formbook | a68cb3bf1d9d41e29fcf2e4391e827591e58783cea5a13fe95403fb6b3429b5d

General

Target

739db143a714b168ad4250a12a903a91.exe
Size

345KB
MD5

739db143a714b168ad4250a12a903a91
SHA1

0e16e00f6fd173672e5e70797a1b063399d373d8
SHA256

a68cb3bf1d9d41e29fcf2e4391e827591e58783cea5a13fe95403fb6b3429b5d
SHA512

09a5436fe70035fc2225729db560eba215027ca709df7e2050aa7f3f40bf9d5b94499e3e23bb646bcf64fb3199a553d51751998aab4a243eeb2877b6c5b64e37

Score

10^/10

formbook vngb rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

vngb

C2

http://www.gvlc0.club/vngb/

Decoy

omertalasvegas.com

payyep.com

modasportss.com

gestionestrategicadl.com

teamolemiss.club

geektranslate.com

versatileventure.com

athletic-hub.com

vitanovaretreats.com

padison8t.com

tutoeasy.com

ediblewholesale.com

kangrungao.com

satode.com

prohibitionfeeds.com

getmorevacations.com

blinkworldbeauty.com

kdlabsallr.com

almanasef.com

transportationservicellc.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2312-124-0x000000000041F0E0-mapping.dmp	formbook
behavioral2/memory/2312-123-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

739db143a714b168ad4250a12a903a91.exe

description pid process target process

PID 808 set thread context of 2312 808 739db143a714b168ad4250a12a903a91.exe 739db143a714b168ad4250a12a903a91.exe

description	pid	process	target process
PID 808 set thread context of 2312	808	739db143a714b168ad4250a12a903a91.exe	739db143a714b168ad4250a12a903a91.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

739db143a714b168ad4250a12a903a91.exe739db143a714b168ad4250a12a903a91.exe

pid	process
808	739db143a714b168ad4250a12a903a91.exe
808	739db143a714b168ad4250a12a903a91.exe
2312	739db143a714b168ad4250a12a903a91.exe
2312	739db143a714b168ad4250a12a903a91.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

739db143a714b168ad4250a12a903a91.exe

description pid process

Token: SeDebugPrivilege 808 739db143a714b168ad4250a12a903a91.exe

description	pid	process
Token: SeDebugPrivilege	808	739db143a714b168ad4250a12a903a91.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

739db143a714b168ad4250a12a903a91.exe

description	pid	process	target process
PID 808 wrote to memory of 3556	808	739db143a714b168ad4250a12a903a91.exe	739db143a714b168ad4250a12a903a91.exe
PID 808 wrote to memory of 3556	808	739db143a714b168ad4250a12a903a91.exe	739db143a714b168ad4250a12a903a91.exe
PID 808 wrote to memory of 3556	808	739db143a714b168ad4250a12a903a91.exe	739db143a714b168ad4250a12a903a91.exe
PID 808 wrote to memory of 2312	808	739db143a714b168ad4250a12a903a91.exe	739db143a714b168ad4250a12a903a91.exe
PID 808 wrote to memory of 2312	808	739db143a714b168ad4250a12a903a91.exe	739db143a714b168ad4250a12a903a91.exe
PID 808 wrote to memory of 2312	808	739db143a714b168ad4250a12a903a91.exe	739db143a714b168ad4250a12a903a91.exe
PID 808 wrote to memory of 2312	808	739db143a714b168ad4250a12a903a91.exe	739db143a714b168ad4250a12a903a91.exe
PID 808 wrote to memory of 2312	808	739db143a714b168ad4250a12a903a91.exe	739db143a714b168ad4250a12a903a91.exe
PID 808 wrote to memory of 2312	808	739db143a714b168ad4250a12a903a91.exe	739db143a714b168ad4250a12a903a91.exe

C:\Users\Admin\AppData\Local\Temp\739db143a714b168ad4250a12a903a91.exe
"C:\Users\Admin\AppData\Local\Temp\739db143a714b168ad4250a12a903a91.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:808

C:\Users\Admin\AppData\Local\Temp\739db143a714b168ad4250a12a903a91.exe
"C:\Users\Admin\AppData\Local\Temp\739db143a714b168ad4250a12a903a91.exe"
2⤵
PID:3556

C:\Users\Admin\AppData\Local\Temp\739db143a714b168ad4250a12a903a91.exe
"C:\Users\Admin\AppData\Local\Temp\739db143a714b168ad4250a12a903a91.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2312

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/808-114-0x00000000006E0000-0x00000000006E1000-memory.dmp

Filesize
4KB

Download
memory/808-116-0x00000000056A0000-0x00000000056A1000-memory.dmp

Filesize
4KB

Download
memory/808-117-0x00000000051A0000-0x00000000051A1000-memory.dmp

Filesize
4KB

Download
memory/808-118-0x0000000005160000-0x0000000005161000-memory.dmp

Filesize
4KB

Download
memory/808-119-0x00000000050A0000-0x00000000050A1000-memory.dmp

Filesize
4KB

Download
memory/808-120-0x0000000005690000-0x0000000005695000-memory.dmp

Filesize
20KB

Download
memory/808-121-0x0000000007680000-0x0000000007681000-memory.dmp

Filesize
4KB

Download
memory/808-122-0x0000000006E80000-0x0000000006ED0000-memory.dmp

Filesize
320KB

Download
memory/2312-124-0x000000000041F0E0-mapping.dmp

Download
memory/2312-123-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2312-125-0x00000000015C0000-0x00000000018E0000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads