formbook | bb563dd32da362223391bcab4ce944176a91743e3d686284b46c7166feffc9c0

General

Target

Produktmuster bestellen pdf.exe
Size

841KB
MD5

5ca062106a36b73b0eaffd7170d6b239
SHA1

fe5ab18a5e48988fd36b1318d4d1416d1f7014a6
SHA256

ff163e8cfe858604b414adc36790c2b81d59efe58b4b3bb3628893828f8dbdab
SHA512

c96de515f577f2b708423c82632403d4215f911d89100ba213950111e61f50a3690fef55290322febbb00516a43c3e2bb46a8008a36ea28ad2ba234114842b63

Score

10^/10

formbook n7ak rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

n7ak

C2

http://www.kmresults.com/n7ak/

Decoy

modischoolcbse.com

theneverwinter.com

rszkjx-vps-hosting.website

fnihil.com

1pbet.com

nnowzscorrez.com

uaotgvjl.icu

starmapsqatar.com

ekisilani.com

extradeepsheets.com

jam-nins.com

buranly.com

orixentertainment.com

rawtech.energy

myol.guru

utex.club

jiapie.com

wowig.store

wweidlyyl.com

systaskautomation.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2536-116-0x0000000000000000-mapping.dmp	formbook
behavioral2/memory/2536-118-0x0000000010410000-0x000000001043E000-memory.dmp	formbook
behavioral2/memory/2796-124-0x0000000000A00000-0x0000000000A2E000-memory.dmp	formbook

Suspicious use of SetThreadContext 2 IoCs

Processes:

DpiScaling.execolorcpl.exe

description	pid	process	target process
PID 2536 set thread context of 2972	2536	DpiScaling.exe	Explorer.EXE
PID 2796 set thread context of 2972	2796	colorcpl.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 56 IoCs

Processes:

DpiScaling.execolorcpl.exe

pid	process
2536	DpiScaling.exe
2536	DpiScaling.exe
2536	DpiScaling.exe
2536	DpiScaling.exe
2796	colorcpl.exe
2796	colorcpl.exe
2796	colorcpl.exe
2796	colorcpl.exe
2796	colorcpl.exe
2796	colorcpl.exe
2796	colorcpl.exe
2796	colorcpl.exe
2796	colorcpl.exe
2796	colorcpl.exe
2796	colorcpl.exe
2796	colorcpl.exe
2796	colorcpl.exe
2796	colorcpl.exe
2796	colorcpl.exe
2796	colorcpl.exe
2796	colorcpl.exe
2796	colorcpl.exe
2796	colorcpl.exe
2796	colorcpl.exe
2796	colorcpl.exe
2796	colorcpl.exe
2796	colorcpl.exe
2796	colorcpl.exe
2796	colorcpl.exe
2796	colorcpl.exe
2796	colorcpl.exe
2796	colorcpl.exe
2796	colorcpl.exe
2796	colorcpl.exe
2796	colorcpl.exe
2796	colorcpl.exe
2796	colorcpl.exe
2796	colorcpl.exe
2796	colorcpl.exe
2796	colorcpl.exe
2796	colorcpl.exe
2796	colorcpl.exe
2796	colorcpl.exe
2796	colorcpl.exe
2796	colorcpl.exe
2796	colorcpl.exe
2796	colorcpl.exe
2796	colorcpl.exe
2796	colorcpl.exe
2796	colorcpl.exe
2796	colorcpl.exe
2796	colorcpl.exe
2796	colorcpl.exe
2796	colorcpl.exe
2796	colorcpl.exe
2796	colorcpl.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

2972 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

DpiScaling.execolorcpl.exe

pid process

2536 DpiScaling.exe
2536 DpiScaling.exe
2536 DpiScaling.exe
2796 colorcpl.exe
2796 colorcpl.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

DpiScaling.execolorcpl.exe

description pid process

Token: SeDebugPrivilege 2536 DpiScaling.exe
Token: SeDebugPrivilege 2796 colorcpl.exe

pid	process
2972	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	2536	DpiScaling.exe
Token: SeDebugPrivilege	2796	colorcpl.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Produktmuster bestellen pdf.exeExplorer.EXEcolorcpl.exe

description	pid	process	target process
PID 1820 wrote to memory of 2536	1820	Produktmuster bestellen pdf.exe	DpiScaling.exe
PID 1820 wrote to memory of 2536	1820	Produktmuster bestellen pdf.exe	DpiScaling.exe
PID 1820 wrote to memory of 2536	1820	Produktmuster bestellen pdf.exe	DpiScaling.exe
PID 1820 wrote to memory of 2536	1820	Produktmuster bestellen pdf.exe	DpiScaling.exe
PID 1820 wrote to memory of 2536	1820	Produktmuster bestellen pdf.exe	DpiScaling.exe
PID 1820 wrote to memory of 2536	1820	Produktmuster bestellen pdf.exe	DpiScaling.exe
PID 2972 wrote to memory of 2796	2972	Explorer.EXE	colorcpl.exe
PID 2972 wrote to memory of 2796	2972	Explorer.EXE	colorcpl.exe
PID 2972 wrote to memory of 2796	2972	Explorer.EXE	colorcpl.exe
PID 2796 wrote to memory of 3532	2796	colorcpl.exe	cmd.exe
PID 2796 wrote to memory of 3532	2796	colorcpl.exe	cmd.exe
PID 2796 wrote to memory of 3532	2796	colorcpl.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2972

C:\Users\Admin\AppData\Local\Temp\Produktmuster bestellen pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Produktmuster bestellen pdf.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1820

C:\Windows\SysWOW64\DpiScaling.exe
DpiScaling.exe
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2536

C:\Windows\SysWOW64\colorcpl.exe
"C:\Windows\SysWOW64\colorcpl.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2796

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Windows\SysWOW64\DpiScaling.exe"
3⤵
PID:3532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1820-115-0x0000000000630000-0x000000000077A000-memory.dmp

Filesize
1.3MB

Download
memory/2536-116-0x0000000000000000-mapping.dmp

Download
memory/2536-118-0x0000000010410000-0x000000001043E000-memory.dmp

Filesize
184KB

Download
memory/2536-117-0x0000000000700000-0x0000000000701000-memory.dmp

Filesize
4KB

Download
memory/2536-120-0x0000000000FA0000-0x0000000000FB4000-memory.dmp

Filesize
80KB

Download
memory/2536-119-0x0000000004780000-0x0000000004AA0000-memory.dmp

Filesize
3.1MB

Download
memory/2796-124-0x0000000000A00000-0x0000000000A2E000-memory.dmp

Filesize
184KB

Download
memory/2796-122-0x0000000000000000-mapping.dmp

Download
memory/2796-123-0x0000000001080000-0x0000000001099000-memory.dmp

Filesize
100KB

Download
memory/2796-125-0x00000000049E0000-0x0000000004D00000-memory.dmp

Filesize
3.1MB

Download
memory/2796-127-0x0000000004750000-0x00000000047E3000-memory.dmp

Filesize
588KB

Download
memory/2972-121-0x0000000006B30000-0x0000000006C7D000-memory.dmp

Filesize
1.3MB

Download
memory/2972-128-0x0000000006C80000-0x0000000006DFC000-memory.dmp

Filesize
1.5MB

Download
memory/3532-126-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads