formbook | f13197aff6f530d9883aa1787cd57f4580c4c92bcaa5100f2641924c3e6867a5

General

Target

f13197aff6f530d9883aa1787cd57f4580c4c92bcaa5100f2641924c3e6867a5.exe
Size

503KB
MD5

af594d3a1f091246b196ac370b8b4900
SHA1

e4c5f155d67e41d87e84593d55f9ba45e0ed58ae
SHA256

f13197aff6f530d9883aa1787cd57f4580c4c92bcaa5100f2641924c3e6867a5
SHA512

6d74490cfd7ff7175a0fa19a4d1ea1c9f08291ae33152e69e82f35b56e0079fd00fdd182e895f48239e78ee3436304c6c590706543d934aa0b3da9c79f936a47

Score

10^/10

formbook ed9s rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ed9s

C2

http://www.vaughnmethod.com/ed9s/

Decoy

pocketoptioniraq.com

merabestsolutions.com

atelectronics.site

fuxueshi.net

infinitystay.com

forensicconcept.site

txpmachine.com

masterwhs.xyz

dia-gnwsis.art

fulltiltnodes.com

bigbnbbsc.com

formation-figma.com

bonanacroin.net

medicalmarijuanasatx.com

bagnavy.com

aaegiscares.net

presentationpublicschool.com

bestyousite.site

prescriptionn.com

beyondthenormbouquets.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/4072-126-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/4072-127-0x000000000041F160-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

f13197aff6f530d9883aa1787cd57f4580c4c92bcaa5100f2641924c3e6867a5.exe

description	pid	process	target process
PID 1460 set thread context of 4072	1460	f13197aff6f530d9883aa1787cd57f4580c4c92bcaa5100f2641924c3e6867a5.exe	f13197aff6f530d9883aa1787cd57f4580c4c92bcaa5100f2641924c3e6867a5.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

f13197aff6f530d9883aa1787cd57f4580c4c92bcaa5100f2641924c3e6867a5.exe

pid	process
4072	f13197aff6f530d9883aa1787cd57f4580c4c92bcaa5100f2641924c3e6867a5.exe
4072	f13197aff6f530d9883aa1787cd57f4580c4c92bcaa5100f2641924c3e6867a5.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

f13197aff6f530d9883aa1787cd57f4580c4c92bcaa5100f2641924c3e6867a5.exe

description	pid	process	target process
PID 1460 wrote to memory of 4072	1460	f13197aff6f530d9883aa1787cd57f4580c4c92bcaa5100f2641924c3e6867a5.exe	f13197aff6f530d9883aa1787cd57f4580c4c92bcaa5100f2641924c3e6867a5.exe
PID 1460 wrote to memory of 4072	1460	f13197aff6f530d9883aa1787cd57f4580c4c92bcaa5100f2641924c3e6867a5.exe	f13197aff6f530d9883aa1787cd57f4580c4c92bcaa5100f2641924c3e6867a5.exe
PID 1460 wrote to memory of 4072	1460	f13197aff6f530d9883aa1787cd57f4580c4c92bcaa5100f2641924c3e6867a5.exe	f13197aff6f530d9883aa1787cd57f4580c4c92bcaa5100f2641924c3e6867a5.exe
PID 1460 wrote to memory of 4072	1460	f13197aff6f530d9883aa1787cd57f4580c4c92bcaa5100f2641924c3e6867a5.exe	f13197aff6f530d9883aa1787cd57f4580c4c92bcaa5100f2641924c3e6867a5.exe
PID 1460 wrote to memory of 4072	1460	f13197aff6f530d9883aa1787cd57f4580c4c92bcaa5100f2641924c3e6867a5.exe	f13197aff6f530d9883aa1787cd57f4580c4c92bcaa5100f2641924c3e6867a5.exe
PID 1460 wrote to memory of 4072	1460	f13197aff6f530d9883aa1787cd57f4580c4c92bcaa5100f2641924c3e6867a5.exe	f13197aff6f530d9883aa1787cd57f4580c4c92bcaa5100f2641924c3e6867a5.exe

C:\Users\Admin\AppData\Local\Temp\f13197aff6f530d9883aa1787cd57f4580c4c92bcaa5100f2641924c3e6867a5.exe
"C:\Users\Admin\AppData\Local\Temp\f13197aff6f530d9883aa1787cd57f4580c4c92bcaa5100f2641924c3e6867a5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1460

C:\Users\Admin\AppData\Local\Temp\f13197aff6f530d9883aa1787cd57f4580c4c92bcaa5100f2641924c3e6867a5.exe
"C:\Users\Admin\AppData\Local\Temp\f13197aff6f530d9883aa1787cd57f4580c4c92bcaa5100f2641924c3e6867a5.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4072

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1460-117-0x0000000000A00000-0x0000000000A01000-memory.dmp

Filesize
4KB

Download
memory/1460-119-0x0000000007C50000-0x0000000007C51000-memory.dmp

Filesize
4KB

Download
memory/1460-120-0x00000000077F0000-0x00000000077F1000-memory.dmp

Filesize
4KB

Download
memory/1460-121-0x0000000007790000-0x0000000007791000-memory.dmp

Filesize
4KB

Download
memory/1460-122-0x0000000007750000-0x0000000007C4E000-memory.dmp

Filesize
5.0MB

Download
memory/1460-123-0x0000000008180000-0x0000000008188000-memory.dmp

Filesize
32KB

Download
memory/1460-124-0x000000000D6D0000-0x000000000D6D1000-memory.dmp

Filesize
4KB

Download
memory/1460-125-0x000000000D770000-0x000000000D7C0000-memory.dmp

Filesize
320KB

Download
memory/4072-126-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4072-127-0x000000000041F160-mapping.dmp

Download
memory/4072-128-0x00000000013A0000-0x00000000016C0000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads