formbook | 51d534b716e35b643ac2a4aa73effe9607abfc61a36b7b4a423c9383002b755e

General

Target

51d534b716e35b643ac2a4aa73effe9607abfc61a36b7b4a423c9383002b755e.exe
Size

531KB
MD5

0485b82d63f7ad0fcf8fb8cad375d27c
SHA1

cd5a1c7eac16d6de771d82aafc0b88d3446dcd51
SHA256

51d534b716e35b643ac2a4aa73effe9607abfc61a36b7b4a423c9383002b755e
SHA512

b18d8513051ba56a4e3a0b8fdf0ade811ea0fe7636cd1d910f0c6bfad8def2c8062f5aa360ff48f8ecdc8534885accc510d98e67d6e7443f178e23549e608a98

Score

10^/10

formbook mxwf rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

mxwf

C2

http://www.zahnimplantatangebotede.com/mxwf/

Decoy

orders-cialis.info

auctionorbuy.com

meanmugsamore.com

yachtcrewmark.com

sacredkashilifestudio.net

themintyard.com

bragafoods.com

sierp.com

hausofdeme.com

anthonyjames915.com

bajardepesoencasa.com

marciaroyal.com

earringlifter.com

dsdjfhd9ddksa1as.info

bmzproekt.com

employmentbc.com

ptsdtreatment.space

vrchance.com

cnrongding.com

welovelit.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1448-124-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/1448-125-0x000000000041EBA0-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

51d534b716e35b643ac2a4aa73effe9607abfc61a36b7b4a423c9383002b755e.exe

description	pid	process	target process
PID 2072 set thread context of 1448	2072	51d534b716e35b643ac2a4aa73effe9607abfc61a36b7b4a423c9383002b755e.exe	51d534b716e35b643ac2a4aa73effe9607abfc61a36b7b4a423c9383002b755e.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

51d534b716e35b643ac2a4aa73effe9607abfc61a36b7b4a423c9383002b755e.exe

pid	process
1448	51d534b716e35b643ac2a4aa73effe9607abfc61a36b7b4a423c9383002b755e.exe
1448	51d534b716e35b643ac2a4aa73effe9607abfc61a36b7b4a423c9383002b755e.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

51d534b716e35b643ac2a4aa73effe9607abfc61a36b7b4a423c9383002b755e.exe

description	pid	process	target process
PID 2072 wrote to memory of 1448	2072	51d534b716e35b643ac2a4aa73effe9607abfc61a36b7b4a423c9383002b755e.exe	51d534b716e35b643ac2a4aa73effe9607abfc61a36b7b4a423c9383002b755e.exe
PID 2072 wrote to memory of 1448	2072	51d534b716e35b643ac2a4aa73effe9607abfc61a36b7b4a423c9383002b755e.exe	51d534b716e35b643ac2a4aa73effe9607abfc61a36b7b4a423c9383002b755e.exe
PID 2072 wrote to memory of 1448	2072	51d534b716e35b643ac2a4aa73effe9607abfc61a36b7b4a423c9383002b755e.exe	51d534b716e35b643ac2a4aa73effe9607abfc61a36b7b4a423c9383002b755e.exe
PID 2072 wrote to memory of 1448	2072	51d534b716e35b643ac2a4aa73effe9607abfc61a36b7b4a423c9383002b755e.exe	51d534b716e35b643ac2a4aa73effe9607abfc61a36b7b4a423c9383002b755e.exe
PID 2072 wrote to memory of 1448	2072	51d534b716e35b643ac2a4aa73effe9607abfc61a36b7b4a423c9383002b755e.exe	51d534b716e35b643ac2a4aa73effe9607abfc61a36b7b4a423c9383002b755e.exe
PID 2072 wrote to memory of 1448	2072	51d534b716e35b643ac2a4aa73effe9607abfc61a36b7b4a423c9383002b755e.exe	51d534b716e35b643ac2a4aa73effe9607abfc61a36b7b4a423c9383002b755e.exe

C:\Users\Admin\AppData\Local\Temp\51d534b716e35b643ac2a4aa73effe9607abfc61a36b7b4a423c9383002b755e.exe
"C:\Users\Admin\AppData\Local\Temp\51d534b716e35b643ac2a4aa73effe9607abfc61a36b7b4a423c9383002b755e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2072

C:\Users\Admin\AppData\Local\Temp\51d534b716e35b643ac2a4aa73effe9607abfc61a36b7b4a423c9383002b755e.exe
"C:\Users\Admin\AppData\Local\Temp\51d534b716e35b643ac2a4aa73effe9607abfc61a36b7b4a423c9383002b755e.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1448

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1448-124-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1448-125-0x000000000041EBA0-mapping.dmp

Download
memory/1448-126-0x00000000019D0000-0x0000000001CF0000-memory.dmp

Filesize
3.1MB

Download
memory/2072-115-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/2072-117-0x00000000054B0000-0x00000000054B1000-memory.dmp

Filesize
4KB

Download
memory/2072-118-0x0000000004FB0000-0x0000000004FB1000-memory.dmp

Filesize
4KB

Download
memory/2072-119-0x0000000004F70000-0x0000000004F71000-memory.dmp

Filesize
4KB

Download
memory/2072-120-0x0000000004F80000-0x0000000004F81000-memory.dmp

Filesize
4KB

Download
memory/2072-121-0x00000000051E0000-0x00000000051E5000-memory.dmp

Filesize
20KB

Download
memory/2072-122-0x0000000007260000-0x0000000007261000-memory.dmp

Filesize
4KB

Download
memory/2072-123-0x0000000007400000-0x0000000007470000-memory.dmp

Filesize
448KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads