formbook | 3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea

General

Target

3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe
Size

511KB
MD5

6923309c1cf759930f67710ac9dfd328
SHA1

e74291e311e8466dd7222a2eb3779848385dd3fa
SHA256

3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea
SHA512

993dbcc6063f3a1b293fb3e2c794f1f817a4703d5b21154fc47e02998f72e334cca38b820c6f657a8345775690eed93f2a8f9202b453490735bc89cebf3ecbd5

Score

10^/10

formbook kzk9 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

kzk9

C2

http://www.yourmajordomo.com/kzk9/

Decoy

tianconghuo.club

1996-page.com

ourtownmax.net

conservativetreehose.com

synth.repair

donnachicacreperia.com

tentfull.com

weapp.download

surfersink.com

gattlebusinessservices.com

sebastian249.com

anhphuc.company

betternatureproducts.net

defroplate.com

seattlesquidsquad.com

polarjob.com

lendingadvantage.com

angelsondope.com

goportjitney.com

tiendagrupojagr.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/676-125-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/676-126-0x000000000041EB80-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe

description	pid	process	target process
PID 4016 set thread context of 676	4016	3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe	3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe

pid	process
4016	3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe
4016	3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe
4016	3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe
4016	3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe
4016	3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe
4016	3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe
4016	3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe
4016	3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe
4016	3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe
4016	3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe
4016	3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe
4016	3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe
4016	3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe
676	3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe
676	3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe

description pid process

Token: SeDebugPrivilege 4016 3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe

description	pid	process
Token: SeDebugPrivilege	4016	3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe

C:\Users\Admin\AppData\Local\Temp\3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe
"C:\Users\Admin\AppData\Local\Temp\3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4016

C:\Users\Admin\AppData\Local\Temp\3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe
"C:\Users\Admin\AppData\Local\Temp\3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe"
2⤵
PID:568

C:\Users\Admin\AppData\Local\Temp\3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe
"C:\Users\Admin\AppData\Local\Temp\3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe"
2⤵
PID:640

C:\Users\Admin\AppData\Local\Temp\3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe
"C:\Users\Admin\AppData\Local\Temp\3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe"
2⤵
PID:656

C:\Users\Admin\AppData\Local\Temp\3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe
"C:\Users\Admin\AppData\Local\Temp\3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/676-125-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/676-126-0x000000000041EB80-mapping.dmp

Download
memory/676-127-0x0000000001370000-0x0000000001690000-memory.dmp

Filesize
3.1MB

Download
memory/4016-116-0x0000000000AB0000-0x0000000000AB1000-memory.dmp

Filesize
4KB

Download
memory/4016-118-0x0000000007C70000-0x0000000007C71000-memory.dmp

Filesize
4KB

Download
memory/4016-119-0x0000000007850000-0x0000000007851000-memory.dmp

Filesize
4KB

Download
memory/4016-120-0x0000000007840000-0x0000000007841000-memory.dmp

Filesize
4KB

Download
memory/4016-121-0x0000000007770000-0x0000000007C6E000-memory.dmp

Filesize
5.0MB

Download
memory/4016-122-0x0000000007C50000-0x0000000007C57000-memory.dmp

Filesize
28KB

Download
memory/4016-123-0x0000000008510000-0x0000000008511000-memory.dmp

Filesize
4KB

Download
memory/4016-124-0x0000000008470000-0x00000000084BF000-memory.dmp

Filesize
316KB

Download

description	pid	process	target process
PID 4016 wrote to memory of 568	4016	3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe	3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe
PID 4016 wrote to memory of 568	4016	3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe	3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe
PID 4016 wrote to memory of 568	4016	3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe	3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe
PID 4016 wrote to memory of 640	4016	3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe	3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe
PID 4016 wrote to memory of 640	4016	3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe	3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe
PID 4016 wrote to memory of 640	4016	3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe	3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe
PID 4016 wrote to memory of 656	4016	3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe	3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe
PID 4016 wrote to memory of 656	4016	3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe	3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe
PID 4016 wrote to memory of 656	4016	3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe	3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe
PID 4016 wrote to memory of 676	4016	3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe	3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe
PID 4016 wrote to memory of 676	4016	3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe	3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe
PID 4016 wrote to memory of 676	4016	3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe	3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe
PID 4016 wrote to memory of 676	4016	3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe	3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe
PID 4016 wrote to memory of 676	4016	3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe	3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe
PID 4016 wrote to memory of 676	4016	3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe	3c4aa39e200cb4303a3e5970bbedb5a1bb1baa656c3fc2286f82392a91e4a4ea.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads