formbook | 241937fdff6aeae4c5a60bc707c331504d4b5c8df13b97ddd2e8da2107978f0e

General

Target

PI 46788393.exe
Size

530KB
MD5

1365ef23d6453fbc22a28ee56bec858b
SHA1

c3f1def4b65bc427e791d2e285beadf5b0dfc654
SHA256

773fbca16ec67d4820654e39aaa65645f8608a8f7186f12b5ed62498ff1334c6
SHA512

35aff0f520f713c53420644f3fb92e6037614691934939781299e1350dd290b92ed4c7d1b8e7aa4ac164b9d1ffbde98838740e0ec4ce2798b93b45d44c2b6592

Score

10^/10

formbook q5e rat spyware stealer suricata trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

q5e

Decoy

2177.ltd

thanxiety.com

max-width.com

fixti.net

mostmaj.com

mobilteknolojiuzmani.com

historyannals.com

wheelchairmotion.com

mossandmoonstonestudio.com

kastellifournis.com

axokey.net

peekl.com

metsteeshirt.com

abcfinancial-inc.com

btxrsp.com

amydh.com

ccoauthority.com

lumacorretora.com

kimfelixrealtor.com

iconext.biz

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Formbook Payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1152-59-0x0000000000400000-0x000000000042D000-memory.dmp	formbook
behavioral1/memory/1152-60-0x000000000041E2A0-mapping.dmp	formbook
behavioral1/memory/1152-62-0x0000000000400000-0x000000000042D000-memory.dmp	formbook
behavioral1/memory/2024-69-0x00000000001C0000-0x00000000001ED000-memory.dmp	formbook

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1096 cmd.exe

pid	process
1096	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

PI 46788393.exePI 46788393.exenetsh.exe

description	pid	process	target process
PID 1040 set thread context of 1152	1040	PI 46788393.exe	PI 46788393.exe
PID 1152 set thread context of 1196	1152	PI 46788393.exe	Explorer.EXE
PID 2024 set thread context of 1196	2024	netsh.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

PI 46788393.exenetsh.exe

pid	process
1152	PI 46788393.exe
1152	PI 46788393.exe
2024	netsh.exe
2024	netsh.exe
2024	netsh.exe
2024	netsh.exe
2024	netsh.exe
2024	netsh.exe
2024	netsh.exe
2024	netsh.exe
2024	netsh.exe
2024	netsh.exe
2024	netsh.exe
2024	netsh.exe
2024	netsh.exe
2024	netsh.exe

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

PI 46788393.exenetsh.exe

pid process

1152 PI 46788393.exe
1152 PI 46788393.exe
1152 PI 46788393.exe
2024 netsh.exe
2024 netsh.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

PI 46788393.exenetsh.exe

description pid process

Token: SeDebugPrivilege 1152 PI 46788393.exe
Token: SeDebugPrivilege 2024 netsh.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1196 Explorer.EXE
1196 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1196 Explorer.EXE
1196 Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	1152	PI 46788393.exe
Token: SeDebugPrivilege	2024	netsh.exe

pid	process
1196	Explorer.EXE
1196	Explorer.EXE

pid	process
1196	Explorer.EXE
1196	Explorer.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

PI 46788393.exeExplorer.EXEnetsh.exe

description	pid	process	target process
PID 1040 wrote to memory of 1152	1040	PI 46788393.exe	PI 46788393.exe
PID 1040 wrote to memory of 1152	1040	PI 46788393.exe	PI 46788393.exe
PID 1040 wrote to memory of 1152	1040	PI 46788393.exe	PI 46788393.exe
PID 1040 wrote to memory of 1152	1040	PI 46788393.exe	PI 46788393.exe
PID 1040 wrote to memory of 1152	1040	PI 46788393.exe	PI 46788393.exe
PID 1040 wrote to memory of 1152	1040	PI 46788393.exe	PI 46788393.exe
PID 1040 wrote to memory of 1152	1040	PI 46788393.exe	PI 46788393.exe
PID 1196 wrote to memory of 2024	1196	Explorer.EXE	netsh.exe
PID 1196 wrote to memory of 2024	1196	Explorer.EXE	netsh.exe
PID 1196 wrote to memory of 2024	1196	Explorer.EXE	netsh.exe
PID 1196 wrote to memory of 2024	1196	Explorer.EXE	netsh.exe
PID 2024 wrote to memory of 1096	2024	netsh.exe	cmd.exe
PID 2024 wrote to memory of 1096	2024	netsh.exe	cmd.exe
PID 2024 wrote to memory of 1096	2024	netsh.exe	cmd.exe
PID 2024 wrote to memory of 1096	2024	netsh.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1196

C:\Users\Admin\AppData\Local\Temp\PI 46788393.exe
"C:\Users\Admin\AppData\Local\Temp\PI 46788393.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1040

C:\Users\Admin\AppData\Local\Temp\PI 46788393.exe
"{path}"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1152

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\SysWOW64\netsh.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2024

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\PI 46788393.exe"
3⤵
- Deletes itself
PID:1096

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1040-54-0x0000000076811000-0x0000000076813000-memory.dmp

Filesize
8KB

Download
memory/1040-55-0x00000000748C0000-0x0000000074E6B000-memory.dmp

Filesize
5.7MB

Download
memory/1096-67-0x0000000000000000-mapping.dmp

Download
memory/1152-64-0x00000000001E0000-0x00000000001F4000-memory.dmp

Filesize
80KB

Download
memory/1152-60-0x000000000041E2A0-mapping.dmp

Download
memory/1152-62-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1152-63-0x0000000000C90000-0x0000000000F93000-memory.dmp

Filesize
3.0MB

Download
memory/1152-57-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1152-59-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1152-56-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1196-72-0x00000000047D0000-0x000000000486E000-memory.dmp

Filesize
632KB

Download
memory/1196-65-0x0000000004E40000-0x0000000004FD1000-memory.dmp

Filesize
1.6MB

Download
memory/2024-66-0x0000000000000000-mapping.dmp

Download
memory/2024-69-0x00000000001C0000-0x00000000001ED000-memory.dmp

Filesize
180KB

Download
memory/2024-70-0x00000000021D0000-0x00000000024D3000-memory.dmp

Filesize
3.0MB

Download
memory/2024-71-0x00000000009C0000-0x0000000000A53000-memory.dmp

Filesize
588KB

Download
memory/2024-68-0x0000000000DB0000-0x0000000000DCB000-memory.dmp

Filesize
108KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads