formbook | 3f8d5d1f035d14a94abe8191fb35dd70961af3590ec61a0e90afdb322cd5e18b

General

Target

3f8d5d1f035d14a94abe8191fb35dd70961af3590ec61a0e90afdb322cd5e18b.exe
Size

393KB
MD5

fdebcac35105439faeecb9658e617a8c
SHA1

2ab30ddc845cf8664fbc96f82263f89fca255cec
SHA256

3f8d5d1f035d14a94abe8191fb35dd70961af3590ec61a0e90afdb322cd5e18b
SHA512

3e6ce3997aed664225be3fc363e4343fc8af70f610ef0502001beb9cd679efa09af94e637556b971f4b929c819e2fb5fb8352a6e7c9c1372034084368a3af123

Score

10^/10

formbook kzk9 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

kzk9

C2

http://www.yourmajordomo.com/kzk9/

Decoy

tianconghuo.club

1996-page.com

ourtownmax.net

conservativetreehose.com

synth.repair

donnachicacreperia.com

tentfull.com

weapp.download

surfersink.com

gattlebusinessservices.com

sebastian249.com

anhphuc.company

betternatureproducts.net

defroplate.com

seattlesquidsquad.com

polarjob.com

lendingadvantage.com

angelsondope.com

goportjitney.com

tiendagrupojagr.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/3416-124-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/3416-125-0x000000000041EB80-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

3f8d5d1f035d14a94abe8191fb35dd70961af3590ec61a0e90afdb322cd5e18b.exe

description	pid	process	target process
PID 2716 set thread context of 3416	2716	3f8d5d1f035d14a94abe8191fb35dd70961af3590ec61a0e90afdb322cd5e18b.exe	3f8d5d1f035d14a94abe8191fb35dd70961af3590ec61a0e90afdb322cd5e18b.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

3f8d5d1f035d14a94abe8191fb35dd70961af3590ec61a0e90afdb322cd5e18b.exe3f8d5d1f035d14a94abe8191fb35dd70961af3590ec61a0e90afdb322cd5e18b.exe

pid	process
2716	3f8d5d1f035d14a94abe8191fb35dd70961af3590ec61a0e90afdb322cd5e18b.exe
2716	3f8d5d1f035d14a94abe8191fb35dd70961af3590ec61a0e90afdb322cd5e18b.exe
2716	3f8d5d1f035d14a94abe8191fb35dd70961af3590ec61a0e90afdb322cd5e18b.exe
2716	3f8d5d1f035d14a94abe8191fb35dd70961af3590ec61a0e90afdb322cd5e18b.exe
2716	3f8d5d1f035d14a94abe8191fb35dd70961af3590ec61a0e90afdb322cd5e18b.exe
2716	3f8d5d1f035d14a94abe8191fb35dd70961af3590ec61a0e90afdb322cd5e18b.exe
2716	3f8d5d1f035d14a94abe8191fb35dd70961af3590ec61a0e90afdb322cd5e18b.exe
3416	3f8d5d1f035d14a94abe8191fb35dd70961af3590ec61a0e90afdb322cd5e18b.exe
3416	3f8d5d1f035d14a94abe8191fb35dd70961af3590ec61a0e90afdb322cd5e18b.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

3f8d5d1f035d14a94abe8191fb35dd70961af3590ec61a0e90afdb322cd5e18b.exe

description pid process

Token: SeDebugPrivilege 2716 3f8d5d1f035d14a94abe8191fb35dd70961af3590ec61a0e90afdb322cd5e18b.exe

description	pid	process
Token: SeDebugPrivilege	2716	3f8d5d1f035d14a94abe8191fb35dd70961af3590ec61a0e90afdb322cd5e18b.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

3f8d5d1f035d14a94abe8191fb35dd70961af3590ec61a0e90afdb322cd5e18b.exe

description	pid	process	target process
PID 2716 wrote to memory of 3416	2716	3f8d5d1f035d14a94abe8191fb35dd70961af3590ec61a0e90afdb322cd5e18b.exe	3f8d5d1f035d14a94abe8191fb35dd70961af3590ec61a0e90afdb322cd5e18b.exe
PID 2716 wrote to memory of 3416	2716	3f8d5d1f035d14a94abe8191fb35dd70961af3590ec61a0e90afdb322cd5e18b.exe	3f8d5d1f035d14a94abe8191fb35dd70961af3590ec61a0e90afdb322cd5e18b.exe
PID 2716 wrote to memory of 3416	2716	3f8d5d1f035d14a94abe8191fb35dd70961af3590ec61a0e90afdb322cd5e18b.exe	3f8d5d1f035d14a94abe8191fb35dd70961af3590ec61a0e90afdb322cd5e18b.exe
PID 2716 wrote to memory of 3416	2716	3f8d5d1f035d14a94abe8191fb35dd70961af3590ec61a0e90afdb322cd5e18b.exe	3f8d5d1f035d14a94abe8191fb35dd70961af3590ec61a0e90afdb322cd5e18b.exe
PID 2716 wrote to memory of 3416	2716	3f8d5d1f035d14a94abe8191fb35dd70961af3590ec61a0e90afdb322cd5e18b.exe	3f8d5d1f035d14a94abe8191fb35dd70961af3590ec61a0e90afdb322cd5e18b.exe
PID 2716 wrote to memory of 3416	2716	3f8d5d1f035d14a94abe8191fb35dd70961af3590ec61a0e90afdb322cd5e18b.exe	3f8d5d1f035d14a94abe8191fb35dd70961af3590ec61a0e90afdb322cd5e18b.exe

C:\Users\Admin\AppData\Local\Temp\3f8d5d1f035d14a94abe8191fb35dd70961af3590ec61a0e90afdb322cd5e18b.exe
"C:\Users\Admin\AppData\Local\Temp\3f8d5d1f035d14a94abe8191fb35dd70961af3590ec61a0e90afdb322cd5e18b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2716

C:\Users\Admin\AppData\Local\Temp\3f8d5d1f035d14a94abe8191fb35dd70961af3590ec61a0e90afdb322cd5e18b.exe
"C:\Users\Admin\AppData\Local\Temp\3f8d5d1f035d14a94abe8191fb35dd70961af3590ec61a0e90afdb322cd5e18b.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3416

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2716-115-0x00000000000E0000-0x00000000000E1000-memory.dmp

Filesize
4KB

Download
memory/2716-117-0x0000000004E80000-0x0000000004E81000-memory.dmp

Filesize
4KB

Download
memory/2716-118-0x0000000004980000-0x0000000004981000-memory.dmp

Filesize
4KB

Download
memory/2716-119-0x0000000004980000-0x0000000004E7E000-memory.dmp

Filesize
5.0MB

Download
memory/2716-120-0x0000000004950000-0x0000000004951000-memory.dmp

Filesize
4KB

Download
memory/2716-121-0x0000000004BE0000-0x0000000004BE6000-memory.dmp

Filesize
24KB

Download
memory/2716-122-0x00000000070C0000-0x00000000070C1000-memory.dmp

Filesize
4KB

Download
memory/2716-123-0x0000000007070000-0x00000000070BF000-memory.dmp

Filesize
316KB

Download
memory/3416-124-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3416-125-0x000000000041EB80-mapping.dmp

Download
memory/3416-126-0x0000000001770000-0x0000000001A90000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads