formbook | ce04d9c3445331248d915104634f5d57dbce0a1f2d58d0a62f67c2c41e9df220

General

Target

ce04d9c3445331248d915104634f5d57dbce0a1f2d58d0a62f67c2c41e9df220.exe
Size

656KB
MD5

d0611b9926adb5f09a557b9c8f1d010c
SHA1

518b4a0eb7b11c0056be7393b5b618df025ad661
SHA256

ce04d9c3445331248d915104634f5d57dbce0a1f2d58d0a62f67c2c41e9df220
SHA512

55696413b7b1621f239cbd34955a2c90635380d9461c4e978c1ae859de669f92cbfbc780970e8bb7f77adf4c72b1476edb0b5748204bca45dc68ca66721c0a8f

Score

10^/10

formbook kzk9 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

kzk9

C2

http://www.yourmajordomo.com/kzk9/

Decoy

tianconghuo.club

1996-page.com

ourtownmax.net

conservativetreehose.com

synth.repair

donnachicacreperia.com

tentfull.com

weapp.download

surfersink.com

gattlebusinessservices.com

sebastian249.com

anhphuc.company

betternatureproducts.net

defroplate.com

seattlesquidsquad.com

polarjob.com

lendingadvantage.com

angelsondope.com

goportjitney.com

tiendagrupojagr.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/4584-116-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/4584-117-0x000000000041EB80-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

ce04d9c3445331248d915104634f5d57dbce0a1f2d58d0a62f67c2c41e9df220.exe

description	pid	process	target process
PID 4372 set thread context of 4584	4372	ce04d9c3445331248d915104634f5d57dbce0a1f2d58d0a62f67c2c41e9df220.exe	ce04d9c3445331248d915104634f5d57dbce0a1f2d58d0a62f67c2c41e9df220.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

ce04d9c3445331248d915104634f5d57dbce0a1f2d58d0a62f67c2c41e9df220.exece04d9c3445331248d915104634f5d57dbce0a1f2d58d0a62f67c2c41e9df220.exe

pid	process
4372	ce04d9c3445331248d915104634f5d57dbce0a1f2d58d0a62f67c2c41e9df220.exe
4372	ce04d9c3445331248d915104634f5d57dbce0a1f2d58d0a62f67c2c41e9df220.exe
4372	ce04d9c3445331248d915104634f5d57dbce0a1f2d58d0a62f67c2c41e9df220.exe
4372	ce04d9c3445331248d915104634f5d57dbce0a1f2d58d0a62f67c2c41e9df220.exe
4372	ce04d9c3445331248d915104634f5d57dbce0a1f2d58d0a62f67c2c41e9df220.exe
4372	ce04d9c3445331248d915104634f5d57dbce0a1f2d58d0a62f67c2c41e9df220.exe
4584	ce04d9c3445331248d915104634f5d57dbce0a1f2d58d0a62f67c2c41e9df220.exe
4584	ce04d9c3445331248d915104634f5d57dbce0a1f2d58d0a62f67c2c41e9df220.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ce04d9c3445331248d915104634f5d57dbce0a1f2d58d0a62f67c2c41e9df220.exe

description pid process

Token: SeDebugPrivilege 4372 ce04d9c3445331248d915104634f5d57dbce0a1f2d58d0a62f67c2c41e9df220.exe

description	pid	process
Token: SeDebugPrivilege	4372	ce04d9c3445331248d915104634f5d57dbce0a1f2d58d0a62f67c2c41e9df220.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

ce04d9c3445331248d915104634f5d57dbce0a1f2d58d0a62f67c2c41e9df220.exe

description	pid	process	target process
PID 4372 wrote to memory of 4584	4372	ce04d9c3445331248d915104634f5d57dbce0a1f2d58d0a62f67c2c41e9df220.exe	ce04d9c3445331248d915104634f5d57dbce0a1f2d58d0a62f67c2c41e9df220.exe
PID 4372 wrote to memory of 4584	4372	ce04d9c3445331248d915104634f5d57dbce0a1f2d58d0a62f67c2c41e9df220.exe	ce04d9c3445331248d915104634f5d57dbce0a1f2d58d0a62f67c2c41e9df220.exe
PID 4372 wrote to memory of 4584	4372	ce04d9c3445331248d915104634f5d57dbce0a1f2d58d0a62f67c2c41e9df220.exe	ce04d9c3445331248d915104634f5d57dbce0a1f2d58d0a62f67c2c41e9df220.exe
PID 4372 wrote to memory of 4584	4372	ce04d9c3445331248d915104634f5d57dbce0a1f2d58d0a62f67c2c41e9df220.exe	ce04d9c3445331248d915104634f5d57dbce0a1f2d58d0a62f67c2c41e9df220.exe
PID 4372 wrote to memory of 4584	4372	ce04d9c3445331248d915104634f5d57dbce0a1f2d58d0a62f67c2c41e9df220.exe	ce04d9c3445331248d915104634f5d57dbce0a1f2d58d0a62f67c2c41e9df220.exe
PID 4372 wrote to memory of 4584	4372	ce04d9c3445331248d915104634f5d57dbce0a1f2d58d0a62f67c2c41e9df220.exe	ce04d9c3445331248d915104634f5d57dbce0a1f2d58d0a62f67c2c41e9df220.exe

C:\Users\Admin\AppData\Local\Temp\ce04d9c3445331248d915104634f5d57dbce0a1f2d58d0a62f67c2c41e9df220.exe
"C:\Users\Admin\AppData\Local\Temp\ce04d9c3445331248d915104634f5d57dbce0a1f2d58d0a62f67c2c41e9df220.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4372

C:\Users\Admin\AppData\Local\Temp\ce04d9c3445331248d915104634f5d57dbce0a1f2d58d0a62f67c2c41e9df220.exe
"C:\Users\Admin\AppData\Local\Temp\ce04d9c3445331248d915104634f5d57dbce0a1f2d58d0a62f67c2c41e9df220.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4584

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4372-115-0x0000000002C10000-0x0000000002C11000-memory.dmp

Filesize
4KB

Download
memory/4584-116-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4584-117-0x000000000041EB80-mapping.dmp

Download
memory/4584-118-0x0000000001A70000-0x0000000001D90000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads