formbook | 7e647d064a55731e15f05904b636037d2339e84ca425f53cf752004cd8797468

General

Target

7e647d064a55731e15f05904b636037d2339e84ca425f53cf752004cd8797468.exe
Size

495KB
MD5

b60d7ba369775810d35a8f9fdbc57e83
SHA1

91badba118714884ef1c4d51ec2e2680fb6078b9
SHA256

7e647d064a55731e15f05904b636037d2339e84ca425f53cf752004cd8797468
SHA512

3cb867066080ff4b168b4009260969c7c2093cf7ece6e786e2bbbf73b20f2b677829310b932f208e0c3d04bb3e77c9c081c54807bdbbb3931d3ac5865a0d5f76

Score

10^/10

formbook fzsg rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

fzsg

C2

http://www.grouplmc.com/fzsg/

Decoy

thewetpatch.wtf

oceanfrontrecords.com

ultimatemecha.com

domainnameshq.com

schieksrvservice.com

bedandbreakfastitalia.cloud

rfmlc.com

hightechvids.com

greenvilledermotolgy.com

psilocybinforu.com

xjkerwen.com

euro-d-rev.com

shans-online.com

masterofcrypto.com

gamodaitaliana.online

lavivabet217.com

femsol.online

qafyzey.site

kang17.xyz

kilimlove.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/3008-124-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/3008-125-0x000000000041F100-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

7e647d064a55731e15f05904b636037d2339e84ca425f53cf752004cd8797468.exe

description	pid	process	target process
PID 3628 set thread context of 3008	3628	7e647d064a55731e15f05904b636037d2339e84ca425f53cf752004cd8797468.exe	7e647d064a55731e15f05904b636037d2339e84ca425f53cf752004cd8797468.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

7e647d064a55731e15f05904b636037d2339e84ca425f53cf752004cd8797468.exe

pid	process
3008	7e647d064a55731e15f05904b636037d2339e84ca425f53cf752004cd8797468.exe
3008	7e647d064a55731e15f05904b636037d2339e84ca425f53cf752004cd8797468.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

7e647d064a55731e15f05904b636037d2339e84ca425f53cf752004cd8797468.exe

description	pid	process	target process
PID 3628 wrote to memory of 3008	3628	7e647d064a55731e15f05904b636037d2339e84ca425f53cf752004cd8797468.exe	7e647d064a55731e15f05904b636037d2339e84ca425f53cf752004cd8797468.exe
PID 3628 wrote to memory of 3008	3628	7e647d064a55731e15f05904b636037d2339e84ca425f53cf752004cd8797468.exe	7e647d064a55731e15f05904b636037d2339e84ca425f53cf752004cd8797468.exe
PID 3628 wrote to memory of 3008	3628	7e647d064a55731e15f05904b636037d2339e84ca425f53cf752004cd8797468.exe	7e647d064a55731e15f05904b636037d2339e84ca425f53cf752004cd8797468.exe
PID 3628 wrote to memory of 3008	3628	7e647d064a55731e15f05904b636037d2339e84ca425f53cf752004cd8797468.exe	7e647d064a55731e15f05904b636037d2339e84ca425f53cf752004cd8797468.exe
PID 3628 wrote to memory of 3008	3628	7e647d064a55731e15f05904b636037d2339e84ca425f53cf752004cd8797468.exe	7e647d064a55731e15f05904b636037d2339e84ca425f53cf752004cd8797468.exe
PID 3628 wrote to memory of 3008	3628	7e647d064a55731e15f05904b636037d2339e84ca425f53cf752004cd8797468.exe	7e647d064a55731e15f05904b636037d2339e84ca425f53cf752004cd8797468.exe

C:\Users\Admin\AppData\Local\Temp\7e647d064a55731e15f05904b636037d2339e84ca425f53cf752004cd8797468.exe
"C:\Users\Admin\AppData\Local\Temp\7e647d064a55731e15f05904b636037d2339e84ca425f53cf752004cd8797468.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3628
- C:\Users\Admin\AppData\Local\Temp\7e647d064a55731e15f05904b636037d2339e84ca425f53cf752004cd8797468.exe
  "C:\Users\Admin\AppData\Local\Temp\7e647d064a55731e15f05904b636037d2339e84ca425f53cf752004cd8797468.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3008-124-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3008-125-0x000000000041F100-mapping.dmp

Download
memory/3008-126-0x0000000000FF0000-0x0000000001310000-memory.dmp

Filesize
3.1MB

Download
memory/3628-114-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/3628-116-0x0000000004F50000-0x0000000004F51000-memory.dmp

Filesize
4KB

Download
memory/3628-117-0x0000000004AF0000-0x0000000004AF1000-memory.dmp

Filesize
4KB

Download
memory/3628-118-0x0000000004A50000-0x0000000004F4E000-memory.dmp

Filesize
5.0MB

Download
memory/3628-119-0x0000000004AB0000-0x0000000004AB1000-memory.dmp

Filesize
4KB

Download
memory/3628-120-0x0000000004D10000-0x0000000004D11000-memory.dmp

Filesize
4KB

Download
memory/3628-121-0x0000000004AC0000-0x0000000004AC7000-memory.dmp

Filesize
28KB

Download
memory/3628-122-0x00000000057C0000-0x0000000005827000-memory.dmp

Filesize
412KB

Download
memory/3628-123-0x0000000005930000-0x0000000005967000-memory.dmp

Filesize
220KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads