formbook | bc049a2dd0bd12408af44d221301cc85ed0f46cbe7dc0911e6f8be908f6fce38

General

Target

bc049a2dd0bd12408af44d221301cc85ed0f46cbe7dc0911e6f8be908f6fce38.exe
Size

478KB
MD5

a6994db9af566c6bf180e5738ed966a1
SHA1

db179124a5dc6891377d29a796adc8fc32893c20
SHA256

bc049a2dd0bd12408af44d221301cc85ed0f46cbe7dc0911e6f8be908f6fce38
SHA512

1d41face28500234db165ae4a87289c17dcdab5fd67a7345619dd5f3d8024ad03e2d02186e28bf7357ad0c1fb05425c879204ea8b9ec3b5b1ca4512ee981f2c6

Score

10^/10

formbook a83r rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

a83r

Decoy

comercializadoralonso.com

durhamschoolservces.com

onegreencapital.com

smartcities24.com

maquinas.store

brianlovesbonsai.com

xin41518s.com

moneyearnus.xyz

be-mix.com

fengyat.club

inspectdecided.xyz

paksafpakistan.com

orhidlnt.top

princesuraj.com

vietnamvodka.com

renewnow.site

imageservices.xyz

luxurytravelfranchise.com

kp112.red

royalyorkfirewood.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/4040-124-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/4040-125-0x000000000041F170-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

bc049a2dd0bd12408af44d221301cc85ed0f46cbe7dc0911e6f8be908f6fce38.exe

description	pid	process	target process
PID 3056 set thread context of 4040	3056	bc049a2dd0bd12408af44d221301cc85ed0f46cbe7dc0911e6f8be908f6fce38.exe	bc049a2dd0bd12408af44d221301cc85ed0f46cbe7dc0911e6f8be908f6fce38.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

bc049a2dd0bd12408af44d221301cc85ed0f46cbe7dc0911e6f8be908f6fce38.exe

pid	process
4040	bc049a2dd0bd12408af44d221301cc85ed0f46cbe7dc0911e6f8be908f6fce38.exe
4040	bc049a2dd0bd12408af44d221301cc85ed0f46cbe7dc0911e6f8be908f6fce38.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

bc049a2dd0bd12408af44d221301cc85ed0f46cbe7dc0911e6f8be908f6fce38.exe

description	pid	process	target process
PID 3056 wrote to memory of 4040	3056	bc049a2dd0bd12408af44d221301cc85ed0f46cbe7dc0911e6f8be908f6fce38.exe	bc049a2dd0bd12408af44d221301cc85ed0f46cbe7dc0911e6f8be908f6fce38.exe
PID 3056 wrote to memory of 4040	3056	bc049a2dd0bd12408af44d221301cc85ed0f46cbe7dc0911e6f8be908f6fce38.exe	bc049a2dd0bd12408af44d221301cc85ed0f46cbe7dc0911e6f8be908f6fce38.exe
PID 3056 wrote to memory of 4040	3056	bc049a2dd0bd12408af44d221301cc85ed0f46cbe7dc0911e6f8be908f6fce38.exe	bc049a2dd0bd12408af44d221301cc85ed0f46cbe7dc0911e6f8be908f6fce38.exe
PID 3056 wrote to memory of 4040	3056	bc049a2dd0bd12408af44d221301cc85ed0f46cbe7dc0911e6f8be908f6fce38.exe	bc049a2dd0bd12408af44d221301cc85ed0f46cbe7dc0911e6f8be908f6fce38.exe
PID 3056 wrote to memory of 4040	3056	bc049a2dd0bd12408af44d221301cc85ed0f46cbe7dc0911e6f8be908f6fce38.exe	bc049a2dd0bd12408af44d221301cc85ed0f46cbe7dc0911e6f8be908f6fce38.exe
PID 3056 wrote to memory of 4040	3056	bc049a2dd0bd12408af44d221301cc85ed0f46cbe7dc0911e6f8be908f6fce38.exe	bc049a2dd0bd12408af44d221301cc85ed0f46cbe7dc0911e6f8be908f6fce38.exe

C:\Users\Admin\AppData\Local\Temp\bc049a2dd0bd12408af44d221301cc85ed0f46cbe7dc0911e6f8be908f6fce38.exe
"C:\Users\Admin\AppData\Local\Temp\bc049a2dd0bd12408af44d221301cc85ed0f46cbe7dc0911e6f8be908f6fce38.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3056

C:\Users\Admin\AppData\Local\Temp\bc049a2dd0bd12408af44d221301cc85ed0f46cbe7dc0911e6f8be908f6fce38.exe
"C:\Users\Admin\AppData\Local\Temp\bc049a2dd0bd12408af44d221301cc85ed0f46cbe7dc0911e6f8be908f6fce38.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3056-114-0x00000000005D0000-0x00000000005D1000-memory.dmp

Filesize
4KB

Download
memory/3056-116-0x0000000005550000-0x0000000005551000-memory.dmp

Filesize
4KB

Download
memory/3056-117-0x0000000005050000-0x0000000005051000-memory.dmp

Filesize
4KB

Download
memory/3056-118-0x0000000004FB0000-0x0000000004FB1000-memory.dmp

Filesize
4KB

Download
memory/3056-119-0x0000000005050000-0x000000000554E000-memory.dmp

Filesize
5.0MB

Download
memory/3056-120-0x0000000008740000-0x0000000008741000-memory.dmp

Filesize
4KB

Download
memory/3056-121-0x0000000005280000-0x0000000005288000-memory.dmp

Filesize
32KB

Download
memory/3056-122-0x00000000086A0000-0x00000000086A1000-memory.dmp

Filesize
4KB

Download
memory/3056-123-0x0000000006D30000-0x0000000006D8F000-memory.dmp

Filesize
380KB

Download
memory/4040-124-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4040-125-0x000000000041F170-mapping.dmp

Download
memory/4040-126-0x0000000001360000-0x0000000001680000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads