formbook | 196666c85a31dedff03cdc9a8e19c323f510f7d1b55301463a21cb969751a700

General

Target

196666c8.exe
Size

394KB
MD5

c0774667c40bc1a34b22fe4afdf3d87c
SHA1

750efb48dea98d15bf740aa357eed6235caa2187
SHA256

196666c85a31dedff03cdc9a8e19c323f510f7d1b55301463a21cb969751a700
SHA512

18687d1dbe2657c5e8237fa71b32f9de2fd4944713e874303312d6194eec3758ccef760c8a86d50aa8966abe20357f86b3ae24fa004da824072a0304eff66829

Score

10^/10

formbook s0vc rat spyware stealer suricata trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

s0vc

C2

http://www.xn--289an7fmsbe2rud327e.com/s0vc/

Decoy

redstonemanagers.com

graffitiparktx.com

aliturk.com

asicsmalaysiasale.com

primetimehandyman.com

logjed068.xyz

rusicedream.com

rickcaronmuseum.com

softwarebuynow.com

buddysbarkery.com

ysm99.com

rtetrgwgre.xyz

97020.xyz

utahblind.site

hiyym.com

rohukager.xyz

vcstudentwork.com

oxfordautomotivepa.com

salibrown.com

tekosocks.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/692-116-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/692-117-0x000000000041F160-mapping.dmp	formbook
behavioral2/memory/3964-124-0x0000000000570000-0x000000000059F000-memory.dmp	formbook

Suspicious use of SetThreadContext 3 IoCs

Processes:

196666c8.exe196666c8.execolorcpl.exe

description	pid	process	target process
PID 3848 set thread context of 692	3848	196666c8.exe	196666c8.exe
PID 692 set thread context of 2580	692	196666c8.exe	Explorer.EXE
PID 3964 set thread context of 2580	3964	colorcpl.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 40 IoCs

Processes:

196666c8.execolorcpl.exe

pid	process
692	196666c8.exe
692	196666c8.exe
692	196666c8.exe
692	196666c8.exe
3964	colorcpl.exe
3964	colorcpl.exe
3964	colorcpl.exe
3964	colorcpl.exe
3964	colorcpl.exe
3964	colorcpl.exe
3964	colorcpl.exe
3964	colorcpl.exe
3964	colorcpl.exe
3964	colorcpl.exe
3964	colorcpl.exe
3964	colorcpl.exe
3964	colorcpl.exe
3964	colorcpl.exe
3964	colorcpl.exe
3964	colorcpl.exe
3964	colorcpl.exe
3964	colorcpl.exe
3964	colorcpl.exe
3964	colorcpl.exe
3964	colorcpl.exe
3964	colorcpl.exe
3964	colorcpl.exe
3964	colorcpl.exe
3964	colorcpl.exe
3964	colorcpl.exe
3964	colorcpl.exe
3964	colorcpl.exe
3964	colorcpl.exe
3964	colorcpl.exe
3964	colorcpl.exe
3964	colorcpl.exe
3964	colorcpl.exe
3964	colorcpl.exe
3964	colorcpl.exe
3964	colorcpl.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

2580 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

196666c8.execolorcpl.exe

pid process

692 196666c8.exe
692 196666c8.exe
692 196666c8.exe
3964 colorcpl.exe
3964 colorcpl.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

196666c8.execolorcpl.exe

description pid process

Token: SeDebugPrivilege 692 196666c8.exe
Token: SeDebugPrivilege 3964 colorcpl.exe

pid	process
2580	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	692	196666c8.exe
Token: SeDebugPrivilege	3964	colorcpl.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

196666c8.exeExplorer.EXEcolorcpl.exe

description	pid	process	target process
PID 3848 wrote to memory of 692	3848	196666c8.exe	196666c8.exe
PID 3848 wrote to memory of 692	3848	196666c8.exe	196666c8.exe
PID 3848 wrote to memory of 692	3848	196666c8.exe	196666c8.exe
PID 3848 wrote to memory of 692	3848	196666c8.exe	196666c8.exe
PID 3848 wrote to memory of 692	3848	196666c8.exe	196666c8.exe
PID 3848 wrote to memory of 692	3848	196666c8.exe	196666c8.exe
PID 2580 wrote to memory of 3964	2580	Explorer.EXE	colorcpl.exe
PID 2580 wrote to memory of 3964	2580	Explorer.EXE	colorcpl.exe
PID 2580 wrote to memory of 3964	2580	Explorer.EXE	colorcpl.exe
PID 3964 wrote to memory of 1132	3964	colorcpl.exe	cmd.exe
PID 3964 wrote to memory of 1132	3964	colorcpl.exe	cmd.exe
PID 3964 wrote to memory of 1132	3964	colorcpl.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2580

C:\Users\Admin\AppData\Local\Temp\196666c8.exe
"C:\Users\Admin\AppData\Local\Temp\196666c8.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3848

C:\Users\Admin\AppData\Local\Temp\196666c8.exe
"C:\Users\Admin\AppData\Local\Temp\196666c8.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:692

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:2072

C:\Windows\SysWOW64\colorcpl.exe
"C:\Windows\SysWOW64\colorcpl.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3964

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\196666c8.exe"
3⤵
PID:1132

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/692-120-0x0000000001C40000-0x0000000001C54000-memory.dmp

Filesize
80KB

Download
memory/692-116-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/692-117-0x000000000041F160-mapping.dmp

Download
memory/692-118-0x00000000017A0000-0x0000000001AC0000-memory.dmp

Filesize
3.1MB

Download
memory/1132-126-0x0000000000000000-mapping.dmp

Download
memory/2580-121-0x0000000005AD0000-0x0000000005BEE000-memory.dmp

Filesize
1.1MB

Download
memory/2580-128-0x0000000002C10000-0x0000000002CB7000-memory.dmp

Filesize
668KB

Download
memory/3848-115-0x0000000002A80000-0x0000000002A81000-memory.dmp

Filesize
4KB

Download
memory/3964-122-0x0000000000000000-mapping.dmp

Download
memory/3964-123-0x00000000010C0000-0x00000000010D9000-memory.dmp

Filesize
100KB

Download
memory/3964-125-0x0000000004680000-0x00000000049A0000-memory.dmp

Filesize
3.1MB

Download
memory/3964-124-0x0000000000570000-0x000000000059F000-memory.dmp

Filesize
188KB

Download
memory/3964-127-0x0000000004580000-0x0000000004613000-memory.dmp

Filesize
588KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads