formbook | d1eddd348ee11e3da00c9f45fa1fb94e3b174c8abe780a7d764bd22f62980e8e

General

Target

ac889675aa282449205f31cd4f46f3d6.exe
Size

404KB
MD5

ac889675aa282449205f31cd4f46f3d6
SHA1

50115144e96337ed3bfe27480a82300002310400
SHA256

d1eddd348ee11e3da00c9f45fa1fb94e3b174c8abe780a7d764bd22f62980e8e
SHA512

3a32641a515063fa9d062fa78a778f5f05088707af2a431904c37a0d772145e02617a172be9a74fe65c64b4b3e3dcca82aedf351ccbc4bb5b22e29a0ad6742dd

Score

10^/10

formbook jy93 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

jy93

Decoy

alexito.space

shitsthebalm.com

margaritavillemelbourne.com

vonahk.xyz

1960lawn.com

augustacrim.com

bancopec.com

batrainingstudio.com

kokofleks.store

w4-form-irs.com

putnamob.com

mickeysmotors.com

8181yd.com

wedmecreation.com

mischianti.com

gskpop.com

douvip303.com

unlimitedlyfestylez.com

originophthalmics.com

oandazx86.xyz

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4328-122-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

ac889675aa282449205f31cd4f46f3d6.exe

description pid process target process

PID 3500 set thread context of 4328 3500 ac889675aa282449205f31cd4f46f3d6.exe ac889675aa282449205f31cd4f46f3d6.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

ac889675aa282449205f31cd4f46f3d6.exe

pid process

4328 ac889675aa282449205f31cd4f46f3d6.exe
4328 ac889675aa282449205f31cd4f46f3d6.exe

description	pid	process	target process
PID 3500 set thread context of 4328	3500	ac889675aa282449205f31cd4f46f3d6.exe	ac889675aa282449205f31cd4f46f3d6.exe

pid	process
4328	ac889675aa282449205f31cd4f46f3d6.exe
4328	ac889675aa282449205f31cd4f46f3d6.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

ac889675aa282449205f31cd4f46f3d6.exe

description	pid	process	target process
PID 3500 wrote to memory of 4328	3500	ac889675aa282449205f31cd4f46f3d6.exe	ac889675aa282449205f31cd4f46f3d6.exe
PID 3500 wrote to memory of 4328	3500	ac889675aa282449205f31cd4f46f3d6.exe	ac889675aa282449205f31cd4f46f3d6.exe
PID 3500 wrote to memory of 4328	3500	ac889675aa282449205f31cd4f46f3d6.exe	ac889675aa282449205f31cd4f46f3d6.exe
PID 3500 wrote to memory of 4328	3500	ac889675aa282449205f31cd4f46f3d6.exe	ac889675aa282449205f31cd4f46f3d6.exe
PID 3500 wrote to memory of 4328	3500	ac889675aa282449205f31cd4f46f3d6.exe	ac889675aa282449205f31cd4f46f3d6.exe
PID 3500 wrote to memory of 4328	3500	ac889675aa282449205f31cd4f46f3d6.exe	ac889675aa282449205f31cd4f46f3d6.exe

C:\Users\Admin\AppData\Local\Temp\ac889675aa282449205f31cd4f46f3d6.exe
"C:\Users\Admin\AppData\Local\Temp\ac889675aa282449205f31cd4f46f3d6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3500

C:\Users\Admin\AppData\Local\Temp\ac889675aa282449205f31cd4f46f3d6.exe
"C:\Users\Admin\AppData\Local\Temp\ac889675aa282449205f31cd4f46f3d6.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4328

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3500-114-0x00000000002D0000-0x000000000033C000-memory.dmp

Filesize
432KB

Download
memory/3500-115-0x00000000050F0000-0x00000000055EE000-memory.dmp

Filesize
5.0MB

Download
memory/3500-116-0x0000000004BF0000-0x0000000004C82000-memory.dmp

Filesize
584KB

Download
memory/3500-117-0x0000000004CE0000-0x0000000004CEA000-memory.dmp

Filesize
40KB

Download
memory/3500-118-0x0000000004DB0000-0x0000000004DBC000-memory.dmp

Filesize
48KB

Download
memory/3500-119-0x0000000004AF0000-0x0000000004B82000-memory.dmp

Filesize
584KB

Download
memory/3500-120-0x0000000006F80000-0x000000000701C000-memory.dmp

Filesize
624KB

Download
memory/3500-121-0x00000000070C0000-0x000000000712A000-memory.dmp

Filesize
424KB

Download
memory/4328-122-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4328-123-0x00000000016A0000-0x00000000019C0000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing