8b249a16ea50d01651cf9c1f01c97deea48293f1b28735450d62bd0413b93653

General
Target

8b249a16ea50d01651cf9c1f01c97deea48293f1b28735450d62bd0413b93653.exe

Filesize

329KB

Completed

13-11-2021 11:00

Score
10/10
MD5

1ad9efcddab819d24cca2f9323395f9e

SHA1

1ffcdd188cb66666cdac14bb8d8b48902bd666e6

SHA256

8b249a16ea50d01651cf9c1f01c97deea48293f1b28735450d62bd0413b93653

Malware Config

Extracted

Family formbook
Version 4.1
Campaign kzk9
C2

http://www.yourmajordomo.com/kzk9/

Decoy

tianconghuo.club

1996-page.com

ourtownmax.net

conservativetreehose.com

synth.repair

donnachicacreperia.com

tentfull.com

weapp.download

surfersink.com

gattlebusinessservices.com

sebastian249.com

anhphuc.company

betternatureproducts.net

defroplate.com

seattlesquidsquad.com

polarjob.com

lendingadvantage.com

angelsondope.com

goportjitney.com

tiendagrupojagr.com

self-care360.com

foreignexchage.com

loan-stalemate.info

hrsimrnsingh.com

laserobsession.com

primetimesmagazine.com

teminyulon.xyz

kanoondarab.com

alpinefall.com

tbmautosales.com

4g2020.com

libertyquartermaster.com

flavorfalafel.com

generlitravel.com

solvedfp.icu

jamnvibez.com

zmx258.com

doudiangroup.com

dancecenterwest.com

ryantheeconomist.com

beeofthehive.com

bluelearn.world

vivalasplantas.com

yumiacraftlab.com

shophere247365.com

enjoybespokenwords.com

windajol.com

ctgbazar.xyz

afcerd.com

dateprotect.com

Signatures 6

Filter: none

  • Formbook

    Description

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook Payload

    Tags

    Reported IOCs

    resourceyara_rule
    behavioral1/memory/744-127-0x0000000000400000-0x000000000042E000-memory.dmpformbook
    behavioral1/memory/744-128-0x000000000041EB80-mapping.dmpformbook
  • Suspicious use of SetThreadContext
    8b249a16ea50d01651cf9c1f01c97deea48293f1b28735450d62bd0413b93653.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 3676 set thread context of 74436768b249a16ea50d01651cf9c1f01c97deea48293f1b28735450d62bd0413b93653.exe8b249a16ea50d01651cf9c1f01c97deea48293f1b28735450d62bd0413b93653.exe
  • Suspicious behavior: EnumeratesProcesses
    8b249a16ea50d01651cf9c1f01c97deea48293f1b28735450d62bd0413b93653.exe8b249a16ea50d01651cf9c1f01c97deea48293f1b28735450d62bd0413b93653.exe

    Reported IOCs

    pidprocess
    36768b249a16ea50d01651cf9c1f01c97deea48293f1b28735450d62bd0413b93653.exe
    36768b249a16ea50d01651cf9c1f01c97deea48293f1b28735450d62bd0413b93653.exe
    36768b249a16ea50d01651cf9c1f01c97deea48293f1b28735450d62bd0413b93653.exe
    36768b249a16ea50d01651cf9c1f01c97deea48293f1b28735450d62bd0413b93653.exe
    36768b249a16ea50d01651cf9c1f01c97deea48293f1b28735450d62bd0413b93653.exe
    36768b249a16ea50d01651cf9c1f01c97deea48293f1b28735450d62bd0413b93653.exe
    36768b249a16ea50d01651cf9c1f01c97deea48293f1b28735450d62bd0413b93653.exe
    36768b249a16ea50d01651cf9c1f01c97deea48293f1b28735450d62bd0413b93653.exe
    36768b249a16ea50d01651cf9c1f01c97deea48293f1b28735450d62bd0413b93653.exe
    7448b249a16ea50d01651cf9c1f01c97deea48293f1b28735450d62bd0413b93653.exe
    7448b249a16ea50d01651cf9c1f01c97deea48293f1b28735450d62bd0413b93653.exe
  • Suspicious use of AdjustPrivilegeToken
    8b249a16ea50d01651cf9c1f01c97deea48293f1b28735450d62bd0413b93653.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege36768b249a16ea50d01651cf9c1f01c97deea48293f1b28735450d62bd0413b93653.exe
  • Suspicious use of WriteProcessMemory
    8b249a16ea50d01651cf9c1f01c97deea48293f1b28735450d62bd0413b93653.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 3676 wrote to memory of 43636768b249a16ea50d01651cf9c1f01c97deea48293f1b28735450d62bd0413b93653.exe8b249a16ea50d01651cf9c1f01c97deea48293f1b28735450d62bd0413b93653.exe
    PID 3676 wrote to memory of 43636768b249a16ea50d01651cf9c1f01c97deea48293f1b28735450d62bd0413b93653.exe8b249a16ea50d01651cf9c1f01c97deea48293f1b28735450d62bd0413b93653.exe
    PID 3676 wrote to memory of 43636768b249a16ea50d01651cf9c1f01c97deea48293f1b28735450d62bd0413b93653.exe8b249a16ea50d01651cf9c1f01c97deea48293f1b28735450d62bd0413b93653.exe
    PID 3676 wrote to memory of 74436768b249a16ea50d01651cf9c1f01c97deea48293f1b28735450d62bd0413b93653.exe8b249a16ea50d01651cf9c1f01c97deea48293f1b28735450d62bd0413b93653.exe
    PID 3676 wrote to memory of 74436768b249a16ea50d01651cf9c1f01c97deea48293f1b28735450d62bd0413b93653.exe8b249a16ea50d01651cf9c1f01c97deea48293f1b28735450d62bd0413b93653.exe
    PID 3676 wrote to memory of 74436768b249a16ea50d01651cf9c1f01c97deea48293f1b28735450d62bd0413b93653.exe8b249a16ea50d01651cf9c1f01c97deea48293f1b28735450d62bd0413b93653.exe
    PID 3676 wrote to memory of 74436768b249a16ea50d01651cf9c1f01c97deea48293f1b28735450d62bd0413b93653.exe8b249a16ea50d01651cf9c1f01c97deea48293f1b28735450d62bd0413b93653.exe
    PID 3676 wrote to memory of 74436768b249a16ea50d01651cf9c1f01c97deea48293f1b28735450d62bd0413b93653.exe8b249a16ea50d01651cf9c1f01c97deea48293f1b28735450d62bd0413b93653.exe
    PID 3676 wrote to memory of 74436768b249a16ea50d01651cf9c1f01c97deea48293f1b28735450d62bd0413b93653.exe8b249a16ea50d01651cf9c1f01c97deea48293f1b28735450d62bd0413b93653.exe
Processes 3
  • C:\Users\Admin\AppData\Local\Temp\8b249a16ea50d01651cf9c1f01c97deea48293f1b28735450d62bd0413b93653.exe
    "C:\Users\Admin\AppData\Local\Temp\8b249a16ea50d01651cf9c1f01c97deea48293f1b28735450d62bd0413b93653.exe"
    Suspicious use of SetThreadContext
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:3676
    • C:\Users\Admin\AppData\Local\Temp\8b249a16ea50d01651cf9c1f01c97deea48293f1b28735450d62bd0413b93653.exe
      "C:\Users\Admin\AppData\Local\Temp\8b249a16ea50d01651cf9c1f01c97deea48293f1b28735450d62bd0413b93653.exe"
      PID:436
    • C:\Users\Admin\AppData\Local\Temp\8b249a16ea50d01651cf9c1f01c97deea48293f1b28735450d62bd0413b93653.exe
      "C:\Users\Admin\AppData\Local\Temp\8b249a16ea50d01651cf9c1f01c97deea48293f1b28735450d62bd0413b93653.exe"
      Suspicious behavior: EnumeratesProcesses
      PID:744
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads
                          • memory/744-127-0x0000000000400000-0x000000000042E000-memory.dmp

                          • memory/744-128-0x000000000041EB80-mapping.dmp

                          • memory/744-129-0x00000000010C0000-0x00000000013E0000-memory.dmp

                          • memory/3676-118-0x0000000000F80000-0x0000000000F81000-memory.dmp

                          • memory/3676-120-0x0000000005E90000-0x0000000005E91000-memory.dmp

                          • memory/3676-124-0x0000000005AB0000-0x0000000005AB7000-memory.dmp

                          • memory/3676-125-0x0000000007FC0000-0x0000000007FC1000-memory.dmp

                          • memory/3676-126-0x0000000007F70000-0x0000000007FBB000-memory.dmp

                          • memory/3676-121-0x0000000005880000-0x0000000005881000-memory.dmp

                          • memory/3676-122-0x0000000003340000-0x0000000003341000-memory.dmp

                          • memory/3676-123-0x0000000005810000-0x0000000005811000-memory.dmp