formbook | a2dd12adec362ce7457da7795a1b0505dc2c88ab322a1c59637e8196528739f0

General

Target

1b409f19f166463379e0211aced1af99.exe
Size

348KB
MD5

1b409f19f166463379e0211aced1af99
SHA1

d15127da7d1de660a66e9062c81131d9c3fd9d4b
SHA256

a2dd12adec362ce7457da7795a1b0505dc2c88ab322a1c59637e8196528739f0
SHA512

8d7f1b7814daae7e77334524a6ecfc12c401b94a62e10fbddb5928af87af83d37885ece12b5d95228ad5314209c201348a1b44d5dadd6661fae5e4a050786e65

Score

10^/10

formbook jy0b rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

jy0b

C2

http://www.filecrev.com/jy0b/

Decoy

lamejorimagen.com

mykabukibrush.com

modgon.com

barefoottherapeutics.com

shimpeg.net

trade-sniper.com

chiangkhancityhotel.com

joblessmoni.club

stespritsubways.com

chico-group.com

nni8.xyz

searchtypically.online

jobsyork.com

bestsales-crypto.com

iqmarketing.info

bullcityphotobooths.com

fwssc.icu

1oc87s.icu

usdiesel.xyz

secrets2optimumnutrition.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1900-65-0x000000000041F150-mapping.dmp	formbook
behavioral1/memory/1900-64-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

1b409f19f166463379e0211aced1af99.exe

description pid process target process

PID 2024 set thread context of 1900 2024 1b409f19f166463379e0211aced1af99.exe 1b409f19f166463379e0211aced1af99.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

1b409f19f166463379e0211aced1af99.exe

pid process

1900 1b409f19f166463379e0211aced1af99.exe

description	pid	process	target process
PID 2024 set thread context of 1900	2024	1b409f19f166463379e0211aced1af99.exe	1b409f19f166463379e0211aced1af99.exe

pid	process
1900	1b409f19f166463379e0211aced1af99.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

1b409f19f166463379e0211aced1af99.exe

description	pid	process	target process
PID 2024 wrote to memory of 1900	2024	1b409f19f166463379e0211aced1af99.exe	1b409f19f166463379e0211aced1af99.exe
PID 2024 wrote to memory of 1900	2024	1b409f19f166463379e0211aced1af99.exe	1b409f19f166463379e0211aced1af99.exe
PID 2024 wrote to memory of 1900	2024	1b409f19f166463379e0211aced1af99.exe	1b409f19f166463379e0211aced1af99.exe
PID 2024 wrote to memory of 1900	2024	1b409f19f166463379e0211aced1af99.exe	1b409f19f166463379e0211aced1af99.exe
PID 2024 wrote to memory of 1900	2024	1b409f19f166463379e0211aced1af99.exe	1b409f19f166463379e0211aced1af99.exe
PID 2024 wrote to memory of 1900	2024	1b409f19f166463379e0211aced1af99.exe	1b409f19f166463379e0211aced1af99.exe
PID 2024 wrote to memory of 1900	2024	1b409f19f166463379e0211aced1af99.exe	1b409f19f166463379e0211aced1af99.exe

C:\Users\Admin\AppData\Local\Temp\1b409f19f166463379e0211aced1af99.exe
"C:\Users\Admin\AppData\Local\Temp\1b409f19f166463379e0211aced1af99.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2024

C:\Users\Admin\AppData\Local\Temp\1b409f19f166463379e0211aced1af99.exe
"C:\Users\Admin\AppData\Local\Temp\1b409f19f166463379e0211aced1af99.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1900

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1900-62-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1900-63-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1900-65-0x000000000041F150-mapping.dmp

Download
memory/1900-64-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1900-66-0x0000000000A70000-0x0000000000D73000-memory.dmp

Filesize
3.0MB

Download
memory/2024-55-0x0000000000A10000-0x0000000000A11000-memory.dmp

Filesize
4KB

Download
memory/2024-57-0x0000000075D41000-0x0000000075D43000-memory.dmp

Filesize
8KB

Download
memory/2024-58-0x0000000004650000-0x0000000004651000-memory.dmp

Filesize
4KB

Download
memory/2024-59-0x00000000004C0000-0x00000000004C7000-memory.dmp

Filesize
28KB

Download
memory/2024-60-0x000000007EF40000-0x000000007EF41000-memory.dmp

Filesize
4KB

Download
memory/2024-61-0x00000000048A0000-0x00000000048F0000-memory.dmp

Filesize
320KB

Download

Analysis

Sharing