicious use of SendNotifyMessage 6 IoCs

Processes:

Explorer.EXE

pid process

1204 Explorer.EXE
1204 Explorer.EXE
1204 Explorer.EXE
1204 Explorer.EXE
1204 Explorer.EXE
1204 Explorer.EXE

pid	process
1204	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	980	1.exe
Token: SeDebugPrivilege	368	mstsc.exe

pid	process
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE

pid	process
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

Explorer.EXEmstsc.exe

description	pid	process	target process
PID 1204 wrote to memory of 368	1204	Explorer.EXE	mstsc.exe
PID 1204 wrote to memory of 368	1204	Explorer.EXE	mstsc.exe
PID 1204 wrote to memory of 368	1204	Explorer.EXE	mstsc.exe
PID 1204 wrote to memory of 368	1204	Explorer.EXE	mstsc.exe
PID 368 wrote to memory of 676	368	mstsc.exe	cmd.exe
PID 368 wrote to memory of 676	368	mstsc.exe	cmd.exe
PID 368 wrote to memory of 676	368	mstsc.exe	cmd.exe
PID 368 wrote to memory of 676	368	mstsc.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1204

C:\Users\Admin\AppData\Local\Temp\1.exe
"C:\Users\Admin\AppData\Local\Temp\1.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:980

C:\Windows\SysWOW64\mstsc.exe
"C:\Windows\SysWOW64\mstsc.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:368

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\1.exe"
3⤵
- Deletes itself
PID:676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/368-56-0x0000000000000000-mapping.dmp

Download
memory/368-57-0x0000000076921000-0x0000000076923000-memory.dmp

Filesize
8KB

Download
memory/368-60-0x0000000000080000-0x00000000000AE000-memory.dmp

Filesize
184KB

Download
memory/368-59-0x00000000009B0000-0x0000000000AB4000-memory.dmp

Filesize
1.0MB

Download
memory/368-61-0x0000000002190000-0x0000000002493000-memory.dmp

Filesize
3.0MB

Download
memory/368-62-0x0000000001EC0000-0x0000000001F53000-memory.dmp

Filesize
588KB

Download
memory/676-58-0x0000000000000000-mapping.dmp

Download
memory/980-53-0x00000000008A0000-0x0000000000BA3000-memory.dmp

Filesize
3.0MB

Download
memory/980-55-0x0000000000180000-0x0000000000194000-memory.dmp

Filesize
80KB

Download
memory/1204-54-0x0000000004E10000-0x0000000004F7D000-memory.dmp

Filesize
1.4MB

Download
memory/1204-63-0x0000000006DC0000-0x0000000006F39000-memory.dmp

Filesize
1.5MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads