formbook | fcd3b620d09a3268b7d58c23a46aaa8446c13e045ad99cf5c71eb2d811f3a61f

General

Target

ee8cc08d22bc6541b19e4b435b341ced.exe
Size

559KB
MD5

ee8cc08d22bc6541b19e4b435b341ced
SHA1

14eef8604298dd707b6b6d40c428b176359ea686
SHA256

fcd3b620d09a3268b7d58c23a46aaa8446c13e045ad99cf5c71eb2d811f3a61f
SHA512

7a4ca5e3fc02cd3fc2ce1ec487d00408794fed6f5def10171e6e094ba95637c0594fc1899ab73122776b58b6dad2898b68cc5224a39a2cf67c70313fe5c89b4d

Score

10^/10

formbook jy0b rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

jy0b

C2

http://www.filecrev.com/jy0b/

Decoy

lamejorimagen.com

mykabukibrush.com

modgon.com

barefoottherapeutics.com

shimpeg.net

trade-sniper.com

chiangkhancityhotel.com

joblessmoni.club

stespritsubways.com

chico-group.com

nni8.xyz

searchtypically.online

jobsyork.com

bestsales-crypto.com

iqmarketing.info

bullcityphotobooths.com

fwssc.icu

1oc87s.icu

usdiesel.xyz

secrets2optimumnutrition.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/792-61-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/792-62-0x000000000041F150-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

ee8cc08d22bc6541b19e4b435b341ced.exe

description pid process target process

PID 764 set thread context of 792 764 ee8cc08d22bc6541b19e4b435b341ced.exe ee8cc08d22bc6541b19e4b435b341ced.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

ee8cc08d22bc6541b19e4b435b341ced.exe

pid process

792 ee8cc08d22bc6541b19e4b435b341ced.exe

description	pid	process	target process
PID 764 set thread context of 792	764	ee8cc08d22bc6541b19e4b435b341ced.exe	ee8cc08d22bc6541b19e4b435b341ced.exe

pid	process
792	ee8cc08d22bc6541b19e4b435b341ced.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

ee8cc08d22bc6541b19e4b435b341ced.exe

description	pid	process	target process
PID 764 wrote to memory of 792	764	ee8cc08d22bc6541b19e4b435b341ced.exe	ee8cc08d22bc6541b19e4b435b341ced.exe
PID 764 wrote to memory of 792	764	ee8cc08d22bc6541b19e4b435b341ced.exe	ee8cc08d22bc6541b19e4b435b341ced.exe
PID 764 wrote to memory of 792	764	ee8cc08d22bc6541b19e4b435b341ced.exe	ee8cc08d22bc6541b19e4b435b341ced.exe
PID 764 wrote to memory of 792	764	ee8cc08d22bc6541b19e4b435b341ced.exe	ee8cc08d22bc6541b19e4b435b341ced.exe
PID 764 wrote to memory of 792	764	ee8cc08d22bc6541b19e4b435b341ced.exe	ee8cc08d22bc6541b19e4b435b341ced.exe
PID 764 wrote to memory of 792	764	ee8cc08d22bc6541b19e4b435b341ced.exe	ee8cc08d22bc6541b19e4b435b341ced.exe
PID 764 wrote to memory of 792	764	ee8cc08d22bc6541b19e4b435b341ced.exe	ee8cc08d22bc6541b19e4b435b341ced.exe

C:\Users\Admin\AppData\Local\Temp\ee8cc08d22bc6541b19e4b435b341ced.exe
"C:\Users\Admin\AppData\Local\Temp\ee8cc08d22bc6541b19e4b435b341ced.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:764

C:\Users\Admin\AppData\Local\Temp\ee8cc08d22bc6541b19e4b435b341ced.exe
"C:\Users\Admin\AppData\Local\Temp\ee8cc08d22bc6541b19e4b435b341ced.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:792

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/764-54-0x0000000000E20000-0x0000000000E21000-memory.dmp

Filesize
4KB

Download
memory/764-56-0x0000000004D40000-0x0000000004D41000-memory.dmp

Filesize
4KB

Download
memory/764-57-0x00000000003E0000-0x00000000003E7000-memory.dmp

Filesize
28KB

Download
memory/764-58-0x00000000043C0000-0x0000000004412000-memory.dmp

Filesize
328KB

Download
memory/792-59-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/792-60-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/792-61-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/792-62-0x000000000041F150-mapping.dmp

Download
memory/792-63-0x00000000009C0000-0x0000000000CC3000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing