formbook | 196666c85a31dedff03cdc9a8e19c323f510f7d1b55301463a21cb969751a700

General

Target

196666c8.exe
Size

394KB
MD5

c0774667c40bc1a34b22fe4afdf3d87c
SHA1

750efb48dea98d15bf740aa357eed6235caa2187
SHA256

196666c85a31dedff03cdc9a8e19c323f510f7d1b55301463a21cb969751a700
SHA512

18687d1dbe2657c5e8237fa71b32f9de2fd4944713e874303312d6194eec3758ccef760c8a86d50aa8966abe20357f86b3ae24fa004da824072a0304eff66829

Score

10^/10

formbook s0vc rat spyware stealer suricata trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

s0vc

C2

http://www.xn--289an7fmsbe2rud327e.com/s0vc/

Decoy

redstonemanagers.com

graffitiparktx.com

aliturk.com

asicsmalaysiasale.com

primetimehandyman.com

logjed068.xyz

rusicedream.com

rickcaronmuseum.com

softwarebuynow.com

buddysbarkery.com

ysm99.com

rtetrgwgre.xyz

97020.xyz

utahblind.site

hiyym.com

rohukager.xyz

vcstudentwork.com

oxfordautomotivepa.com

salibrown.com

tekosocks.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1480-58-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1480-59-0x000000000041F160-mapping.dmp	formbook
behavioral1/memory/668-68-0x0000000000070000-0x000000000009F000-memory.dmp	formbook

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

396 cmd.exe

pid	process
396	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

196666c8.exe196666c8.execscript.exe

description	pid	process	target process
PID 1564 set thread context of 1480	1564	196666c8.exe	196666c8.exe
PID 1480 set thread context of 1264	1480	196666c8.exe	Explorer.EXE
PID 668 set thread context of 1264	668	cscript.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 24 IoCs

Processes:

196666c8.exe196666c8.execscript.exe

pid	process
1564	196666c8.exe
1480	196666c8.exe
1480	196666c8.exe
668	cscript.exe
668	cscript.exe
668	cscript.exe
668	cscript.exe
668	cscript.exe
668	cscript.exe
668	cscript.exe
668	cscript.exe
668	cscript.exe
668	cscript.exe
668	cscript.exe
668	cscript.exe
668	cscript.exe
668	cscript.exe
668	cscript.exe
668	cscript.exe
668	cscript.exe
668	cscript.exe
668	cscript.exe
668	cscript.exe
668	cscript.exe

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

196666c8.execscript.exe

pid process

1480 196666c8.exe
1480 196666c8.exe
1480 196666c8.exe
668 cscript.exe
668 cscript.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

196666c8.exe196666c8.execscript.exe

description pid process

Token: SeDebugPrivilege 1564 196666c8.exe
Token: SeDebugPrivilege 1480 196666c8.exe
Token: SeDebugPrivilege 668 cscript.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1264 Explorer.EXE
1264 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1264 Explorer.EXE
1264 Explorer.EXE

pid	process
1480	196666c8.exe
1480	196666c8.exe
1480	196666c8.exe
668	cscript.exe
668	cscript.exe

description	pid	process
Token: SeDebugPrivilege	1564	196666c8.exe
Token: SeDebugPrivilege	1480	196666c8.exe
Token: SeDebugPrivilege	668	cscript.exe

pid	process
1264	Explorer.EXE
1264	Explorer.EXE

pid	process
1264	Explorer.EXE
1264	Explorer.EXE

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

196666c8.exeExplorer.EXEcscript.exe

description	pid	process	target process
PID 1564 wrote to memory of 1464	1564	196666c8.exe	196666c8.exe
PID 1564 wrote to memory of 1464	1564	196666c8.exe	196666c8.exe
PID 1564 wrote to memory of 1464	1564	196666c8.exe	196666c8.exe
PID 1564 wrote to memory of 1464	1564	196666c8.exe	196666c8.exe
PID 1564 wrote to memory of 1480	1564	196666c8.exe	196666c8.exe
PID 1564 wrote to memory of 1480	1564	196666c8.exe	196666c8.exe
PID 1564 wrote to memory of 1480	1564	196666c8.exe	196666c8.exe
PID 1564 wrote to memory of 1480	1564	196666c8.exe	196666c8.exe
PID 1564 wrote to memory of 1480	1564	196666c8.exe	196666c8.exe
PID 1564 wrote to memory of 1480	1564	196666c8.exe	196666c8.exe
PID 1564 wrote to memory of 1480	1564	196666c8.exe	196666c8.exe
PID 1264 wrote to memory of 668	1264	Explorer.EXE	cscript.exe
PID 1264 wrote to memory of 668	1264	Explorer.EXE	cscript.exe
PID 1264 wrote to memory of 668	1264	Explorer.EXE	cscript.exe
PID 1264 wrote to memory of 668	1264	Explorer.EXE	cscript.exe
PID 668 wrote to memory of 396	668	cscript.exe	cmd.exe
PID 668 wrote to memory of 396	668	cscript.exe	cmd.exe
PID 668 wrote to memory of 396	668	cscript.exe	cmd.exe
PID 668 wrote to memory of 396	668	cscript.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1264

C:\Users\Admin\AppData\Local\Temp\196666c8.exe
"C:\Users\Admin\AppData\Local\Temp\196666c8.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1564

C:\Users\Admin\AppData\Local\Temp\196666c8.exe
"C:\Users\Admin\AppData\Local\Temp\196666c8.exe"
3⤵
PID:1464

C:\Users\Admin\AppData\Local\Temp\196666c8.exe
"C:\Users\Admin\AppData\Local\Temp\196666c8.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1480

C:\Windows\SysWOW64\cscript.exe
"C:\Windows\SysWOW64\cscript.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:668

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\196666c8.exe"
3⤵
- Deletes itself
PID:396

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/396-69-0x0000000000000000-mapping.dmp

Download
memory/668-70-0x0000000000560000-0x00000000005F3000-memory.dmp

Filesize
588KB

Download
memory/668-68-0x0000000000070000-0x000000000009F000-memory.dmp

Filesize
188KB

Download
memory/668-67-0x0000000002130000-0x0000000002433000-memory.dmp

Filesize
3.0MB

Download
memory/668-66-0x00000000004E0000-0x0000000000502000-memory.dmp

Filesize
136KB

Download
memory/668-65-0x0000000000000000-mapping.dmp

Download
memory/1264-64-0x0000000006CE0000-0x0000000006DF7000-memory.dmp

Filesize
1.1MB

Download
memory/1264-71-0x0000000006E00000-0x0000000006F0D000-memory.dmp

Filesize
1.1MB

Download
memory/1480-58-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1480-63-0x0000000000280000-0x0000000000294000-memory.dmp

Filesize
80KB

Download
memory/1480-62-0x0000000000B90000-0x0000000000E93000-memory.dmp

Filesize
3.0MB

Download
memory/1480-59-0x000000000041F160-mapping.dmp

Download
memory/1480-57-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1480-56-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1564-61-0x0000000002111000-0x0000000002112000-memory.dmp

Filesize
4KB

Download
memory/1564-54-0x0000000075821000-0x0000000075823000-memory.dmp

Filesize
8KB

Download
memory/1564-55-0x0000000002110000-0x0000000002111000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads