formbook | 92c90d735148f7fd056e2d53bf44239f3fdab6b029e78d3ed6077d9c7f40aef2

General

Target

92c90d735148f7fd056e2d53bf44239f3fdab6b029e78d3ed6077d9c7f40aef2.exe
Size

490KB
MD5

3b2d25157b1d79ec200db1564b696bc8
SHA1

4e188e851f36fe716494fc805039b4f30f0b3c96
SHA256

92c90d735148f7fd056e2d53bf44239f3fdab6b029e78d3ed6077d9c7f40aef2
SHA512

d9071b6d905382c6ab94675cd65c35ef7fd11ae0f9e2dd2dc4fcf8a921807f7ae271e0730efe98dd858e284f185edd57866fac818c2a9c712e96b5c7f9df48f2

Score

10^/10

formbook bckt rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

bckt

C2

http://www.picnictablecompany.com/bckt/

Decoy

termoindustrias.com

vcjcfw.com

digitalmoutain.com

outtanowhereentertainment.com

kcreative.design

tea-mails.com

xn--ob0b23la.com

lanyard-for-keys.com

luoyuanqiong.com

goxhome.com

spryandhonner.com

sheltrd.com

aagamdahale.com

charlie-fendius.com

zekesky.com

bills360hub.com

byrsmith.com

emaxpk.com

waterproofselection.com

primelab.xyz

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/3728-125-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/3728-126-0x000000000041F190-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

92c90d735148f7fd056e2d53bf44239f3fdab6b029e78d3ed6077d9c7f40aef2.exe

description	pid	process	target process
PID 2392 set thread context of 3728	2392	92c90d735148f7fd056e2d53bf44239f3fdab6b029e78d3ed6077d9c7f40aef2.exe	92c90d735148f7fd056e2d53bf44239f3fdab6b029e78d3ed6077d9c7f40aef2.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

92c90d735148f7fd056e2d53bf44239f3fdab6b029e78d3ed6077d9c7f40aef2.exe92c90d735148f7fd056e2d53bf44239f3fdab6b029e78d3ed6077d9c7f40aef2.exe

pid	process
2392	92c90d735148f7fd056e2d53bf44239f3fdab6b029e78d3ed6077d9c7f40aef2.exe
2392	92c90d735148f7fd056e2d53bf44239f3fdab6b029e78d3ed6077d9c7f40aef2.exe
3728	92c90d735148f7fd056e2d53bf44239f3fdab6b029e78d3ed6077d9c7f40aef2.exe
3728	92c90d735148f7fd056e2d53bf44239f3fdab6b029e78d3ed6077d9c7f40aef2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

92c90d735148f7fd056e2d53bf44239f3fdab6b029e78d3ed6077d9c7f40aef2.exe

description pid process

Token: SeDebugPrivilege 2392 92c90d735148f7fd056e2d53bf44239f3fdab6b029e78d3ed6077d9c7f40aef2.exe

description	pid	process
Token: SeDebugPrivilege	2392	92c90d735148f7fd056e2d53bf44239f3fdab6b029e78d3ed6077d9c7f40aef2.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

92c90d735148f7fd056e2d53bf44239f3fdab6b029e78d3ed6077d9c7f40aef2.exe

description	pid	process	target process
PID 2392 wrote to memory of 1680	2392	92c90d735148f7fd056e2d53bf44239f3fdab6b029e78d3ed6077d9c7f40aef2.exe	92c90d735148f7fd056e2d53bf44239f3fdab6b029e78d3ed6077d9c7f40aef2.exe
PID 2392 wrote to memory of 1680	2392	92c90d735148f7fd056e2d53bf44239f3fdab6b029e78d3ed6077d9c7f40aef2.exe	92c90d735148f7fd056e2d53bf44239f3fdab6b029e78d3ed6077d9c7f40aef2.exe
PID 2392 wrote to memory of 1680	2392	92c90d735148f7fd056e2d53bf44239f3fdab6b029e78d3ed6077d9c7f40aef2.exe	92c90d735148f7fd056e2d53bf44239f3fdab6b029e78d3ed6077d9c7f40aef2.exe
PID 2392 wrote to memory of 3728	2392	92c90d735148f7fd056e2d53bf44239f3fdab6b029e78d3ed6077d9c7f40aef2.exe	92c90d735148f7fd056e2d53bf44239f3fdab6b029e78d3ed6077d9c7f40aef2.exe
PID 2392 wrote to memory of 3728	2392	92c90d735148f7fd056e2d53bf44239f3fdab6b029e78d3ed6077d9c7f40aef2.exe	92c90d735148f7fd056e2d53bf44239f3fdab6b029e78d3ed6077d9c7f40aef2.exe
PID 2392 wrote to memory of 3728	2392	92c90d735148f7fd056e2d53bf44239f3fdab6b029e78d3ed6077d9c7f40aef2.exe	92c90d735148f7fd056e2d53bf44239f3fdab6b029e78d3ed6077d9c7f40aef2.exe
PID 2392 wrote to memory of 3728	2392	92c90d735148f7fd056e2d53bf44239f3fdab6b029e78d3ed6077d9c7f40aef2.exe	92c90d735148f7fd056e2d53bf44239f3fdab6b029e78d3ed6077d9c7f40aef2.exe
PID 2392 wrote to memory of 3728	2392	92c90d735148f7fd056e2d53bf44239f3fdab6b029e78d3ed6077d9c7f40aef2.exe	92c90d735148f7fd056e2d53bf44239f3fdab6b029e78d3ed6077d9c7f40aef2.exe
PID 2392 wrote to memory of 3728	2392	92c90d735148f7fd056e2d53bf44239f3fdab6b029e78d3ed6077d9c7f40aef2.exe	92c90d735148f7fd056e2d53bf44239f3fdab6b029e78d3ed6077d9c7f40aef2.exe

C:\Users\Admin\AppData\Local\Temp\92c90d735148f7fd056e2d53bf44239f3fdab6b029e78d3ed6077d9c7f40aef2.exe
"C:\Users\Admin\AppData\Local\Temp\92c90d735148f7fd056e2d53bf44239f3fdab6b029e78d3ed6077d9c7f40aef2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2392

C:\Users\Admin\AppData\Local\Temp\92c90d735148f7fd056e2d53bf44239f3fdab6b029e78d3ed6077d9c7f40aef2.exe
"C:\Users\Admin\AppData\Local\Temp\92c90d735148f7fd056e2d53bf44239f3fdab6b029e78d3ed6077d9c7f40aef2.exe"
2⤵
PID:1680

C:\Users\Admin\AppData\Local\Temp\92c90d735148f7fd056e2d53bf44239f3fdab6b029e78d3ed6077d9c7f40aef2.exe
"C:\Users\Admin\AppData\Local\Temp\92c90d735148f7fd056e2d53bf44239f3fdab6b029e78d3ed6077d9c7f40aef2.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2392-115-0x0000000000380000-0x0000000000381000-memory.dmp

Filesize
4KB

Download
memory/2392-117-0x0000000005210000-0x0000000005211000-memory.dmp

Filesize
4KB

Download
memory/2392-118-0x0000000004C20000-0x0000000004C21000-memory.dmp

Filesize
4KB

Download
memory/2392-119-0x0000000004CD0000-0x0000000004CD1000-memory.dmp

Filesize
4KB

Download
memory/2392-120-0x0000000004EA0000-0x0000000004EA1000-memory.dmp

Filesize
4KB

Download
memory/2392-121-0x0000000004CE0000-0x0000000004CE7000-memory.dmp

Filesize
28KB

Download
memory/2392-122-0x0000000004D10000-0x000000000520E000-memory.dmp

Filesize
5.0MB

Download
memory/2392-123-0x0000000005940000-0x00000000059A8000-memory.dmp

Filesize
416KB

Download
memory/2392-124-0x0000000005AB0000-0x0000000005AE8000-memory.dmp

Filesize
224KB

Download
memory/3728-125-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3728-126-0x000000000041F190-mapping.dmp

Download
memory/3728-127-0x0000000001160000-0x0000000001480000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads