formbook | 83708560ecc442b5b6dadbdf5af39ae4f1e843664c932a9de3eff1e38bf6d4a5

General

Target

e17b528f9c192653dc9777bd46e48d82.exe
Size

521KB
MD5

e17b528f9c192653dc9777bd46e48d82
SHA1

f4dfc93942ed0c091340057f1164b1e1e6f4a148
SHA256

83708560ecc442b5b6dadbdf5af39ae4f1e843664c932a9de3eff1e38bf6d4a5
SHA512

d041efc3a98c8fc690841669f3e9722c43bbee4c6eac7191056b7dff5b8c27d938bf9f7de3409f27239cadf46c70696c12a9c98e86f772339e902b295060ae29

Score

10^/10

formbook s18y rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

s18y

C2

http://www.agentpathleurre.space/s18y/

Decoy

jokes-online.com

dzzdjn.com

lizzieerhardtebnaryepptts.com

interfacehand.xyz

sale-m.site

block-facebook.com

dicasdamadrinha.com

maythewind.com

hasari.net

omnists.com

thevalley-eg.com

rdfj.xyz

szhfcy.com

alkalineage.club

fdf.xyz

absorplus.com

poldolongo.com

badassshirts.club

ferienwohnungenmv.com

bilboondokoak.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3680-124-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/3680-125-0x000000000041F120-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

e17b528f9c192653dc9777bd46e48d82.exe

description pid process target process

PID 352 set thread context of 3680 352 e17b528f9c192653dc9777bd46e48d82.exe e17b528f9c192653dc9777bd46e48d82.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

e17b528f9c192653dc9777bd46e48d82.exe

pid process

3680 e17b528f9c192653dc9777bd46e48d82.exe
3680 e17b528f9c192653dc9777bd46e48d82.exe

description	pid	process	target process
PID 352 set thread context of 3680	352	e17b528f9c192653dc9777bd46e48d82.exe	e17b528f9c192653dc9777bd46e48d82.exe

pid	process
3680	e17b528f9c192653dc9777bd46e48d82.exe
3680	e17b528f9c192653dc9777bd46e48d82.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

e17b528f9c192653dc9777bd46e48d82.exe

description	pid	process	target process
PID 352 wrote to memory of 3680	352	e17b528f9c192653dc9777bd46e48d82.exe	e17b528f9c192653dc9777bd46e48d82.exe
PID 352 wrote to memory of 3680	352	e17b528f9c192653dc9777bd46e48d82.exe	e17b528f9c192653dc9777bd46e48d82.exe
PID 352 wrote to memory of 3680	352	e17b528f9c192653dc9777bd46e48d82.exe	e17b528f9c192653dc9777bd46e48d82.exe
PID 352 wrote to memory of 3680	352	e17b528f9c192653dc9777bd46e48d82.exe	e17b528f9c192653dc9777bd46e48d82.exe
PID 352 wrote to memory of 3680	352	e17b528f9c192653dc9777bd46e48d82.exe	e17b528f9c192653dc9777bd46e48d82.exe
PID 352 wrote to memory of 3680	352	e17b528f9c192653dc9777bd46e48d82.exe	e17b528f9c192653dc9777bd46e48d82.exe

C:\Users\Admin\AppData\Local\Temp\e17b528f9c192653dc9777bd46e48d82.exe
"C:\Users\Admin\AppData\Local\Temp\e17b528f9c192653dc9777bd46e48d82.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:352

C:\Users\Admin\AppData\Local\Temp\e17b528f9c192653dc9777bd46e48d82.exe
"C:\Users\Admin\AppData\Local\Temp\e17b528f9c192653dc9777bd46e48d82.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/352-115-0x0000000000A30000-0x0000000000A31000-memory.dmp

Filesize
4KB

Download
memory/352-117-0x0000000005860000-0x0000000005861000-memory.dmp

Filesize
4KB

Download
memory/352-118-0x0000000005360000-0x0000000005361000-memory.dmp

Filesize
4KB

Download
memory/352-119-0x00000000052E0000-0x00000000052E1000-memory.dmp

Filesize
4KB

Download
memory/352-120-0x0000000005490000-0x0000000005496000-memory.dmp

Filesize
24KB

Download
memory/352-121-0x0000000005360000-0x000000000585E000-memory.dmp

Filesize
5.0MB

Download
memory/352-122-0x0000000006100000-0x0000000006101000-memory.dmp

Filesize
4KB

Download
memory/352-123-0x0000000006060000-0x00000000060B0000-memory.dmp

Filesize
320KB

Download
memory/3680-124-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3680-125-0x000000000041F120-mapping.dmp

Download
memory/3680-126-0x00000000016B0000-0x00000000019D0000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing