formbook | cce2edbec8676315b05ba2e2dda2feb9190edb5f217b9824ae58b40a770924fe

General

Target

yryclCpe3QldozN.exe
Size

513KB
MD5

28e0a297c93023d0ad2d296b214598b5
SHA1

ef10cbec56dc28cba963887050738501419306e6
SHA256

cce2edbec8676315b05ba2e2dda2feb9190edb5f217b9824ae58b40a770924fe
SHA512

f5f78b83a50a90d4f35208522c7baf30685dd755ecdc78c9245ca7d94643b85797b4041282dd9655a0cc4bc8032211203b1c452999c3ab0ab74b06751211b1c5

Score

10^/10

formbook d7ln rat spyware stealer suricata trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

d7ln

C2

http://www.mottpolis.com/d7ln/

Decoy

bulut-imza.com

gotastebuds.com

shutupmags.com

clocksport.com

toweryachtcounsel.com

kingcopier.com

pluspersona.com

inchallahe.com

unclonedconsulting.com

ccdt168.com

tonyzheng.xyz

voiceoftheepeople.com

cicapital.xyz

offxpro.com

loyatiproductions.com

makemebuystuff.com

incuba8labs.com

remparka.com

newstft.com

bgame.pro

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Formbook Payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/876-61-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/876-62-0x000000000041F0D0-mapping.dmp	formbook
behavioral1/memory/876-67-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/980-74-0x0000000000090000-0x00000000000BF000-memory.dmp	formbook

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1412 cmd.exe

pid	process
1412	cmd.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

yryclCpe3QldozN.exeyryclCpe3QldozN.exemsiexec.exe

description	pid	process	target process
PID 1144 set thread context of 876	1144	yryclCpe3QldozN.exe	yryclCpe3QldozN.exe
PID 876 set thread context of 1392	876	yryclCpe3QldozN.exe	Explorer.EXE
PID 876 set thread context of 1392	876	yryclCpe3QldozN.exe	Explorer.EXE
PID 980 set thread context of 1392	980	msiexec.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 23 IoCs

Processes:

yryclCpe3QldozN.exemsiexec.exe

pid	process
876	yryclCpe3QldozN.exe
876	yryclCpe3QldozN.exe
876	yryclCpe3QldozN.exe
980	msiexec.exe
980	msiexec.exe
980	msiexec.exe
980	msiexec.exe
980	msiexec.exe
980	msiexec.exe
980	msiexec.exe
980	msiexec.exe
980	msiexec.exe
980	msiexec.exe
980	msiexec.exe
980	msiexec.exe
980	msiexec.exe
980	msiexec.exe
980	msiexec.exe
980	msiexec.exe
980	msiexec.exe
980	msiexec.exe
980	msiexec.exe
980	msiexec.exe

Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

yryclCpe3QldozN.exemsiexec.exe

pid process

876 yryclCpe3QldozN.exe
876 yryclCpe3QldozN.exe
876 yryclCpe3QldozN.exe
876 yryclCpe3QldozN.exe
980 msiexec.exe
980 msiexec.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

yryclCpe3QldozN.exemsiexec.exe

description pid process

Token: SeDebugPrivilege 876 yryclCpe3QldozN.exe
Token: SeDebugPrivilege 980 msiexec.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1392 Explorer.EXE
1392 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1392 Explorer.EXE
1392 Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	876	yryclCpe3QldozN.exe
Token: SeDebugPrivilege	980	msiexec.exe

pid	process
1392	Explorer.EXE
1392	Explorer.EXE

pid	process
1392	Explorer.EXE
1392	Explorer.EXE

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

yryclCpe3QldozN.exeExplorer.EXEmsiexec.exe

description	pid	process	target process
PID 1144 wrote to memory of 876	1144	yryclCpe3QldozN.exe	yryclCpe3QldozN.exe
PID 1144 wrote to memory of 876	1144	yryclCpe3QldozN.exe	yryclCpe3QldozN.exe
PID 1144 wrote to memory of 876	1144	yryclCpe3QldozN.exe	yryclCpe3QldozN.exe
PID 1144 wrote to memory of 876	1144	yryclCpe3QldozN.exe	yryclCpe3QldozN.exe
PID 1144 wrote to memory of 876	1144	yryclCpe3QldozN.exe	yryclCpe3QldozN.exe
PID 1144 wrote to memory of 876	1144	yryclCpe3QldozN.exe	yryclCpe3QldozN.exe
PID 1144 wrote to memory of 876	1144	yryclCpe3QldozN.exe	yryclCpe3QldozN.exe
PID 1392 wrote to memory of 980	1392	Explorer.EXE	msiexec.exe
PID 1392 wrote to memory of 980	1392	Explorer.EXE	msiexec.exe
PID 1392 wrote to memory of 980	1392	Explorer.EXE	msiexec.exe
PID 1392 wrote to memory of 980	1392	Explorer.EXE	msiexec.exe
PID 1392 wrote to memory of 980	1392	Explorer.EXE	msiexec.exe
PID 1392 wrote to memory of 980	1392	Explorer.EXE	msiexec.exe
PID 1392 wrote to memory of 980	1392	Explorer.EXE	msiexec.exe
PID 980 wrote to memory of 1412	980	msiexec.exe	cmd.exe
PID 980 wrote to memory of 1412	980	msiexec.exe	cmd.exe
PID 980 wrote to memory of 1412	980	msiexec.exe	cmd.exe
PID 980 wrote to memory of 1412	980	msiexec.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1392

C:\Users\Admin\AppData\Local\Temp\yryclCpe3QldozN.exe
"C:\Users\Admin\AppData\Local\Temp\yryclCpe3QldozN.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1144

C:\Users\Admin\AppData\Local\Temp\yryclCpe3QldozN.exe
"C:\Users\Admin\AppData\Local\Temp\yryclCpe3QldozN.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:876

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\SysWOW64\msiexec.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:980

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\yryclCpe3QldozN.exe"
3⤵
- Deletes itself
PID:1412

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/876-65-0x0000000000140000-0x0000000000154000-memory.dmp

Filesize
80KB

Download
memory/876-68-0x00000000001D0000-0x00000000001E4000-memory.dmp

Filesize
80KB

Download
memory/876-59-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/876-60-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/876-61-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/876-67-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/876-63-0x0000000000950000-0x0000000000C53000-memory.dmp

Filesize
3.0MB

Download
memory/876-62-0x000000000041F0D0-mapping.dmp

Download
memory/980-76-0x0000000001F90000-0x0000000002023000-memory.dmp

Filesize
588KB

Download
memory/980-74-0x0000000000090000-0x00000000000BF000-memory.dmp

Filesize
188KB

Download
memory/980-75-0x00000000022B0000-0x00000000025B3000-memory.dmp

Filesize
3.0MB

Download
memory/980-73-0x0000000000910000-0x0000000000924000-memory.dmp

Filesize
80KB

Download
memory/980-70-0x0000000000000000-mapping.dmp

Download
memory/1144-56-0x0000000000450000-0x0000000000457000-memory.dmp

Filesize
28KB

Download
memory/1144-55-0x0000000076581000-0x0000000076583000-memory.dmp

Filesize
8KB

Download
memory/1144-58-0x0000000000F40000-0x0000000000F90000-memory.dmp

Filesize
320KB

Download
memory/1144-57-0x0000000004ED0000-0x0000000004ED1000-memory.dmp

Filesize
4KB

Download
memory/1144-53-0x00000000013E0000-0x00000000013E1000-memory.dmp

Filesize
4KB

Download
memory/1392-69-0x0000000004B50000-0x0000000004C0D000-memory.dmp

Filesize
756KB

Download
memory/1392-77-0x0000000007B40000-0x0000000007C2F000-memory.dmp

Filesize
956KB

Download
memory/1392-66-0x0000000006BB0000-0x0000000006CF2000-memory.dmp

Filesize
1.3MB

Download
memory/1412-72-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads