formbook | 8aa346b87c8d3d53fb5265cd0c04bbd3c8c978b7e1eb7b2e0958c078322d75e9

General

Target

b87f81920e06301937deb513ff65bf91.exe
Size

403KB
MD5

b87f81920e06301937deb513ff65bf91
SHA1

cbe9ee020d5fad93b49784f6707614804f3f8ce2
SHA256

8aa346b87c8d3d53fb5265cd0c04bbd3c8c978b7e1eb7b2e0958c078322d75e9
SHA512

edafb5cd221b340ab2b5b9c9a00d087b0a80d35bd9f07c073fc5ffb0eb4f7360f5751fbf04974ce1e94a39d649fbc7c5efd5b5400c2a255e8b9e01e2964eff27

Score

10^/10

formbook s18y rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

s18y

C2

http://www.agentpathleurre.space/s18y/

Decoy

jokes-online.com

dzzdjn.com

lizzieerhardtebnaryepptts.com

interfacehand.xyz

sale-m.site

block-facebook.com

dicasdamadrinha.com

maythewind.com

hasari.net

omnists.com

thevalley-eg.com

rdfj.xyz

szhfcy.com

alkalineage.club

fdf.xyz

absorplus.com

poldolongo.com

badassshirts.club

ferienwohnungenmv.com

bilboondokoak.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/760-127-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/760-128-0x000000000041F120-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

b87f81920e06301937deb513ff65bf91.exe

description pid process target process

PID 3772 set thread context of 760 3772 b87f81920e06301937deb513ff65bf91.exe b87f81920e06301937deb513ff65bf91.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

b87f81920e06301937deb513ff65bf91.exe

pid process

760 b87f81920e06301937deb513ff65bf91.exe
760 b87f81920e06301937deb513ff65bf91.exe

description	pid	process	target process
PID 3772 set thread context of 760	3772	b87f81920e06301937deb513ff65bf91.exe	b87f81920e06301937deb513ff65bf91.exe

pid	process
760	b87f81920e06301937deb513ff65bf91.exe
760	b87f81920e06301937deb513ff65bf91.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

b87f81920e06301937deb513ff65bf91.exe

description	pid	process	target process
PID 3772 wrote to memory of 760	3772	b87f81920e06301937deb513ff65bf91.exe	b87f81920e06301937deb513ff65bf91.exe
PID 3772 wrote to memory of 760	3772	b87f81920e06301937deb513ff65bf91.exe	b87f81920e06301937deb513ff65bf91.exe
PID 3772 wrote to memory of 760	3772	b87f81920e06301937deb513ff65bf91.exe	b87f81920e06301937deb513ff65bf91.exe
PID 3772 wrote to memory of 760	3772	b87f81920e06301937deb513ff65bf91.exe	b87f81920e06301937deb513ff65bf91.exe
PID 3772 wrote to memory of 760	3772	b87f81920e06301937deb513ff65bf91.exe	b87f81920e06301937deb513ff65bf91.exe
PID 3772 wrote to memory of 760	3772	b87f81920e06301937deb513ff65bf91.exe	b87f81920e06301937deb513ff65bf91.exe

C:\Users\Admin\AppData\Local\Temp\b87f81920e06301937deb513ff65bf91.exe
"C:\Users\Admin\AppData\Local\Temp\b87f81920e06301937deb513ff65bf91.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3772

C:\Users\Admin\AppData\Local\Temp\b87f81920e06301937deb513ff65bf91.exe
"C:\Users\Admin\AppData\Local\Temp\b87f81920e06301937deb513ff65bf91.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:760

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/760-127-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/760-128-0x000000000041F120-mapping.dmp

Download
memory/760-129-0x0000000001310000-0x0000000001630000-memory.dmp

Filesize
3.1MB

Download
memory/3772-118-0x0000000000C40000-0x0000000000C41000-memory.dmp

Filesize
4KB

Download
memory/3772-120-0x0000000005980000-0x0000000005981000-memory.dmp

Filesize
4KB

Download
memory/3772-121-0x0000000005520000-0x0000000005521000-memory.dmp

Filesize
4KB

Download
memory/3772-122-0x0000000005480000-0x000000000597E000-memory.dmp

Filesize
5.0MB

Download
memory/3772-123-0x00000000057A0000-0x00000000057A1000-memory.dmp

Filesize
4KB

Download
memory/3772-124-0x0000000008A50000-0x0000000008A56000-memory.dmp

Filesize
24KB

Download
memory/3772-125-0x0000000008D80000-0x0000000008D81000-memory.dmp

Filesize
4KB

Download
memory/3772-126-0x0000000008F20000-0x0000000008F70000-memory.dmp

Filesize
320KB

Download

Analysis

Sharing