formbook | dbd051d77f3b2c3945fa86e4960706e93892003d7d34c0939b938ae7c0d608a8

General

Target

dbd051d77f3b2c3945fa86e4960706e93892003d7d34c0939b938ae7c0d608a8.exe
Size

515KB
MD5

53fc9ba711f3d6c8e4863c4680074c62
SHA1

6de09d2dd61fd30bd64be0625ba01be710d4e852
SHA256

dbd051d77f3b2c3945fa86e4960706e93892003d7d34c0939b938ae7c0d608a8
SHA512

e8ed9a27919e55d6aec09c608835a00dd01a8e696ad63e9b9460658b78d9c7031de98506b5d82d5476c8fb4833149a66435c3702991949885849ea1f4f544d8b

Score

10^/10

formbook jy0b rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

jy0b

C2

http://www.filecrev.com/jy0b/

Decoy

lamejorimagen.com

mykabukibrush.com

modgon.com

barefoottherapeutics.com

shimpeg.net

trade-sniper.com

chiangkhancityhotel.com

joblessmoni.club

stespritsubways.com

chico-group.com

nni8.xyz

searchtypically.online

jobsyork.com

bestsales-crypto.com

iqmarketing.info

bullcityphotobooths.com

fwssc.icu

1oc87s.icu

usdiesel.xyz

secrets2optimumnutrition.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/4456-124-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/4456-125-0x000000000041F150-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

dbd051d77f3b2c3945fa86e4960706e93892003d7d34c0939b938ae7c0d608a8.exe

description	pid	process	target process
PID 592 set thread context of 4456	592	dbd051d77f3b2c3945fa86e4960706e93892003d7d34c0939b938ae7c0d608a8.exe	dbd051d77f3b2c3945fa86e4960706e93892003d7d34c0939b938ae7c0d608a8.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

dbd051d77f3b2c3945fa86e4960706e93892003d7d34c0939b938ae7c0d608a8.exe

pid	process
4456	dbd051d77f3b2c3945fa86e4960706e93892003d7d34c0939b938ae7c0d608a8.exe
4456	dbd051d77f3b2c3945fa86e4960706e93892003d7d34c0939b938ae7c0d608a8.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

dbd051d77f3b2c3945fa86e4960706e93892003d7d34c0939b938ae7c0d608a8.exe

description	pid	process	target process
PID 592 wrote to memory of 4456	592	dbd051d77f3b2c3945fa86e4960706e93892003d7d34c0939b938ae7c0d608a8.exe	dbd051d77f3b2c3945fa86e4960706e93892003d7d34c0939b938ae7c0d608a8.exe
PID 592 wrote to memory of 4456	592	dbd051d77f3b2c3945fa86e4960706e93892003d7d34c0939b938ae7c0d608a8.exe	dbd051d77f3b2c3945fa86e4960706e93892003d7d34c0939b938ae7c0d608a8.exe
PID 592 wrote to memory of 4456	592	dbd051d77f3b2c3945fa86e4960706e93892003d7d34c0939b938ae7c0d608a8.exe	dbd051d77f3b2c3945fa86e4960706e93892003d7d34c0939b938ae7c0d608a8.exe
PID 592 wrote to memory of 4456	592	dbd051d77f3b2c3945fa86e4960706e93892003d7d34c0939b938ae7c0d608a8.exe	dbd051d77f3b2c3945fa86e4960706e93892003d7d34c0939b938ae7c0d608a8.exe
PID 592 wrote to memory of 4456	592	dbd051d77f3b2c3945fa86e4960706e93892003d7d34c0939b938ae7c0d608a8.exe	dbd051d77f3b2c3945fa86e4960706e93892003d7d34c0939b938ae7c0d608a8.exe
PID 592 wrote to memory of 4456	592	dbd051d77f3b2c3945fa86e4960706e93892003d7d34c0939b938ae7c0d608a8.exe	dbd051d77f3b2c3945fa86e4960706e93892003d7d34c0939b938ae7c0d608a8.exe

C:\Users\Admin\AppData\Local\Temp\dbd051d77f3b2c3945fa86e4960706e93892003d7d34c0939b938ae7c0d608a8.exe
"C:\Users\Admin\AppData\Local\Temp\dbd051d77f3b2c3945fa86e4960706e93892003d7d34c0939b938ae7c0d608a8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:592

C:\Users\Admin\AppData\Local\Temp\dbd051d77f3b2c3945fa86e4960706e93892003d7d34c0939b938ae7c0d608a8.exe
"C:\Users\Admin\AppData\Local\Temp\dbd051d77f3b2c3945fa86e4960706e93892003d7d34c0939b938ae7c0d608a8.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4456

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/592-115-0x0000000000DE0000-0x0000000000DE1000-memory.dmp

Filesize
4KB

Download
memory/592-117-0x0000000005BA0000-0x0000000005BA1000-memory.dmp

Filesize
4KB

Download
memory/592-118-0x00000000056A0000-0x00000000056A1000-memory.dmp

Filesize
4KB

Download
memory/592-119-0x0000000005820000-0x0000000005821000-memory.dmp

Filesize
4KB

Download
memory/592-120-0x00000000056A0000-0x0000000005B9E000-memory.dmp

Filesize
5.0MB

Download
memory/592-121-0x0000000006490000-0x0000000006497000-memory.dmp

Filesize
28KB

Download
memory/592-122-0x00000000093C0000-0x00000000093C1000-memory.dmp

Filesize
4KB

Download
memory/592-123-0x0000000009460000-0x00000000094B0000-memory.dmp

Filesize
320KB

Download
memory/4456-124-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4456-125-0x000000000041F150-mapping.dmp

Download
memory/4456-126-0x0000000001A50000-0x0000000001D70000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads