formbook | 0bbec09890d31b79c26d2b175684426630f8b243c4a210cd919e54f35572bd80

General

Target

12479bd46f56b3e134a02c85e2d0e3df.exe
Size

565KB
MD5

12479bd46f56b3e134a02c85e2d0e3df
SHA1

cc8ed3116ff08234d5f6bd98a5fdc8f4bf07f1a5
SHA256

0bbec09890d31b79c26d2b175684426630f8b243c4a210cd919e54f35572bd80
SHA512

bc1d89bad911f8e0220dbcf1847d9150c3e623472d4acfeebae757ac25c74c94d2778b6fa1fcf5ec8f220d54eb50ced9ae7b083135eb1b4711ecbb10f7cbc21f

Score

10^/10

formbook s18y rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

s18y

C2

http://www.agentpathleurre.space/s18y/

Decoy

jokes-online.com

dzzdjn.com

lizzieerhardtebnaryepptts.com

interfacehand.xyz

sale-m.site

block-facebook.com

dicasdamadrinha.com

maythewind.com

hasari.net

omnists.com

thevalley-eg.com

rdfj.xyz

szhfcy.com

alkalineage.club

fdf.xyz

absorplus.com

poldolongo.com

badassshirts.club

ferienwohnungenmv.com

bilboondokoak.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1620-124-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/1620-125-0x000000000041F120-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

12479bd46f56b3e134a02c85e2d0e3df.exe

description pid process target process

PID 2704 set thread context of 1620 2704 12479bd46f56b3e134a02c85e2d0e3df.exe 12479bd46f56b3e134a02c85e2d0e3df.exe

description	pid	process	target process
PID 2704 set thread context of 1620	2704	12479bd46f56b3e134a02c85e2d0e3df.exe	12479bd46f56b3e134a02c85e2d0e3df.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

12479bd46f56b3e134a02c85e2d0e3df.exe12479bd46f56b3e134a02c85e2d0e3df.exe

pid	process
2704	12479bd46f56b3e134a02c85e2d0e3df.exe
2704	12479bd46f56b3e134a02c85e2d0e3df.exe
2704	12479bd46f56b3e134a02c85e2d0e3df.exe
2704	12479bd46f56b3e134a02c85e2d0e3df.exe
2704	12479bd46f56b3e134a02c85e2d0e3df.exe
2704	12479bd46f56b3e134a02c85e2d0e3df.exe
1620	12479bd46f56b3e134a02c85e2d0e3df.exe
1620	12479bd46f56b3e134a02c85e2d0e3df.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

12479bd46f56b3e134a02c85e2d0e3df.exe

description pid process

Token: SeDebugPrivilege 2704 12479bd46f56b3e134a02c85e2d0e3df.exe

description	pid	process
Token: SeDebugPrivilege	2704	12479bd46f56b3e134a02c85e2d0e3df.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

12479bd46f56b3e134a02c85e2d0e3df.exe

C:\Users\Admin\AppData\Local\Temp\12479bd46f56b3e134a02c85e2d0e3df.exe
"C:\Users\Admin\AppData\Local\Temp\12479bd46f56b3e134a02c85e2d0e3df.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2704

C:\Users\Admin\AppData\Local\Temp\12479bd46f56b3e134a02c85e2d0e3df.exe
"C:\Users\Admin\AppData\Local\Temp\12479bd46f56b3e134a02c85e2d0e3df.exe"
2⤵
PID:1600

C:\Users\Admin\AppData\Local\Temp\12479bd46f56b3e134a02c85e2d0e3df.exe
"C:\Users\Admin\AppData\Local\Temp\12479bd46f56b3e134a02c85e2d0e3df.exe"
2⤵
PID:1420

C:\Users\Admin\AppData\Local\Temp\12479bd46f56b3e134a02c85e2d0e3df.exe
"C:\Users\Admin\AppData\Local\Temp\12479bd46f56b3e134a02c85e2d0e3df.exe"
2⤵
PID:1424

C:\Users\Admin\AppData\Local\Temp\12479bd46f56b3e134a02c85e2d0e3df.exe
"C:\Users\Admin\AppData\Local\Temp\12479bd46f56b3e134a02c85e2d0e3df.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1620-124-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1620-125-0x000000000041F120-mapping.dmp

Download
memory/1620-126-0x00000000010B0000-0x00000000013D0000-memory.dmp

Filesize
3.1MB

Download
memory/2704-115-0x0000000000E60000-0x0000000000E61000-memory.dmp

Filesize
4KB

Download
memory/2704-117-0x0000000005D60000-0x0000000005D61000-memory.dmp

Filesize
4KB

Download
memory/2704-118-0x0000000005750000-0x0000000005751000-memory.dmp

Filesize
4KB

Download
memory/2704-119-0x0000000005860000-0x0000000005D5E000-memory.dmp

Filesize
5.0MB

Download
memory/2704-120-0x0000000005740000-0x0000000005741000-memory.dmp

Filesize
4KB

Download
memory/2704-121-0x0000000005AB0000-0x0000000005AB7000-memory.dmp

Filesize
28KB

Download
memory/2704-122-0x0000000008FE0000-0x0000000008FE1000-memory.dmp

Filesize
4KB

Download
memory/2704-123-0x0000000009180000-0x00000000091D2000-memory.dmp

Filesize
328KB

Download

description	pid	process	target process
PID 2704 wrote to memory of 1600	2704	12479bd46f56b3e134a02c85e2d0e3df.exe	12479bd46f56b3e134a02c85e2d0e3df.exe
PID 2704 wrote to memory of 1600	2704	12479bd46f56b3e134a02c85e2d0e3df.exe	12479bd46f56b3e134a02c85e2d0e3df.exe
PID 2704 wrote to memory of 1600	2704	12479bd46f56b3e134a02c85e2d0e3df.exe	12479bd46f56b3e134a02c85e2d0e3df.exe
PID 2704 wrote to memory of 1420	2704	12479bd46f56b3e134a02c85e2d0e3df.exe	12479bd46f56b3e134a02c85e2d0e3df.exe
PID 2704 wrote to memory of 1420	2704	12479bd46f56b3e134a02c85e2d0e3df.exe	12479bd46f56b3e134a02c85e2d0e3df.exe
PID 2704 wrote to memory of 1420	2704	12479bd46f56b3e134a02c85e2d0e3df.exe	12479bd46f56b3e134a02c85e2d0e3df.exe
PID 2704 wrote to memory of 1424	2704	12479bd46f56b3e134a02c85e2d0e3df.exe	12479bd46f56b3e134a02c85e2d0e3df.exe
PID 2704 wrote to memory of 1424	2704	12479bd46f56b3e134a02c85e2d0e3df.exe	12479bd46f56b3e134a02c85e2d0e3df.exe
PID 2704 wrote to memory of 1424	2704	12479bd46f56b3e134a02c85e2d0e3df.exe	12479bd46f56b3e134a02c85e2d0e3df.exe
PID 2704 wrote to memory of 1620	2704	12479bd46f56b3e134a02c85e2d0e3df.exe	12479bd46f56b3e134a02c85e2d0e3df.exe
PID 2704 wrote to memory of 1620	2704	12479bd46f56b3e134a02c85e2d0e3df.exe	12479bd46f56b3e134a02c85e2d0e3df.exe
PID 2704 wrote to memory of 1620	2704	12479bd46f56b3e134a02c85e2d0e3df.exe	12479bd46f56b3e134a02c85e2d0e3df.exe
PID 2704 wrote to memory of 1620	2704	12479bd46f56b3e134a02c85e2d0e3df.exe	12479bd46f56b3e134a02c85e2d0e3df.exe
PID 2704 wrote to memory of 1620	2704	12479bd46f56b3e134a02c85e2d0e3df.exe	12479bd46f56b3e134a02c85e2d0e3df.exe
PID 2704 wrote to memory of 1620	2704	12479bd46f56b3e134a02c85e2d0e3df.exe	12479bd46f56b3e134a02c85e2d0e3df.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads