formbook | 0366673a2a85919a9419b85f9f552a2c9713edda8319dc9046f271ee024816ad

General

Target

0366673a2a85919a9419b85f9f552a2c9713edda8319dc9046f271ee024816ad.exe
Size

702KB
MD5

ba67c997b2e0d90d44e889e3629300c9
SHA1

0a5b49e3176fa0e2f4623426f6d3d47757a0f742
SHA256

0366673a2a85919a9419b85f9f552a2c9713edda8319dc9046f271ee024816ad
SHA512

380f2f464532c2b98eac89a52c210b00ab4a17af0e27501d8ebf49fbc6dab189f1a6b7f61319137584056e69646c5bdaffce73218d13109a59b79bbc07806676

Score

10^/10

formbook kzk9 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

kzk9

C2

http://www.yourmajordomo.com/kzk9/

Decoy

tianconghuo.club

1996-page.com

ourtownmax.net

conservativetreehose.com

synth.repair

donnachicacreperia.com

tentfull.com

weapp.download

surfersink.com

gattlebusinessservices.com

sebastian249.com

anhphuc.company

betternatureproducts.net

defroplate.com

seattlesquidsquad.com

polarjob.com

lendingadvantage.com

angelsondope.com

goportjitney.com

tiendagrupojagr.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/3608-127-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/3608-128-0x000000000041EB80-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

0366673a2a85919a9419b85f9f552a2c9713edda8319dc9046f271ee024816ad.exe

description	pid	process	target process
PID 3464 set thread context of 3608	3464	0366673a2a85919a9419b85f9f552a2c9713edda8319dc9046f271ee024816ad.exe	0366673a2a85919a9419b85f9f552a2c9713edda8319dc9046f271ee024816ad.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

0366673a2a85919a9419b85f9f552a2c9713edda8319dc9046f271ee024816ad.exe0366673a2a85919a9419b85f9f552a2c9713edda8319dc9046f271ee024816ad.exe

pid	process
3464	0366673a2a85919a9419b85f9f552a2c9713edda8319dc9046f271ee024816ad.exe
3464	0366673a2a85919a9419b85f9f552a2c9713edda8319dc9046f271ee024816ad.exe
3464	0366673a2a85919a9419b85f9f552a2c9713edda8319dc9046f271ee024816ad.exe
3464	0366673a2a85919a9419b85f9f552a2c9713edda8319dc9046f271ee024816ad.exe
3464	0366673a2a85919a9419b85f9f552a2c9713edda8319dc9046f271ee024816ad.exe
3464	0366673a2a85919a9419b85f9f552a2c9713edda8319dc9046f271ee024816ad.exe
3608	0366673a2a85919a9419b85f9f552a2c9713edda8319dc9046f271ee024816ad.exe
3608	0366673a2a85919a9419b85f9f552a2c9713edda8319dc9046f271ee024816ad.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0366673a2a85919a9419b85f9f552a2c9713edda8319dc9046f271ee024816ad.exe

description pid process

Token: SeDebugPrivilege 3464 0366673a2a85919a9419b85f9f552a2c9713edda8319dc9046f271ee024816ad.exe

description	pid	process
Token: SeDebugPrivilege	3464	0366673a2a85919a9419b85f9f552a2c9713edda8319dc9046f271ee024816ad.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

0366673a2a85919a9419b85f9f552a2c9713edda8319dc9046f271ee024816ad.exe

description	pid	process	target process
PID 3464 wrote to memory of 3608	3464	0366673a2a85919a9419b85f9f552a2c9713edda8319dc9046f271ee024816ad.exe	0366673a2a85919a9419b85f9f552a2c9713edda8319dc9046f271ee024816ad.exe
PID 3464 wrote to memory of 3608	3464	0366673a2a85919a9419b85f9f552a2c9713edda8319dc9046f271ee024816ad.exe	0366673a2a85919a9419b85f9f552a2c9713edda8319dc9046f271ee024816ad.exe
PID 3464 wrote to memory of 3608	3464	0366673a2a85919a9419b85f9f552a2c9713edda8319dc9046f271ee024816ad.exe	0366673a2a85919a9419b85f9f552a2c9713edda8319dc9046f271ee024816ad.exe
PID 3464 wrote to memory of 3608	3464	0366673a2a85919a9419b85f9f552a2c9713edda8319dc9046f271ee024816ad.exe	0366673a2a85919a9419b85f9f552a2c9713edda8319dc9046f271ee024816ad.exe
PID 3464 wrote to memory of 3608	3464	0366673a2a85919a9419b85f9f552a2c9713edda8319dc9046f271ee024816ad.exe	0366673a2a85919a9419b85f9f552a2c9713edda8319dc9046f271ee024816ad.exe
PID 3464 wrote to memory of 3608	3464	0366673a2a85919a9419b85f9f552a2c9713edda8319dc9046f271ee024816ad.exe	0366673a2a85919a9419b85f9f552a2c9713edda8319dc9046f271ee024816ad.exe

C:\Users\Admin\AppData\Local\Temp\0366673a2a85919a9419b85f9f552a2c9713edda8319dc9046f271ee024816ad.exe
"C:\Users\Admin\AppData\Local\Temp\0366673a2a85919a9419b85f9f552a2c9713edda8319dc9046f271ee024816ad.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3464

C:\Users\Admin\AppData\Local\Temp\0366673a2a85919a9419b85f9f552a2c9713edda8319dc9046f271ee024816ad.exe
"C:\Users\Admin\AppData\Local\Temp\0366673a2a85919a9419b85f9f552a2c9713edda8319dc9046f271ee024816ad.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3608

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3464-118-0x0000000000710000-0x0000000000711000-memory.dmp

Filesize
4KB

Download
memory/3464-120-0x00000000079C0000-0x00000000079C1000-memory.dmp

Filesize
4KB

Download
memory/3464-121-0x0000000007560000-0x0000000007561000-memory.dmp

Filesize
4KB

Download
memory/3464-122-0x0000000005010000-0x0000000005011000-memory.dmp

Filesize
4KB

Download
memory/3464-123-0x00000000074E0000-0x00000000074E1000-memory.dmp

Filesize
4KB

Download
memory/3464-124-0x0000000008950000-0x0000000008957000-memory.dmp

Filesize
28KB

Download
memory/3464-125-0x0000000008280000-0x0000000008281000-memory.dmp

Filesize
4KB

Download
memory/3464-126-0x0000000008320000-0x000000000836F000-memory.dmp

Filesize
316KB

Download
memory/3608-127-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3608-128-0x000000000041EB80-mapping.dmp

Download
memory/3608-129-0x0000000001890000-0x0000000001BB0000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads