formbook | 1cf584b3c3eededb83018e351db64db867ed30dc15fb280d14c2d7ef810db423

Analysis

Target
Pedido 299.exe
Size 382KB
Sample210930-eyaceagdc9
SHA256 28f0397af278256b634686ba73bd16ab3344f29e3a4ed7fe486e2408ee52345a
MD5 6cbbba154506fa873c3238ed362d9a5d
SHA1 a23e5d49fdbbc76007adf5b1bf743551a32e4d9c
SHA512 c05a95ffcb34669bb0e472445471c3aca8255f6071cbbe135b827809347964589315fe203e4eb1b4da4ff18fa06463ea0c24b67ef2e0427b6652148dfd607988
MD5 SHA1 SHA512

Score

10^/10

Family

Version

Campaign

Decoy

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2072 created 2532	2072	WerFault.exe	69

Formbook Payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/2532-115-0x0000000002060000-0x000000000208F000-memory.dmp	formbook

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2072	2532	WerFault.exe	69

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

C:\Users\Admin\AppData\Local\Temp\Pedido 299.exe
"C:\Users\Admin\AppData\Local\Temp\Pedido 299.exe"
1⤵
PID:2532
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 248
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2072

memory/2532-115-0x0000000002060000-0x000000000208F000-memory.dmp

Download