formbook | 0c33fe39195569a868cf9f87d3aff16e72f5a54c4e52a852b8f986d121fa47e8

General

Target

0c33fe39195569a868cf9f87d3aff16e72f5a54c4e52a852b8f986d121fa47e8.exe
Size

485KB
MD5

1fe73fe4d37cae6a02262b5164f3def0
SHA1

80b03eb27651723bded1fd1425f489225b3bba3b
SHA256

0c33fe39195569a868cf9f87d3aff16e72f5a54c4e52a852b8f986d121fa47e8
SHA512

7416dadb6e85cc43000bba33f47797cf7e5fe5ee0c9f8639685130264a867b6048839d2b74ca3e00b00caf8a1dcf83d08f01901c56ab9343888d62501c48d2b6

Score

10^/10

formbook kzk9 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

kzk9

C2

http://www.yourmajordomo.com/kzk9/

Decoy

tianconghuo.club

1996-page.com

ourtownmax.net

conservativetreehose.com

synth.repair

donnachicacreperia.com

tentfull.com

weapp.download

surfersink.com

gattlebusinessservices.com

sebastian249.com

anhphuc.company

betternatureproducts.net

defroplate.com

seattlesquidsquad.com

polarjob.com

lendingadvantage.com

angelsondope.com

goportjitney.com

tiendagrupojagr.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1096-123-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/1096-124-0x000000000041EB80-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

0c33fe39195569a868cf9f87d3aff16e72f5a54c4e52a852b8f986d121fa47e8.exe

description	pid	process	target process
PID 656 set thread context of 1096	656	0c33fe39195569a868cf9f87d3aff16e72f5a54c4e52a852b8f986d121fa47e8.exe	0c33fe39195569a868cf9f87d3aff16e72f5a54c4e52a852b8f986d121fa47e8.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

0c33fe39195569a868cf9f87d3aff16e72f5a54c4e52a852b8f986d121fa47e8.exe0c33fe39195569a868cf9f87d3aff16e72f5a54c4e52a852b8f986d121fa47e8.exe

pid	process
656	0c33fe39195569a868cf9f87d3aff16e72f5a54c4e52a852b8f986d121fa47e8.exe
656	0c33fe39195569a868cf9f87d3aff16e72f5a54c4e52a852b8f986d121fa47e8.exe
656	0c33fe39195569a868cf9f87d3aff16e72f5a54c4e52a852b8f986d121fa47e8.exe
656	0c33fe39195569a868cf9f87d3aff16e72f5a54c4e52a852b8f986d121fa47e8.exe
656	0c33fe39195569a868cf9f87d3aff16e72f5a54c4e52a852b8f986d121fa47e8.exe
656	0c33fe39195569a868cf9f87d3aff16e72f5a54c4e52a852b8f986d121fa47e8.exe
1096	0c33fe39195569a868cf9f87d3aff16e72f5a54c4e52a852b8f986d121fa47e8.exe
1096	0c33fe39195569a868cf9f87d3aff16e72f5a54c4e52a852b8f986d121fa47e8.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0c33fe39195569a868cf9f87d3aff16e72f5a54c4e52a852b8f986d121fa47e8.exe

description pid process

Token: SeDebugPrivilege 656 0c33fe39195569a868cf9f87d3aff16e72f5a54c4e52a852b8f986d121fa47e8.exe

description	pid	process
Token: SeDebugPrivilege	656	0c33fe39195569a868cf9f87d3aff16e72f5a54c4e52a852b8f986d121fa47e8.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

0c33fe39195569a868cf9f87d3aff16e72f5a54c4e52a852b8f986d121fa47e8.exe

description	pid	process	target process
PID 656 wrote to memory of 1096	656	0c33fe39195569a868cf9f87d3aff16e72f5a54c4e52a852b8f986d121fa47e8.exe	0c33fe39195569a868cf9f87d3aff16e72f5a54c4e52a852b8f986d121fa47e8.exe
PID 656 wrote to memory of 1096	656	0c33fe39195569a868cf9f87d3aff16e72f5a54c4e52a852b8f986d121fa47e8.exe	0c33fe39195569a868cf9f87d3aff16e72f5a54c4e52a852b8f986d121fa47e8.exe
PID 656 wrote to memory of 1096	656	0c33fe39195569a868cf9f87d3aff16e72f5a54c4e52a852b8f986d121fa47e8.exe	0c33fe39195569a868cf9f87d3aff16e72f5a54c4e52a852b8f986d121fa47e8.exe
PID 656 wrote to memory of 1096	656	0c33fe39195569a868cf9f87d3aff16e72f5a54c4e52a852b8f986d121fa47e8.exe	0c33fe39195569a868cf9f87d3aff16e72f5a54c4e52a852b8f986d121fa47e8.exe
PID 656 wrote to memory of 1096	656	0c33fe39195569a868cf9f87d3aff16e72f5a54c4e52a852b8f986d121fa47e8.exe	0c33fe39195569a868cf9f87d3aff16e72f5a54c4e52a852b8f986d121fa47e8.exe
PID 656 wrote to memory of 1096	656	0c33fe39195569a868cf9f87d3aff16e72f5a54c4e52a852b8f986d121fa47e8.exe	0c33fe39195569a868cf9f87d3aff16e72f5a54c4e52a852b8f986d121fa47e8.exe

C:\Users\Admin\AppData\Local\Temp\0c33fe39195569a868cf9f87d3aff16e72f5a54c4e52a852b8f986d121fa47e8.exe
"C:\Users\Admin\AppData\Local\Temp\0c33fe39195569a868cf9f87d3aff16e72f5a54c4e52a852b8f986d121fa47e8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:656

C:\Users\Admin\AppData\Local\Temp\0c33fe39195569a868cf9f87d3aff16e72f5a54c4e52a852b8f986d121fa47e8.exe
"C:\Users\Admin\AppData\Local\Temp\0c33fe39195569a868cf9f87d3aff16e72f5a54c4e52a852b8f986d121fa47e8.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1096

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/656-114-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download
memory/656-116-0x00000000050D0000-0x00000000050D1000-memory.dmp

Filesize
4KB

Download
memory/656-117-0x0000000004CB0000-0x0000000004CB1000-memory.dmp

Filesize
4KB

Download
memory/656-118-0x0000000004C40000-0x0000000004C41000-memory.dmp

Filesize
4KB

Download
memory/656-119-0x0000000004BD0000-0x00000000050CE000-memory.dmp

Filesize
5.0MB

Download
memory/656-120-0x0000000004FD0000-0x0000000004FD5000-memory.dmp

Filesize
20KB

Download
memory/656-121-0x0000000007170000-0x0000000007171000-memory.dmp

Filesize
4KB

Download
memory/656-122-0x0000000007210000-0x0000000007260000-memory.dmp

Filesize
320KB

Download
memory/1096-123-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1096-124-0x000000000041EB80-mapping.dmp

Download
memory/1096-125-0x0000000001450000-0x0000000001770000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads