formbook | 95e46bda24b5240f0ee2c70793709836c568d27da06b7393c7ed5cb4d5f4d888

General

Target

95e46bda24b5240f0ee2c70793709836c568d27da06b7393c7ed5cb4d5f4d888.exe
Size

727KB
MD5

0d435fc2005ce7e69f850cc3e57712e3
SHA1

abf6796e578328c841042a14fe58300733fd0556
SHA256

95e46bda24b5240f0ee2c70793709836c568d27da06b7393c7ed5cb4d5f4d888
SHA512

598426ab19450153c68abbda02755849d9bfc741a3d370501c95fc9c913d626f9e118c5852045a331b1d4aeef20ba9d811b328a4e2a0bf84c1c414bb3b79f756

Score

10^/10

formbook gae rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

gae

Decoy

haolexin.com

mediatradeprofiles.com

336540.com

khive.team

itbossinc.com

appantoniojoin.com

fleetalfa.com

szwrites.com

developistanbul.com

harrybuyshomes4fastcash.com

homelandmarkets.com

911directpp.com

bipocamerica.com

imperialdesignonline.com

covid-19tablets.info

tutorquranonline.com

dataaisummit.com

learn-interviewskills.com

trijayatekniktama.com

bulbalabs.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/960-60-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/960-61-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/960-62-0x000000000041ED50-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 920 set thread context of 960	920	95e46bda24b5240f0ee2c70793709836c568d27da06b7393c7ed5cb4d5f4d888.exe	27

Program crash 1 IoCs

pid	pid_target	Process	procid_target
908	960	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	920	95e46bda24b5240f0ee2c70793709836c568d27da06b7393c7ed5cb4d5f4d888.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 920 wrote to memory of 960	920	95e46bda24b5240f0ee2c70793709836c568d27da06b7393c7ed5cb4d5f4d888.exe	27
PID 920 wrote to memory of 960	920	95e46bda24b5240f0ee2c70793709836c568d27da06b7393c7ed5cb4d5f4d888.exe	27
PID 920 wrote to memory of 960	920	95e46bda24b5240f0ee2c70793709836c568d27da06b7393c7ed5cb4d5f4d888.exe	27
PID 920 wrote to memory of 960	920	95e46bda24b5240f0ee2c70793709836c568d27da06b7393c7ed5cb4d5f4d888.exe	27
PID 920 wrote to memory of 960	920	95e46bda24b5240f0ee2c70793709836c568d27da06b7393c7ed5cb4d5f4d888.exe	27
PID 920 wrote to memory of 960	920	95e46bda24b5240f0ee2c70793709836c568d27da06b7393c7ed5cb4d5f4d888.exe	27
PID 920 wrote to memory of 960	920	95e46bda24b5240f0ee2c70793709836c568d27da06b7393c7ed5cb4d5f4d888.exe	27
PID 920 wrote to memory of 960	920	95e46bda24b5240f0ee2c70793709836c568d27da06b7393c7ed5cb4d5f4d888.exe	27
PID 960 wrote to memory of 908	960	95e46bda24b5240f0ee2c70793709836c568d27da06b7393c7ed5cb4d5f4d888.exe	28
PID 960 wrote to memory of 908	960	95e46bda24b5240f0ee2c70793709836c568d27da06b7393c7ed5cb4d5f4d888.exe	28
PID 960 wrote to memory of 908	960	95e46bda24b5240f0ee2c70793709836c568d27da06b7393c7ed5cb4d5f4d888.exe	28
PID 960 wrote to memory of 908	960	95e46bda24b5240f0ee2c70793709836c568d27da06b7393c7ed5cb4d5f4d888.exe	28

C:\Users\Admin\AppData\Local\Temp\95e46bda24b5240f0ee2c70793709836c568d27da06b7393c7ed5cb4d5f4d888.exe
"C:\Users\Admin\AppData\Local\Temp\95e46bda24b5240f0ee2c70793709836c568d27da06b7393c7ed5cb4d5f4d888.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:920
- C:\Users\Admin\AppData\Local\Temp\95e46bda24b5240f0ee2c70793709836c568d27da06b7393c7ed5cb4d5f4d888.exe
  "{path}"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:960
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 960 -s 36
    3⤵
    - Program crash
    PID:908

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/920-54-0x0000000000DE0000-0x0000000000E9C000-memory.dmp

Filesize
752KB

Download
memory/920-55-0x0000000000500000-0x000000000051C000-memory.dmp

Filesize
112KB

Download
memory/920-56-0x0000000004980000-0x00000000049DE000-memory.dmp

Filesize
376KB

Download
memory/960-57-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/960-58-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/960-60-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/960-61-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing