formbook | bb563dd32da362223391bcab4ce944176a91743e3d686284b46c7166feffc9c0

General

Target

Produktmuster bestellen pdf.exe
Size

841KB
MD5

5ca062106a36b73b0eaffd7170d6b239
SHA1

fe5ab18a5e48988fd36b1318d4d1416d1f7014a6
SHA256

ff163e8cfe858604b414adc36790c2b81d59efe58b4b3bb3628893828f8dbdab
SHA512

c96de515f577f2b708423c82632403d4215f911d89100ba213950111e61f50a3690fef55290322febbb00516a43c3e2bb46a8008a36ea28ad2ba234114842b63

Score

10^/10

formbook n7ak rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

n7ak

C2

http://www.kmresults.com/n7ak/

Decoy

modischoolcbse.com

theneverwinter.com

rszkjx-vps-hosting.website

fnihil.com

1pbet.com

nnowzscorrez.com

uaotgvjl.icu

starmapsqatar.com

ekisilani.com

extradeepsheets.com

jam-nins.com

buranly.com

orixentertainment.com

rawtech.energy

myol.guru

utex.club

jiapie.com

wowig.store

wweidlyyl.com

systaskautomation.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/756-56-0x0000000000000000-mapping.dmp	formbook
behavioral1/memory/756-59-0x0000000010410000-0x000000001043E000-memory.dmp	formbook
behavioral1/memory/564-67-0x0000000000090000-0x00000000000BE000-memory.dmp	formbook

Suspicious use of SetThreadContext 2 IoCs

Processes:

DpiScaling.exemsiexec.exe

description	pid	process	target process
PID 756 set thread context of 1360	756	DpiScaling.exe	Explorer.EXE
PID 564 set thread context of 1360	564	msiexec.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 28 IoCs

Processes:

DpiScaling.exemsiexec.exe

pid	process
756	DpiScaling.exe
756	DpiScaling.exe
564	msiexec.exe
564	msiexec.exe
564	msiexec.exe
564	msiexec.exe
564	msiexec.exe
564	msiexec.exe
564	msiexec.exe
564	msiexec.exe
564	msiexec.exe
564	msiexec.exe
564	msiexec.exe
564	msiexec.exe
564	msiexec.exe
564	msiexec.exe
564	msiexec.exe
564	msiexec.exe
564	msiexec.exe
564	msiexec.exe
564	msiexec.exe
564	msiexec.exe
564	msiexec.exe
564	msiexec.exe
564	msiexec.exe
564	msiexec.exe
564	msiexec.exe
564	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1360 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

DpiScaling.exemsiexec.exe

pid process

756 DpiScaling.exe
756 DpiScaling.exe
756 DpiScaling.exe
564 msiexec.exe
564 msiexec.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

DpiScaling.exemsiexec.exe

description pid process

Token: SeDebugPrivilege 756 DpiScaling.exe
Token: SeDebugPrivilege 564 msiexec.exe
Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

Explorer.EXE

pid process

1360 Explorer.EXE
1360 Explorer.EXE
1360 Explorer.EXE
1360 Explorer.EXE
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

Explorer.EXE

pid process

1360 Explorer.EXE
1360 Explorer.EXE
1360 Explorer.EXE
1360 Explorer.EXE

pid	process
1360	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	756	DpiScaling.exe
Token: SeDebugPrivilege	564	msiexec.exe

pid	process
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE

pid	process
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

Produktmuster bestellen pdf.exeExplorer.EXEmsiexec.exe

description	pid	process	target process
PID 1092 wrote to memory of 756	1092	Produktmuster bestellen pdf.exe	DpiScaling.exe
PID 1092 wrote to memory of 756	1092	Produktmuster bestellen pdf.exe	DpiScaling.exe
PID 1092 wrote to memory of 756	1092	Produktmuster bestellen pdf.exe	DpiScaling.exe
PID 1092 wrote to memory of 756	1092	Produktmuster bestellen pdf.exe	DpiScaling.exe
PID 1092 wrote to memory of 756	1092	Produktmuster bestellen pdf.exe	DpiScaling.exe
PID 1092 wrote to memory of 756	1092	Produktmuster bestellen pdf.exe	DpiScaling.exe
PID 1092 wrote to memory of 756	1092	Produktmuster bestellen pdf.exe	DpiScaling.exe
PID 1360 wrote to memory of 564	1360	Explorer.EXE	msiexec.exe
PID 1360 wrote to memory of 564	1360	Explorer.EXE	msiexec.exe
PID 1360 wrote to memory of 564	1360	Explorer.EXE	msiexec.exe
PID 1360 wrote to memory of 564	1360	Explorer.EXE	msiexec.exe
PID 1360 wrote to memory of 564	1360	Explorer.EXE	msiexec.exe
PID 1360 wrote to memory of 564	1360	Explorer.EXE	msiexec.exe
PID 1360 wrote to memory of 564	1360	Explorer.EXE	msiexec.exe
PID 564 wrote to memory of 524	564	msiexec.exe	cmd.exe
PID 564 wrote to memory of 524	564	msiexec.exe	cmd.exe
PID 564 wrote to memory of 524	564	msiexec.exe	cmd.exe
PID 564 wrote to memory of 524	564	msiexec.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1360

C:\Users\Admin\AppData\Local\Temp\Produktmuster bestellen pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Produktmuster bestellen pdf.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1092

C:\Windows\SysWOW64\DpiScaling.exe
DpiScaling.exe
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:756

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\SysWOW64\msiexec.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:564

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Windows\SysWOW64\DpiScaling.exe"
3⤵
PID:524

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/524-65-0x0000000000000000-mapping.dmp

Download
memory/564-63-0x0000000000000000-mapping.dmp

Download
memory/564-69-0x0000000001EB0000-0x0000000001F43000-memory.dmp

Filesize
588KB

Download
memory/564-68-0x00000000020E0000-0x00000000023E3000-memory.dmp

Filesize
3.0MB

Download
memory/564-66-0x0000000000860000-0x0000000000874000-memory.dmp

Filesize
80KB

Download
memory/564-67-0x0000000000090000-0x00000000000BE000-memory.dmp

Filesize
184KB

Download
memory/756-58-0x00000000000D0000-0x00000000000D1000-memory.dmp

Filesize
4KB

Download
memory/756-60-0x0000000001FC0000-0x00000000022C3000-memory.dmp

Filesize
3.0MB

Download
memory/756-61-0x00000000002C0000-0x00000000002D4000-memory.dmp

Filesize
80KB

Download
memory/756-59-0x0000000010410000-0x000000001043E000-memory.dmp

Filesize
184KB

Download
memory/756-56-0x0000000000000000-mapping.dmp

Download
memory/1092-54-0x0000000074B41000-0x0000000074B43000-memory.dmp

Filesize
8KB

Download
memory/1092-55-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1360-62-0x0000000004B10000-0x0000000004BC7000-memory.dmp

Filesize
732KB

Download
memory/1360-70-0x0000000004DC0000-0x0000000004E98000-memory.dmp

Filesize
864KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads