formbook | 91ced8ae239b6f99a6b15217769d96e5ebf2b2575dd9b9a3e1abd4269133a7cb

General

Target
wire swift copy.exe
Size 1.2MB
Sample220323-pb8a2aabar
SHA256 7f0e1d1ec3cedb0f7855a4d8a7b2fb3905c58c999604162fc669ca4aa361dd70
MD5 e49f2228be478c0adfd27fc6d103e733
SHA1 69d3e65e9b1476de013ec11cde3e740b9bc634a4
SHA512 93b54f3c6758f7a5cf8a2368459feeb6a228794ad7134f6d94315f397fb5fcaf655dc06c468ead4f118632694d9ab4c5b6a5143c4049b23486a8b806052418c7
MD5 SHA1 SHA512

Score

10^/10

formbook oto8 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

oto8

Decoy

thingssy.com
graufotografo.com
theartofimprovement.com
yukinokobanashi.com
i4cpm.com
khoavang.online
ktieman.com
picturebookoriginals.com
arucad.university
ellibrodesammy.com
managejabsurd.com
studyallenergy.com
easterndisposalobx.com
immoprivado.net
chuyusama.club
249521.com
metavgames.com
uvenux.xyz
servifluidoshs.com
tamyresethyago.com
windmillbusiness.com
bwde3q.com
streamcondos.com
totuillem.com
calo.solutions
beatricewoolf.com
itsycart.com
genietenhovori.com
mutoros.com
onzep.net
tiosamusa.com
tsmetaverse.com
archimetrica-bj.store
bacwheel.com
kasifler40.xyz
dev-illumidesk.com
tenloe073.xyz
mansnewz.com
bonneylakeapartments.com
stakephil.com
ddipdcbit.com
beautybysum.com
gy17fac.com
entrekindesign.com
marsfighter.com
slavkingvamp.com
xn--5mq97bs14c3se.xn--czru2d
camocoin88.com
consciousumbrella.com
betterwithsupplements.com
meueducard.com
oemlift.com
logodiseno.com
yanduy.com
themalayspecialist.com
basyz.com
miniliga.xyz
paramsachinshaleen.com
captainbenmaughan.com
life-easir.com
emmalion.com
i8sya366gkae.biz
soundsbrand.com
nestainternational.net
billionaireglobal.university

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

resource	yara_rule
behavioral1/memory/108-61-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/108-62-0x000000000041F1C0-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2016 set thread context of 108	2016	wire swift copy.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1072	108	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2016	wire swift copy.exe
2016	wire swift copy.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2016	wire swift copy.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 872	2016	wire swift copy.exe	27
PID 2016 wrote to memory of 872	2016	wire swift copy.exe	27
PID 2016 wrote to memory of 872	2016	wire swift copy.exe	27
PID 2016 wrote to memory of 872	2016	wire swift copy.exe	27
PID 2016 wrote to memory of 872	2016	wire swift copy.exe	27
PID 2016 wrote to memory of 872	2016	wire swift copy.exe	27
PID 2016 wrote to memory of 872	2016	wire swift copy.exe	27
PID 2016 wrote to memory of 108	2016	wire swift copy.exe	28
PID 2016 wrote to memory of 108	2016	wire swift copy.exe	28
PID 2016 wrote to memory of 108	2016	wire swift copy.exe	28
PID 2016 wrote to memory of 108	2016	wire swift copy.exe	28
PID 2016 wrote to memory of 108	2016	wire swift copy.exe	28
PID 2016 wrote to memory of 108	2016	wire swift copy.exe	28
PID 2016 wrote to memory of 108	2016	wire swift copy.exe	28
PID 2016 wrote to memory of 108	2016	wire swift copy.exe	28
PID 2016 wrote to memory of 108	2016	wire swift copy.exe	28
PID 2016 wrote to memory of 108	2016	wire swift copy.exe	28
PID 108 wrote to memory of 1072	108	RegSvcs.exe	29
PID 108 wrote to memory of 1072	108	RegSvcs.exe	29
PID 108 wrote to memory of 1072	108	RegSvcs.exe	29
PID 108 wrote to memory of 1072	108	RegSvcs.exe	29

C:\Users\Admin\AppData\Local\Temp\wire swift copy.exe
"C:\Users\Admin\AppData\Local\Temp\wire swift copy.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "{path}"
  2⤵
  PID:872
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "{path}"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:108
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 108 -s 36
    3⤵
    - Program crash
    PID:1072

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/108-58-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/108-59-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/108-61-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2016-54-0x0000000000EB0000-0x0000000000FF6000-memory.dmp

Download

memory/2016-55-0x00000000002A0000-0x00000000002AA000-memory.dmp

Download

memory/2016-56-0x00000000054C0000-0x0000000005548000-memory.dmp

Download

memory/2016-57-0x0000000000640000-0x0000000000674000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads