formbook | 694b9ea09a47c2f24b47c60ddff0a0537828e8ba964c0ad0045b9862bce37d42

General

Target

76d6388e293de04e8ff5b3124a47cb82.exe
Size

355KB
MD5

76d6388e293de04e8ff5b3124a47cb82
SHA1

a6163b93b45573b4a7792588a9fad3e8ba22ef71
SHA256

694b9ea09a47c2f24b47c60ddff0a0537828e8ba964c0ad0045b9862bce37d42
SHA512

00ebb1aed4182d52704cef6fadb9f81e2cffc8b8eefb6c1268113acd6fdfe882646cd4245856e30624c6bd71dc61e6d64f7230f1ebf22ebbb196446dbb078a99

Score

10^/10

formbook vngb rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

vngb

C2

http://www.gvlc0.club/vngb/

Decoy

omertalasvegas.com

payyep.com

modasportss.com

gestionestrategicadl.com

teamolemiss.club

geektranslate.com

versatileventure.com

athletic-hub.com

vitanovaretreats.com

padison8t.com

tutoeasy.com

ediblewholesale.com

kangrungao.com

satode.com

prohibitionfeeds.com

getmorevacations.com

blinkworldbeauty.com

kdlabsallr.com

almanasef.com

transportationservicellc.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4092-123-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/4092-124-0x000000000041F0E0-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

76d6388e293de04e8ff5b3124a47cb82.exe

description pid process target process

PID 4060 set thread context of 4092 4060 76d6388e293de04e8ff5b3124a47cb82.exe 76d6388e293de04e8ff5b3124a47cb82.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

76d6388e293de04e8ff5b3124a47cb82.exe

pid process

4092 76d6388e293de04e8ff5b3124a47cb82.exe
4092 76d6388e293de04e8ff5b3124a47cb82.exe

description	pid	process	target process
PID 4060 set thread context of 4092	4060	76d6388e293de04e8ff5b3124a47cb82.exe	76d6388e293de04e8ff5b3124a47cb82.exe

pid	process
4092	76d6388e293de04e8ff5b3124a47cb82.exe
4092	76d6388e293de04e8ff5b3124a47cb82.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

76d6388e293de04e8ff5b3124a47cb82.exe

description	pid	process	target process
PID 4060 wrote to memory of 4092	4060	76d6388e293de04e8ff5b3124a47cb82.exe	76d6388e293de04e8ff5b3124a47cb82.exe
PID 4060 wrote to memory of 4092	4060	76d6388e293de04e8ff5b3124a47cb82.exe	76d6388e293de04e8ff5b3124a47cb82.exe
PID 4060 wrote to memory of 4092	4060	76d6388e293de04e8ff5b3124a47cb82.exe	76d6388e293de04e8ff5b3124a47cb82.exe
PID 4060 wrote to memory of 4092	4060	76d6388e293de04e8ff5b3124a47cb82.exe	76d6388e293de04e8ff5b3124a47cb82.exe
PID 4060 wrote to memory of 4092	4060	76d6388e293de04e8ff5b3124a47cb82.exe	76d6388e293de04e8ff5b3124a47cb82.exe
PID 4060 wrote to memory of 4092	4060	76d6388e293de04e8ff5b3124a47cb82.exe	76d6388e293de04e8ff5b3124a47cb82.exe

C:\Users\Admin\AppData\Local\Temp\76d6388e293de04e8ff5b3124a47cb82.exe
"C:\Users\Admin\AppData\Local\Temp\76d6388e293de04e8ff5b3124a47cb82.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4060

C:\Users\Admin\AppData\Local\Temp\76d6388e293de04e8ff5b3124a47cb82.exe
"C:\Users\Admin\AppData\Local\Temp\76d6388e293de04e8ff5b3124a47cb82.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4092

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4060-114-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download
memory/4060-116-0x0000000005000000-0x0000000005001000-memory.dmp

Filesize
4KB

Download
memory/4060-117-0x00000000026E0000-0x00000000026E1000-memory.dmp

Filesize
4KB

Download
memory/4060-118-0x0000000004B00000-0x0000000004FFE000-memory.dmp

Filesize
5.0MB

Download
memory/4060-119-0x0000000002580000-0x0000000002581000-memory.dmp

Filesize
4KB

Download
memory/4060-120-0x0000000004FF0000-0x0000000004FF5000-memory.dmp

Filesize
20KB

Download
memory/4060-121-0x0000000006FB0000-0x0000000006FB1000-memory.dmp

Filesize
4KB

Download
memory/4060-122-0x00000000068F0000-0x0000000006940000-memory.dmp

Filesize
320KB

Download
memory/4092-123-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4092-124-0x000000000041F0E0-mapping.dmp

Download
memory/4092-125-0x0000000001560000-0x0000000001880000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing