formbook | 3cf411dfe4bd60c8bb4c7e0c77d0418c885e65570c7a5b8458d60cdf06423960

General

Target

3cf411dfe4bd60c8bb4c7e0c77d0418c885e65570c7a5b8458d60cdf06423960.exe
Size

394KB
MD5

b570d7c8836e9828981a3a801d287f1e
SHA1

d1cb9a8d1823ca4785f4cfb1913f6ca3288ee96f
SHA256

3cf411dfe4bd60c8bb4c7e0c77d0418c885e65570c7a5b8458d60cdf06423960
SHA512

2ee9636edf2472b7ccc21718682c6f311da5c57ce18d31b724c6a3683e774c4d2b4ae0b41ab37939de370fb5ff06abf631e4d756c70445a9dfe014fad0f6f0d4

Score

10^/10

formbook mxwf rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

mxwf

C2

http://www.zahnimplantatangebotede.com/mxwf/

Decoy

orders-cialis.info

auctionorbuy.com

meanmugsamore.com

yachtcrewmark.com

sacredkashilifestudio.net

themintyard.com

bragafoods.com

sierp.com

hausofdeme.com

anthonyjames915.com

bajardepesoencasa.com

marciaroyal.com

earringlifter.com

dsdjfhd9ddksa1as.info

bmzproekt.com

employmentbc.com

ptsdtreatment.space

vrchance.com

cnrongding.com

welovelit.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2848-124-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/2848-125-0x000000000041EBA0-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

3cf411dfe4bd60c8bb4c7e0c77d0418c885e65570c7a5b8458d60cdf06423960.exe

description	pid	process	target process
PID 3128 set thread context of 2848	3128	3cf411dfe4bd60c8bb4c7e0c77d0418c885e65570c7a5b8458d60cdf06423960.exe	3cf411dfe4bd60c8bb4c7e0c77d0418c885e65570c7a5b8458d60cdf06423960.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

3cf411dfe4bd60c8bb4c7e0c77d0418c885e65570c7a5b8458d60cdf06423960.exe

pid	process
2848	3cf411dfe4bd60c8bb4c7e0c77d0418c885e65570c7a5b8458d60cdf06423960.exe
2848	3cf411dfe4bd60c8bb4c7e0c77d0418c885e65570c7a5b8458d60cdf06423960.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

3cf411dfe4bd60c8bb4c7e0c77d0418c885e65570c7a5b8458d60cdf06423960.exe

description	pid	process	target process
PID 3128 wrote to memory of 2848	3128	3cf411dfe4bd60c8bb4c7e0c77d0418c885e65570c7a5b8458d60cdf06423960.exe	3cf411dfe4bd60c8bb4c7e0c77d0418c885e65570c7a5b8458d60cdf06423960.exe
PID 3128 wrote to memory of 2848	3128	3cf411dfe4bd60c8bb4c7e0c77d0418c885e65570c7a5b8458d60cdf06423960.exe	3cf411dfe4bd60c8bb4c7e0c77d0418c885e65570c7a5b8458d60cdf06423960.exe
PID 3128 wrote to memory of 2848	3128	3cf411dfe4bd60c8bb4c7e0c77d0418c885e65570c7a5b8458d60cdf06423960.exe	3cf411dfe4bd60c8bb4c7e0c77d0418c885e65570c7a5b8458d60cdf06423960.exe
PID 3128 wrote to memory of 2848	3128	3cf411dfe4bd60c8bb4c7e0c77d0418c885e65570c7a5b8458d60cdf06423960.exe	3cf411dfe4bd60c8bb4c7e0c77d0418c885e65570c7a5b8458d60cdf06423960.exe
PID 3128 wrote to memory of 2848	3128	3cf411dfe4bd60c8bb4c7e0c77d0418c885e65570c7a5b8458d60cdf06423960.exe	3cf411dfe4bd60c8bb4c7e0c77d0418c885e65570c7a5b8458d60cdf06423960.exe
PID 3128 wrote to memory of 2848	3128	3cf411dfe4bd60c8bb4c7e0c77d0418c885e65570c7a5b8458d60cdf06423960.exe	3cf411dfe4bd60c8bb4c7e0c77d0418c885e65570c7a5b8458d60cdf06423960.exe

C:\Users\Admin\AppData\Local\Temp\3cf411dfe4bd60c8bb4c7e0c77d0418c885e65570c7a5b8458d60cdf06423960.exe
"C:\Users\Admin\AppData\Local\Temp\3cf411dfe4bd60c8bb4c7e0c77d0418c885e65570c7a5b8458d60cdf06423960.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3128

C:\Users\Admin\AppData\Local\Temp\3cf411dfe4bd60c8bb4c7e0c77d0418c885e65570c7a5b8458d60cdf06423960.exe
"C:\Users\Admin\AppData\Local\Temp\3cf411dfe4bd60c8bb4c7e0c77d0418c885e65570c7a5b8458d60cdf06423960.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2848-124-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2848-125-0x000000000041EBA0-mapping.dmp

Download
memory/2848-126-0x0000000001980000-0x0000000001CA0000-memory.dmp

Filesize
3.1MB

Download
memory/3128-115-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/3128-117-0x0000000004F30000-0x0000000004F31000-memory.dmp

Filesize
4KB

Download
memory/3128-118-0x0000000004960000-0x0000000004961000-memory.dmp

Filesize
4KB

Download
memory/3128-119-0x0000000004A30000-0x0000000004F2E000-memory.dmp

Filesize
5.0MB

Download
memory/3128-120-0x0000000004BF0000-0x0000000004BF1000-memory.dmp

Filesize
4KB

Download
memory/3128-121-0x0000000004F20000-0x0000000004F26000-memory.dmp

Filesize
24KB

Download
memory/3128-122-0x0000000007FA0000-0x0000000007FA1000-memory.dmp

Filesize
4KB

Download
memory/3128-123-0x0000000007F00000-0x0000000007F4F000-memory.dmp

Filesize
316KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads