formbook | 30c4d8cc68cc16af698b521cf9e31a8540f0c5cce8e2d66e874fc62a87dae393

General

Target

fef53bf27227284ba5324f1eb1cca516.exe
Size

720KB
MD5

fef53bf27227284ba5324f1eb1cca516
SHA1

759e18dc1467c5df07561185090ba816953f810f
SHA256

30c4d8cc68cc16af698b521cf9e31a8540f0c5cce8e2d66e874fc62a87dae393
SHA512

a58d1b717db73d30eb2c1f25aabe02535a2bd6d8ef538818320abab84c5e9dcfa2350821e789cdab43d4fce7d703906ac623f7479f83aba7f7a9c73a4cea65ac

Score

10^/10

formbook vngb rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

vngb

C2

http://www.gvlc0.club/vngb/

Decoy

omertalasvegas.com

payyep.com

modasportss.com

gestionestrategicadl.com

teamolemiss.club

geektranslate.com

versatileventure.com

athletic-hub.com

vitanovaretreats.com

padison8t.com

tutoeasy.com

ediblewholesale.com

kangrungao.com

satode.com

prohibitionfeeds.com

getmorevacations.com

blinkworldbeauty.com

kdlabsallr.com

almanasef.com

transportationservicellc.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/364-63-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/364-64-0x000000000041F0E0-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

fef53bf27227284ba5324f1eb1cca516.exe

description pid process target process

PID 1504 set thread context of 364 1504 fef53bf27227284ba5324f1eb1cca516.exe fef53bf27227284ba5324f1eb1cca516.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

fef53bf27227284ba5324f1eb1cca516.exefef53bf27227284ba5324f1eb1cca516.exe

pid process

1504 fef53bf27227284ba5324f1eb1cca516.exe
364 fef53bf27227284ba5324f1eb1cca516.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

fef53bf27227284ba5324f1eb1cca516.exe

description pid process

Token: SeDebugPrivilege 1504 fef53bf27227284ba5324f1eb1cca516.exe

description	pid	process	target process
PID 1504 set thread context of 364	1504	fef53bf27227284ba5324f1eb1cca516.exe	fef53bf27227284ba5324f1eb1cca516.exe

pid	process
1504	fef53bf27227284ba5324f1eb1cca516.exe
364	fef53bf27227284ba5324f1eb1cca516.exe

description	pid	process
Token: SeDebugPrivilege	1504	fef53bf27227284ba5324f1eb1cca516.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

fef53bf27227284ba5324f1eb1cca516.exe

description	pid	process	target process
PID 1504 wrote to memory of 1364	1504	fef53bf27227284ba5324f1eb1cca516.exe	fef53bf27227284ba5324f1eb1cca516.exe
PID 1504 wrote to memory of 1364	1504	fef53bf27227284ba5324f1eb1cca516.exe	fef53bf27227284ba5324f1eb1cca516.exe
PID 1504 wrote to memory of 1364	1504	fef53bf27227284ba5324f1eb1cca516.exe	fef53bf27227284ba5324f1eb1cca516.exe
PID 1504 wrote to memory of 1364	1504	fef53bf27227284ba5324f1eb1cca516.exe	fef53bf27227284ba5324f1eb1cca516.exe
PID 1504 wrote to memory of 364	1504	fef53bf27227284ba5324f1eb1cca516.exe	fef53bf27227284ba5324f1eb1cca516.exe
PID 1504 wrote to memory of 364	1504	fef53bf27227284ba5324f1eb1cca516.exe	fef53bf27227284ba5324f1eb1cca516.exe
PID 1504 wrote to memory of 364	1504	fef53bf27227284ba5324f1eb1cca516.exe	fef53bf27227284ba5324f1eb1cca516.exe
PID 1504 wrote to memory of 364	1504	fef53bf27227284ba5324f1eb1cca516.exe	fef53bf27227284ba5324f1eb1cca516.exe
PID 1504 wrote to memory of 364	1504	fef53bf27227284ba5324f1eb1cca516.exe	fef53bf27227284ba5324f1eb1cca516.exe
PID 1504 wrote to memory of 364	1504	fef53bf27227284ba5324f1eb1cca516.exe	fef53bf27227284ba5324f1eb1cca516.exe
PID 1504 wrote to memory of 364	1504	fef53bf27227284ba5324f1eb1cca516.exe	fef53bf27227284ba5324f1eb1cca516.exe

C:\Users\Admin\AppData\Local\Temp\fef53bf27227284ba5324f1eb1cca516.exe
"C:\Users\Admin\AppData\Local\Temp\fef53bf27227284ba5324f1eb1cca516.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1504

C:\Users\Admin\AppData\Local\Temp\fef53bf27227284ba5324f1eb1cca516.exe
"C:\Users\Admin\AppData\Local\Temp\fef53bf27227284ba5324f1eb1cca516.exe"
2⤵
PID:1364

C:\Users\Admin\AppData\Local\Temp\fef53bf27227284ba5324f1eb1cca516.exe
"C:\Users\Admin\AppData\Local\Temp\fef53bf27227284ba5324f1eb1cca516.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:364

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/364-61-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/364-62-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/364-63-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/364-64-0x000000000041F0E0-mapping.dmp

Download
memory/364-65-0x0000000000700000-0x0000000000A03000-memory.dmp

Filesize
3.0MB

Download
memory/1504-55-0x0000000010D50000-0x0000000010D51000-memory.dmp

Filesize
4KB

Download
memory/1504-57-0x0000000075141000-0x0000000075143000-memory.dmp

Filesize
8KB

Download
memory/1504-58-0x00000000041D0000-0x00000000041D1000-memory.dmp

Filesize
4KB

Download
memory/1504-59-0x0000000000510000-0x0000000000514000-memory.dmp

Filesize
16KB

Download
memory/1504-60-0x0000000004170000-0x00000000041D0000-memory.dmp

Filesize
384KB

Download

Analysis

Sharing