formbook | a9ee744d7181c80db0ffbabf36933b815cf8b731ad6fb920393fb325cdfce9cc

General

Target

9afab2ef4657edb330c16533e7829faa.exe
Size

537KB
MD5

9afab2ef4657edb330c16533e7829faa
SHA1

6bd646737538682c96b300e491a78f5f3744e1dc
SHA256

a9ee744d7181c80db0ffbabf36933b815cf8b731ad6fb920393fb325cdfce9cc
SHA512

1053273e2563fa452a57c939dba887215900c858407d637b8c11f1fd8595c5c479f2f6245a2052d2e0def575d87972070870578f07d83f1de53481d8e0fb861c

Score

10^/10

formbook d7ln rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

d7ln

Decoy

bulut-imza.com

gotastebuds.com

shutupmags.com

clocksport.com

toweryachtcounsel.com

kingcopier.com

pluspersona.com

inchallahe.com

unclonedconsulting.com

ccdt168.com

tonyzheng.xyz

voiceoftheepeople.com

cicapital.xyz

offxpro.com

loyatiproductions.com

makemebuystuff.com

incuba8labs.com

remparka.com

newstft.com

bgame.pro

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1644-62-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

9afab2ef4657edb330c16533e7829faa.exe

description pid process target process

PID 1704 set thread context of 1644 1704 9afab2ef4657edb330c16533e7829faa.exe 9afab2ef4657edb330c16533e7829faa.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

9afab2ef4657edb330c16533e7829faa.exe

pid process

1644 9afab2ef4657edb330c16533e7829faa.exe

description	pid	process	target process
PID 1704 set thread context of 1644	1704	9afab2ef4657edb330c16533e7829faa.exe	9afab2ef4657edb330c16533e7829faa.exe

pid	process
1644	9afab2ef4657edb330c16533e7829faa.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

9afab2ef4657edb330c16533e7829faa.exe

description	pid	process	target process
PID 1704 wrote to memory of 1644	1704	9afab2ef4657edb330c16533e7829faa.exe	9afab2ef4657edb330c16533e7829faa.exe
PID 1704 wrote to memory of 1644	1704	9afab2ef4657edb330c16533e7829faa.exe	9afab2ef4657edb330c16533e7829faa.exe
PID 1704 wrote to memory of 1644	1704	9afab2ef4657edb330c16533e7829faa.exe	9afab2ef4657edb330c16533e7829faa.exe
PID 1704 wrote to memory of 1644	1704	9afab2ef4657edb330c16533e7829faa.exe	9afab2ef4657edb330c16533e7829faa.exe
PID 1704 wrote to memory of 1644	1704	9afab2ef4657edb330c16533e7829faa.exe	9afab2ef4657edb330c16533e7829faa.exe
PID 1704 wrote to memory of 1644	1704	9afab2ef4657edb330c16533e7829faa.exe	9afab2ef4657edb330c16533e7829faa.exe
PID 1704 wrote to memory of 1644	1704	9afab2ef4657edb330c16533e7829faa.exe	9afab2ef4657edb330c16533e7829faa.exe

C:\Users\Admin\AppData\Local\Temp\9afab2ef4657edb330c16533e7829faa.exe
"C:\Users\Admin\AppData\Local\Temp\9afab2ef4657edb330c16533e7829faa.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1704

C:\Users\Admin\AppData\Local\Temp\9afab2ef4657edb330c16533e7829faa.exe
"C:\Users\Admin\AppData\Local\Temp\9afab2ef4657edb330c16533e7829faa.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1644

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1644-60-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1644-61-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1644-62-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1644-63-0x0000000000B10000-0x0000000000E13000-memory.dmp

Filesize
3.0MB

Download
memory/1704-55-0x00000000008F0000-0x000000000097C000-memory.dmp

Filesize
560KB

Download
memory/1704-56-0x0000000075F91000-0x0000000075F93000-memory.dmp

Filesize
8KB

Download
memory/1704-57-0x00000000046E0000-0x00000000046E1000-memory.dmp

Filesize
4KB

Download
memory/1704-58-0x0000000000410000-0x0000000000424000-memory.dmp

Filesize
80KB

Download
memory/1704-59-0x0000000004240000-0x00000000042A6000-memory.dmp

Filesize
408KB

Download

Analysis

Sharing