formbook | a9ee744d7181c80db0ffbabf36933b815cf8b731ad6fb920393fb325cdfce9cc

General

Target

a9ee744d7181c80db0ffbabf36933b815cf8b731ad6fb920393fb325cdfce9cc.exe
Size

537KB
MD5

9afab2ef4657edb330c16533e7829faa
SHA1

6bd646737538682c96b300e491a78f5f3744e1dc
SHA256

a9ee744d7181c80db0ffbabf36933b815cf8b731ad6fb920393fb325cdfce9cc
SHA512

1053273e2563fa452a57c939dba887215900c858407d637b8c11f1fd8595c5c479f2f6245a2052d2e0def575d87972070870578f07d83f1de53481d8e0fb861c

Score

10^/10

formbook d7ln rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

d7ln

Decoy

bulut-imza.com

gotastebuds.com

shutupmags.com

clocksport.com

toweryachtcounsel.com

kingcopier.com

pluspersona.com

inchallahe.com

unclonedconsulting.com

ccdt168.com

tonyzheng.xyz

voiceoftheepeople.com

cicapital.xyz

offxpro.com

loyatiproductions.com

makemebuystuff.com

incuba8labs.com

remparka.com

newstft.com

bgame.pro

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1900-126-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

a9ee744d7181c80db0ffbabf36933b815cf8b731ad6fb920393fb325cdfce9cc.exe

description	pid	process	target process
PID 2792 set thread context of 1900	2792	a9ee744d7181c80db0ffbabf36933b815cf8b731ad6fb920393fb325cdfce9cc.exe	a9ee744d7181c80db0ffbabf36933b815cf8b731ad6fb920393fb325cdfce9cc.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

a9ee744d7181c80db0ffbabf36933b815cf8b731ad6fb920393fb325cdfce9cc.exea9ee744d7181c80db0ffbabf36933b815cf8b731ad6fb920393fb325cdfce9cc.exe

pid	process
2792	a9ee744d7181c80db0ffbabf36933b815cf8b731ad6fb920393fb325cdfce9cc.exe
2792	a9ee744d7181c80db0ffbabf36933b815cf8b731ad6fb920393fb325cdfce9cc.exe
1900	a9ee744d7181c80db0ffbabf36933b815cf8b731ad6fb920393fb325cdfce9cc.exe
1900	a9ee744d7181c80db0ffbabf36933b815cf8b731ad6fb920393fb325cdfce9cc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a9ee744d7181c80db0ffbabf36933b815cf8b731ad6fb920393fb325cdfce9cc.exe

description pid process

Token: SeDebugPrivilege 2792 a9ee744d7181c80db0ffbabf36933b815cf8b731ad6fb920393fb325cdfce9cc.exe

description	pid	process
Token: SeDebugPrivilege	2792	a9ee744d7181c80db0ffbabf36933b815cf8b731ad6fb920393fb325cdfce9cc.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

a9ee744d7181c80db0ffbabf36933b815cf8b731ad6fb920393fb325cdfce9cc.exe

description	pid	process	target process
PID 2792 wrote to memory of 1676	2792	a9ee744d7181c80db0ffbabf36933b815cf8b731ad6fb920393fb325cdfce9cc.exe	a9ee744d7181c80db0ffbabf36933b815cf8b731ad6fb920393fb325cdfce9cc.exe
PID 2792 wrote to memory of 1676	2792	a9ee744d7181c80db0ffbabf36933b815cf8b731ad6fb920393fb325cdfce9cc.exe	a9ee744d7181c80db0ffbabf36933b815cf8b731ad6fb920393fb325cdfce9cc.exe
PID 2792 wrote to memory of 1676	2792	a9ee744d7181c80db0ffbabf36933b815cf8b731ad6fb920393fb325cdfce9cc.exe	a9ee744d7181c80db0ffbabf36933b815cf8b731ad6fb920393fb325cdfce9cc.exe
PID 2792 wrote to memory of 1900	2792	a9ee744d7181c80db0ffbabf36933b815cf8b731ad6fb920393fb325cdfce9cc.exe	a9ee744d7181c80db0ffbabf36933b815cf8b731ad6fb920393fb325cdfce9cc.exe
PID 2792 wrote to memory of 1900	2792	a9ee744d7181c80db0ffbabf36933b815cf8b731ad6fb920393fb325cdfce9cc.exe	a9ee744d7181c80db0ffbabf36933b815cf8b731ad6fb920393fb325cdfce9cc.exe
PID 2792 wrote to memory of 1900	2792	a9ee744d7181c80db0ffbabf36933b815cf8b731ad6fb920393fb325cdfce9cc.exe	a9ee744d7181c80db0ffbabf36933b815cf8b731ad6fb920393fb325cdfce9cc.exe
PID 2792 wrote to memory of 1900	2792	a9ee744d7181c80db0ffbabf36933b815cf8b731ad6fb920393fb325cdfce9cc.exe	a9ee744d7181c80db0ffbabf36933b815cf8b731ad6fb920393fb325cdfce9cc.exe
PID 2792 wrote to memory of 1900	2792	a9ee744d7181c80db0ffbabf36933b815cf8b731ad6fb920393fb325cdfce9cc.exe	a9ee744d7181c80db0ffbabf36933b815cf8b731ad6fb920393fb325cdfce9cc.exe
PID 2792 wrote to memory of 1900	2792	a9ee744d7181c80db0ffbabf36933b815cf8b731ad6fb920393fb325cdfce9cc.exe	a9ee744d7181c80db0ffbabf36933b815cf8b731ad6fb920393fb325cdfce9cc.exe

C:\Users\Admin\AppData\Local\Temp\a9ee744d7181c80db0ffbabf36933b815cf8b731ad6fb920393fb325cdfce9cc.exe
"C:\Users\Admin\AppData\Local\Temp\a9ee744d7181c80db0ffbabf36933b815cf8b731ad6fb920393fb325cdfce9cc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2792

C:\Users\Admin\AppData\Local\Temp\a9ee744d7181c80db0ffbabf36933b815cf8b731ad6fb920393fb325cdfce9cc.exe
"C:\Users\Admin\AppData\Local\Temp\a9ee744d7181c80db0ffbabf36933b815cf8b731ad6fb920393fb325cdfce9cc.exe"
2⤵
PID:1676

C:\Users\Admin\AppData\Local\Temp\a9ee744d7181c80db0ffbabf36933b815cf8b731ad6fb920393fb325cdfce9cc.exe
"C:\Users\Admin\AppData\Local\Temp\a9ee744d7181c80db0ffbabf36933b815cf8b731ad6fb920393fb325cdfce9cc.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1900

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1900-126-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1900-127-0x0000000001410000-0x0000000001730000-memory.dmp

Filesize
3.1MB

Download
memory/2792-118-0x0000000000BC0000-0x0000000000C4C000-memory.dmp

Filesize
560KB

Download
memory/2792-119-0x0000000005B00000-0x0000000005FFE000-memory.dmp

Filesize
5.0MB

Download
memory/2792-120-0x00000000054E0000-0x0000000005572000-memory.dmp

Filesize
584KB

Download
memory/2792-121-0x0000000005600000-0x0000000005AFE000-memory.dmp

Filesize
5.0MB

Download
memory/2792-122-0x0000000005480000-0x000000000548A000-memory.dmp

Filesize
40KB

Download
memory/2792-123-0x0000000005750000-0x0000000005764000-memory.dmp

Filesize
80KB

Download
memory/2792-124-0x0000000007CB0000-0x0000000007D4C000-memory.dmp

Filesize
624KB

Download
memory/2792-125-0x00000000011A0000-0x0000000001206000-memory.dmp

Filesize
408KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads