formbook | 882d1b405632e01ab063253e2a0f647ff2587fe879e6b90e03b59226e36c8fe8

General

Target

e96932ebdf43aba69c5cdcebc89413cb.exe
Size

502KB
MD5

e96932ebdf43aba69c5cdcebc89413cb
SHA1

5051ceeb14e13c31f64df10844b65fea185caf44
SHA256

882d1b405632e01ab063253e2a0f647ff2587fe879e6b90e03b59226e36c8fe8
SHA512

6cb93514c2d240de42a321bdd579b34091b65e6615b23924602e7168b9ac2f3a32c146d415832c2d98d9ad1b4367a829e5ebc2c0c4e862f361b54de5edcc055a

Score

10^/10

formbook vngb rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

vngb

C2

http://www.gvlc0.club/vngb/

Decoy

omertalasvegas.com

payyep.com

modasportss.com

gestionestrategicadl.com

teamolemiss.club

geektranslate.com

versatileventure.com

athletic-hub.com

vitanovaretreats.com

padison8t.com

tutoeasy.com

ediblewholesale.com

kangrungao.com

satode.com

prohibitionfeeds.com

getmorevacations.com

blinkworldbeauty.com

kdlabsallr.com

almanasef.com

transportationservicellc.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/576-63-0x000000000041F0E0-mapping.dmp	formbook
behavioral1/memory/576-62-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

e96932ebdf43aba69c5cdcebc89413cb.exe

description pid process target process

PID 1580 set thread context of 576 1580 e96932ebdf43aba69c5cdcebc89413cb.exe e96932ebdf43aba69c5cdcebc89413cb.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

e96932ebdf43aba69c5cdcebc89413cb.exe

pid process

576 e96932ebdf43aba69c5cdcebc89413cb.exe

description	pid	process	target process
PID 1580 set thread context of 576	1580	e96932ebdf43aba69c5cdcebc89413cb.exe	e96932ebdf43aba69c5cdcebc89413cb.exe

pid	process
576	e96932ebdf43aba69c5cdcebc89413cb.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

e96932ebdf43aba69c5cdcebc89413cb.exe

description	pid	process	target process
PID 1580 wrote to memory of 576	1580	e96932ebdf43aba69c5cdcebc89413cb.exe	e96932ebdf43aba69c5cdcebc89413cb.exe
PID 1580 wrote to memory of 576	1580	e96932ebdf43aba69c5cdcebc89413cb.exe	e96932ebdf43aba69c5cdcebc89413cb.exe
PID 1580 wrote to memory of 576	1580	e96932ebdf43aba69c5cdcebc89413cb.exe	e96932ebdf43aba69c5cdcebc89413cb.exe
PID 1580 wrote to memory of 576	1580	e96932ebdf43aba69c5cdcebc89413cb.exe	e96932ebdf43aba69c5cdcebc89413cb.exe
PID 1580 wrote to memory of 576	1580	e96932ebdf43aba69c5cdcebc89413cb.exe	e96932ebdf43aba69c5cdcebc89413cb.exe
PID 1580 wrote to memory of 576	1580	e96932ebdf43aba69c5cdcebc89413cb.exe	e96932ebdf43aba69c5cdcebc89413cb.exe
PID 1580 wrote to memory of 576	1580	e96932ebdf43aba69c5cdcebc89413cb.exe	e96932ebdf43aba69c5cdcebc89413cb.exe

C:\Users\Admin\AppData\Local\Temp\e96932ebdf43aba69c5cdcebc89413cb.exe
"C:\Users\Admin\AppData\Local\Temp\e96932ebdf43aba69c5cdcebc89413cb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1580

C:\Users\Admin\AppData\Local\Temp\e96932ebdf43aba69c5cdcebc89413cb.exe
"C:\Users\Admin\AppData\Local\Temp\e96932ebdf43aba69c5cdcebc89413cb.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:576

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/576-60-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/576-61-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/576-63-0x000000000041F0E0-mapping.dmp

Download
memory/576-62-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/576-64-0x0000000000B70000-0x0000000000E73000-memory.dmp

Filesize
3.0MB

Download
memory/1580-55-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

Filesize
4KB

Download
memory/1580-57-0x0000000000670000-0x0000000000676000-memory.dmp

Filesize
24KB

Download
memory/1580-58-0x0000000004260000-0x0000000004261000-memory.dmp

Filesize
4KB

Download
memory/1580-59-0x0000000004F30000-0x0000000004F90000-memory.dmp

Filesize
384KB

Download

Analysis

Sharing