formbook | a0cea434baf3e56def0762e975e5c623c47f5ed75edbb6826ee594e260832c31

General

Target

655400c95408ab33a90686b581a100d0.exe
Size

493KB
MD5

655400c95408ab33a90686b581a100d0
SHA1

a4974a824b80db98d20dc11893cd958a937f6078
SHA256

a0cea434baf3e56def0762e975e5c623c47f5ed75edbb6826ee594e260832c31
SHA512

ba2e84679fab21e39381b42aae91cb538de922e5a4770e061c40904028a2347e6b324bd49aba37e846c85b1309da6e4b9c4ee9b4c672ccf4be4ed73c9af6c5d7

Score

10^/10

formbook kzk9 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

kzk9

C2

http://www.yourmajordomo.com/kzk9/

Decoy

tianconghuo.club

1996-page.com

ourtownmax.net

conservativetreehose.com

synth.repair

donnachicacreperia.com

tentfull.com

weapp.download

surfersink.com

gattlebusinessservices.com

sebastian249.com

anhphuc.company

betternatureproducts.net

defroplate.com

seattlesquidsquad.com

polarjob.com

lendingadvantage.com

angelsondope.com

goportjitney.com

tiendagrupojagr.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2012-125-0x000000000041EB80-mapping.dmp	formbook
behavioral2/memory/2012-124-0x0000000000400000-0x000000000042E000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

655400c95408ab33a90686b581a100d0.exe

description pid process target process

PID 2472 set thread context of 2012 2472 655400c95408ab33a90686b581a100d0.exe 655400c95408ab33a90686b581a100d0.exe

description	pid	process	target process
PID 2472 set thread context of 2012	2472	655400c95408ab33a90686b581a100d0.exe	655400c95408ab33a90686b581a100d0.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

655400c95408ab33a90686b581a100d0.exe655400c95408ab33a90686b581a100d0.exe

pid	process
2472	655400c95408ab33a90686b581a100d0.exe
2472	655400c95408ab33a90686b581a100d0.exe
2472	655400c95408ab33a90686b581a100d0.exe
2472	655400c95408ab33a90686b581a100d0.exe
2472	655400c95408ab33a90686b581a100d0.exe
2472	655400c95408ab33a90686b581a100d0.exe
2472	655400c95408ab33a90686b581a100d0.exe
2012	655400c95408ab33a90686b581a100d0.exe
2012	655400c95408ab33a90686b581a100d0.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

655400c95408ab33a90686b581a100d0.exe

description pid process

Token: SeDebugPrivilege 2472 655400c95408ab33a90686b581a100d0.exe

description	pid	process
Token: SeDebugPrivilege	2472	655400c95408ab33a90686b581a100d0.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

655400c95408ab33a90686b581a100d0.exe

description	pid	process	target process
PID 2472 wrote to memory of 2012	2472	655400c95408ab33a90686b581a100d0.exe	655400c95408ab33a90686b581a100d0.exe
PID 2472 wrote to memory of 2012	2472	655400c95408ab33a90686b581a100d0.exe	655400c95408ab33a90686b581a100d0.exe
PID 2472 wrote to memory of 2012	2472	655400c95408ab33a90686b581a100d0.exe	655400c95408ab33a90686b581a100d0.exe
PID 2472 wrote to memory of 2012	2472	655400c95408ab33a90686b581a100d0.exe	655400c95408ab33a90686b581a100d0.exe
PID 2472 wrote to memory of 2012	2472	655400c95408ab33a90686b581a100d0.exe	655400c95408ab33a90686b581a100d0.exe
PID 2472 wrote to memory of 2012	2472	655400c95408ab33a90686b581a100d0.exe	655400c95408ab33a90686b581a100d0.exe

C:\Users\Admin\AppData\Local\Temp\655400c95408ab33a90686b581a100d0.exe
"C:\Users\Admin\AppData\Local\Temp\655400c95408ab33a90686b581a100d0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2472

C:\Users\Admin\AppData\Local\Temp\655400c95408ab33a90686b581a100d0.exe
"C:\Users\Admin\AppData\Local\Temp\655400c95408ab33a90686b581a100d0.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2012-125-0x000000000041EB80-mapping.dmp

Download
memory/2012-124-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2012-126-0x00000000016D0000-0x00000000019F0000-memory.dmp

Filesize
3.1MB

Download
memory/2472-115-0x0000000000B70000-0x0000000000B71000-memory.dmp

Filesize
4KB

Download
memory/2472-117-0x0000000007DE0000-0x0000000007DE1000-memory.dmp

Filesize
4KB

Download
memory/2472-118-0x0000000007980000-0x0000000007981000-memory.dmp

Filesize
4KB

Download
memory/2472-119-0x00000000078E0000-0x0000000007DDE000-memory.dmp

Filesize
5.0MB

Download
memory/2472-120-0x0000000007910000-0x0000000007911000-memory.dmp

Filesize
4KB

Download
memory/2472-121-0x0000000007D00000-0x0000000007D08000-memory.dmp

Filesize
32KB

Download
memory/2472-122-0x000000000D870000-0x000000000D871000-memory.dmp

Filesize
4KB

Download
memory/2472-123-0x000000000D820000-0x000000000D86F000-memory.dmp

Filesize
316KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads