formbook | 30c4d8cc68cc16af698b521cf9e31a8540f0c5cce8e2d66e874fc62a87dae393

General

Target

fef53bf27227284ba5324f1eb1cca516.exe
Size

720KB
MD5

fef53bf27227284ba5324f1eb1cca516
SHA1

759e18dc1467c5df07561185090ba816953f810f
SHA256

30c4d8cc68cc16af698b521cf9e31a8540f0c5cce8e2d66e874fc62a87dae393
SHA512

a58d1b717db73d30eb2c1f25aabe02535a2bd6d8ef538818320abab84c5e9dcfa2350821e789cdab43d4fce7d703906ac623f7479f83aba7f7a9c73a4cea65ac

Score

10^/10

formbook vngb rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

vngb

C2

http://www.gvlc0.club/vngb/

Decoy

omertalasvegas.com

payyep.com

modasportss.com

gestionestrategicadl.com

teamolemiss.club

geektranslate.com

versatileventure.com

athletic-hub.com

vitanovaretreats.com

padison8t.com

tutoeasy.com

ediblewholesale.com

kangrungao.com

satode.com

prohibitionfeeds.com

getmorevacations.com

blinkworldbeauty.com

kdlabsallr.com

almanasef.com

transportationservicellc.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/624-125-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/624-126-0x000000000041F0E0-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

fef53bf27227284ba5324f1eb1cca516.exe

description pid process target process

PID 3592 set thread context of 624 3592 fef53bf27227284ba5324f1eb1cca516.exe fef53bf27227284ba5324f1eb1cca516.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

fef53bf27227284ba5324f1eb1cca516.exe

pid process

624 fef53bf27227284ba5324f1eb1cca516.exe
624 fef53bf27227284ba5324f1eb1cca516.exe

description	pid	process	target process
PID 3592 set thread context of 624	3592	fef53bf27227284ba5324f1eb1cca516.exe	fef53bf27227284ba5324f1eb1cca516.exe

pid	process
624	fef53bf27227284ba5324f1eb1cca516.exe
624	fef53bf27227284ba5324f1eb1cca516.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

fef53bf27227284ba5324f1eb1cca516.exe

description	pid	process	target process
PID 3592 wrote to memory of 624	3592	fef53bf27227284ba5324f1eb1cca516.exe	fef53bf27227284ba5324f1eb1cca516.exe
PID 3592 wrote to memory of 624	3592	fef53bf27227284ba5324f1eb1cca516.exe	fef53bf27227284ba5324f1eb1cca516.exe
PID 3592 wrote to memory of 624	3592	fef53bf27227284ba5324f1eb1cca516.exe	fef53bf27227284ba5324f1eb1cca516.exe
PID 3592 wrote to memory of 624	3592	fef53bf27227284ba5324f1eb1cca516.exe	fef53bf27227284ba5324f1eb1cca516.exe
PID 3592 wrote to memory of 624	3592	fef53bf27227284ba5324f1eb1cca516.exe	fef53bf27227284ba5324f1eb1cca516.exe
PID 3592 wrote to memory of 624	3592	fef53bf27227284ba5324f1eb1cca516.exe	fef53bf27227284ba5324f1eb1cca516.exe

C:\Users\Admin\AppData\Local\Temp\fef53bf27227284ba5324f1eb1cca516.exe
"C:\Users\Admin\AppData\Local\Temp\fef53bf27227284ba5324f1eb1cca516.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3592

C:\Users\Admin\AppData\Local\Temp\fef53bf27227284ba5324f1eb1cca516.exe
"C:\Users\Admin\AppData\Local\Temp\fef53bf27227284ba5324f1eb1cca516.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/624-125-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/624-126-0x000000000041F0E0-mapping.dmp

Download
memory/624-127-0x00000000018D0000-0x0000000001BF0000-memory.dmp

Filesize
3.1MB

Download
memory/3592-115-0x0000000000810000-0x0000000000811000-memory.dmp

Filesize
4KB

Download
memory/3592-117-0x00000000056D0000-0x00000000056D1000-memory.dmp

Filesize
4KB

Download
memory/3592-118-0x00000000050E0000-0x00000000050E1000-memory.dmp

Filesize
4KB

Download
memory/3592-119-0x0000000005040000-0x00000000050D2000-memory.dmp

Filesize
584KB

Download
memory/3592-120-0x0000000005190000-0x0000000005191000-memory.dmp

Filesize
4KB

Download
memory/3592-121-0x00000000051B0000-0x00000000051B4000-memory.dmp

Filesize
16KB

Download
memory/3592-122-0x0000000005640000-0x0000000005641000-memory.dmp

Filesize
4KB

Download
memory/3592-123-0x0000000005FB0000-0x0000000005FB1000-memory.dmp

Filesize
4KB

Download
memory/3592-124-0x0000000006050000-0x00000000060B0000-memory.dmp

Filesize
384KB

Download

Analysis

Sharing