formbook | c6e101b1f3ef37505f4cae99303735cdbc09b0ef4f33f1d3f27742722e8276b4

General

Target

fd4fde74267b1f08dc0588a66481f230.exe
Size

841KB
MD5

fd4fde74267b1f08dc0588a66481f230
SHA1

f029ca51857e6fe326e6a6a573afadf9bdfcee9f
SHA256

c6e101b1f3ef37505f4cae99303735cdbc09b0ef4f33f1d3f27742722e8276b4
SHA512

0e1b6335a3e69f7009e1445fe28c398e47fa94e6151a5c1d475bc488b41a2feafc940010bb91cab098cdf9b4a755c09f7ca9294cd406dae9c971d65eac5ba8a3

Score

10^/10

formbook bt33 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

bt33

Decoy

mbaonlinefreedegress.info

myforevermaid.com

daoyi365.com

weientm.com

legal-mx.com

formationrigging.com

heidiet.xyz

school-prosto.store

healthvitaminnutrition.com

digitalsolutionusa.com

little-bazar.com

jnbeautycanada.com

optoelek.com

learntoairmail.com

hawkminer.com

kingofearth.love

ktnstay.xyz

zouxin.love

mainlandpr.com

mamm-hummel.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/432-61-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

fd4fde74267b1f08dc0588a66481f230.exe

description pid process target process

PID 1632 set thread context of 432 1632 fd4fde74267b1f08dc0588a66481f230.exe fd4fde74267b1f08dc0588a66481f230.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

fd4fde74267b1f08dc0588a66481f230.exe

pid process

432 fd4fde74267b1f08dc0588a66481f230.exe

description	pid	process	target process
PID 1632 set thread context of 432	1632	fd4fde74267b1f08dc0588a66481f230.exe	fd4fde74267b1f08dc0588a66481f230.exe

pid	process
432	fd4fde74267b1f08dc0588a66481f230.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

fd4fde74267b1f08dc0588a66481f230.exe

description	pid	process	target process
PID 1632 wrote to memory of 432	1632	fd4fde74267b1f08dc0588a66481f230.exe	fd4fde74267b1f08dc0588a66481f230.exe
PID 1632 wrote to memory of 432	1632	fd4fde74267b1f08dc0588a66481f230.exe	fd4fde74267b1f08dc0588a66481f230.exe
PID 1632 wrote to memory of 432	1632	fd4fde74267b1f08dc0588a66481f230.exe	fd4fde74267b1f08dc0588a66481f230.exe
PID 1632 wrote to memory of 432	1632	fd4fde74267b1f08dc0588a66481f230.exe	fd4fde74267b1f08dc0588a66481f230.exe
PID 1632 wrote to memory of 432	1632	fd4fde74267b1f08dc0588a66481f230.exe	fd4fde74267b1f08dc0588a66481f230.exe
PID 1632 wrote to memory of 432	1632	fd4fde74267b1f08dc0588a66481f230.exe	fd4fde74267b1f08dc0588a66481f230.exe
PID 1632 wrote to memory of 432	1632	fd4fde74267b1f08dc0588a66481f230.exe	fd4fde74267b1f08dc0588a66481f230.exe

C:\Users\Admin\AppData\Local\Temp\fd4fde74267b1f08dc0588a66481f230.exe
"C:\Users\Admin\AppData\Local\Temp\fd4fde74267b1f08dc0588a66481f230.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1632

C:\Users\Admin\AppData\Local\Temp\fd4fde74267b1f08dc0588a66481f230.exe
"C:\Users\Admin\AppData\Local\Temp\fd4fde74267b1f08dc0588a66481f230.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:432

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/432-59-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/432-60-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/432-61-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/432-62-0x0000000000A60000-0x0000000000D63000-memory.dmp

Filesize
3.0MB

Download
memory/1632-54-0x0000000000980000-0x0000000000A5A000-memory.dmp

Filesize
872KB

Download
memory/1632-55-0x0000000075801000-0x0000000075803000-memory.dmp

Filesize
8KB

Download
memory/1632-56-0x0000000004F80000-0x0000000004F81000-memory.dmp

Filesize
4KB

Download
memory/1632-57-0x00000000004C0000-0x00000000004CC000-memory.dmp

Filesize
48KB

Download
memory/1632-58-0x0000000005490000-0x00000000054FA000-memory.dmp

Filesize
424KB

Download

Analysis

Sharing