Behavioral Report

General

Target

d9db7f117e5fc750e78b0178003bca82684a2a36f951fa0d3a59a58bd178a302.exe
Size

697KB
MD5

f94dd54fedbdf4f0f6992c781476e4a4
SHA1

93fb57ab3c31b5fa13827670a003ea203ff904d5
SHA256

d9db7f117e5fc750e78b0178003bca82684a2a36f951fa0d3a59a58bd178a302
SHA512

fadf4a955ef4d3d0162c66ac896046177d86b2e9f401e5c02be2b181755827629e617584b853f5f4aa5393391834700ad103cc755e71482b0c3a4b40f7f65ace

Score

10^/10

formbook kzk9 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

kzk9

C2

http://www.yourmajordomo.com/kzk9/

Decoy

tianconghuo.club

1996-page.com

ourtownmax.net

conservativetreehose.com

synth.repair

donnachicacreperia.com

tentfull.com

weapp.download

surfersink.com

gattlebusinessservices.com

sebastian249.com

anhphuc.company

betternatureproducts.net

defroplate.com

seattlesquidsquad.com

polarjob.com

lendingadvantage.com

angelsondope.com

goportjitney.com

tiendagrupojagr.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/3796-124-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/3796-125-0x000000000041EB80-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

d9db7f117e5fc750e78b0178003bca82684a2a36f951fa0d3a59a58bd178a302.exe

description	pid	process	target process
PID 2744 set thread context of 3796	2744	d9db7f117e5fc750e78b0178003bca82684a2a36f951fa0d3a59a58bd178a302.exe	d9db7f117e5fc750e78b0178003bca82684a2a36f951fa0d3a59a58bd178a302.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

d9db7f117e5fc750e78b0178003bca82684a2a36f951fa0d3a59a58bd178a302.exed9db7f117e5fc750e78b0178003bca82684a2a36f951fa0d3a59a58bd178a302.exe

pid	process
2744	d9db7f117e5fc750e78b0178003bca82684a2a36f951fa0d3a59a58bd178a302.exe
2744	d9db7f117e5fc750e78b0178003bca82684a2a36f951fa0d3a59a58bd178a302.exe
2744	d9db7f117e5fc750e78b0178003bca82684a2a36f951fa0d3a59a58bd178a302.exe
2744	d9db7f117e5fc750e78b0178003bca82684a2a36f951fa0d3a59a58bd178a302.exe
2744	d9db7f117e5fc750e78b0178003bca82684a2a36f951fa0d3a59a58bd178a302.exe
2744	d9db7f117e5fc750e78b0178003bca82684a2a36f951fa0d3a59a58bd178a302.exe
3796	d9db7f117e5fc750e78b0178003bca82684a2a36f951fa0d3a59a58bd178a302.exe
3796	d9db7f117e5fc750e78b0178003bca82684a2a36f951fa0d3a59a58bd178a302.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

d9db7f117e5fc750e78b0178003bca82684a2a36f951fa0d3a59a58bd178a302.exe

description pid process

Token: SeDebugPrivilege 2744 d9db7f117e5fc750e78b0178003bca82684a2a36f951fa0d3a59a58bd178a302.exe

description	pid	process
Token: SeDebugPrivilege	2744	d9db7f117e5fc750e78b0178003bca82684a2a36f951fa0d3a59a58bd178a302.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

d9db7f117e5fc750e78b0178003bca82684a2a36f951fa0d3a59a58bd178a302.exe

description	pid	process	target process
PID 2744 wrote to memory of 3796	2744	d9db7f117e5fc750e78b0178003bca82684a2a36f951fa0d3a59a58bd178a302.exe	d9db7f117e5fc750e78b0178003bca82684a2a36f951fa0d3a59a58bd178a302.exe
PID 2744 wrote to memory of 3796	2744	d9db7f117e5fc750e78b0178003bca82684a2a36f951fa0d3a59a58bd178a302.exe	d9db7f117e5fc750e78b0178003bca82684a2a36f951fa0d3a59a58bd178a302.exe
PID 2744 wrote to memory of 3796	2744	d9db7f117e5fc750e78b0178003bca82684a2a36f951fa0d3a59a58bd178a302.exe	d9db7f117e5fc750e78b0178003bca82684a2a36f951fa0d3a59a58bd178a302.exe
PID 2744 wrote to memory of 3796	2744	d9db7f117e5fc750e78b0178003bca82684a2a36f951fa0d3a59a58bd178a302.exe	d9db7f117e5fc750e78b0178003bca82684a2a36f951fa0d3a59a58bd178a302.exe
PID 2744 wrote to memory of 3796	2744	d9db7f117e5fc750e78b0178003bca82684a2a36f951fa0d3a59a58bd178a302.exe	d9db7f117e5fc750e78b0178003bca82684a2a36f951fa0d3a59a58bd178a302.exe
PID 2744 wrote to memory of 3796	2744	d9db7f117e5fc750e78b0178003bca82684a2a36f951fa0d3a59a58bd178a302.exe	d9db7f117e5fc750e78b0178003bca82684a2a36f951fa0d3a59a58bd178a302.exe

C:\Users\Admin\AppData\Local\Temp\d9db7f117e5fc750e78b0178003bca82684a2a36f951fa0d3a59a58bd178a302.exe

"C:\Users\Admin\AppData\Local\Temp\d9db7f117e5fc750e78b0178003bca82684a2a36f951fa0d3a59a58bd178a302.exe"

Suspicious use of SetThreadContext
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory

PID:2744

C:\Users\Admin\AppData\Local\Temp\d9db7f117e5fc750e78b0178003bca82684a2a36f951fa0d3a59a58bd178a302.exe

"C:\Users\Admin\AppData\Local\Temp\d9db7f117e5fc750e78b0178003bca82684a2a36f951fa0d3a59a58bd178a302.exe"

Suspicious behavior: EnumeratesProcesses

PID:3796

Network

MITRE ATT&CK Matrix

Replay Monitor

00:00 00:00

Downloads

memory/2744-115-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

Filesize
4KB

Download
memory/2744-117-0x0000000007EF0000-0x0000000007EF1000-memory.dmp

Filesize
4KB

Download
memory/2744-118-0x0000000007AD0000-0x0000000007AD1000-memory.dmp

Filesize
4KB

Download
memory/2744-119-0x00000000079F0000-0x0000000007EEE000-memory.dmp

Filesize
4MB

Download
memory/2744-120-0x0000000007A60000-0x0000000007A61000-memory.dmp

Filesize
4KB

Download
memory/2744-121-0x0000000007D60000-0x0000000007D67000-memory.dmp

Filesize
28KB

Download
memory/2744-122-0x000000000A2F0000-0x000000000A2F1000-memory.dmp

Filesize
4KB

Download
memory/2744-123-0x0000000008D80000-0x0000000008DCF000-memory.dmp

Filesize
316KB

Download
memory/3796-124-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3796-125-0x000000000041EB80-mapping.dmp

Download
memory/3796-126-0x0000000001A10000-0x0000000001D30000-memory.dmp

Filesize
3MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Downloads