formbook | 133ae28bce4d3af3eaf5c07b5e9f3174db465afcf33693a4382f8798d1e9e62d

General

Target

133ae28bce4d3af3eaf5c07b5e9f3174db465afcf33693a4382f8798d1e9e62d.exe
Size

456KB
MD5

4d338da1a2c3facd8a4eb70c2ff76791
SHA1

168ee5eddcd1e5f0c75d21860e68833eba0ef3e5
SHA256

133ae28bce4d3af3eaf5c07b5e9f3174db465afcf33693a4382f8798d1e9e62d
SHA512

cfa69717296e87fb67e745d8c3a468418bd0d9ba988f0bb078954bb4284c0452b95a4ef7067b730d37c81322ee68240be03ed3130338e11f98e19f6d064d126a

Score

10^/10

formbook private rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

3.1

Campaign

private

Decoy

hyeyumplus.com

amananature.com

anhuixinshang.com

wxxfaeyfi.biz

wwwitb18.com

fanshu365.com

xxh333666.com

xn--kcr98bq47b.com

opnfi.com

shekblog.com

hurricanehelpcenter.com

qdqtsw.com

videojos.online

seguir.link

webstudio-friendly.com

vacationrentalsofthedessert.com

ccdhxxzx.com

kaihangtools.com

jl.link

teesncaps.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1128-58-0x0000000000000000-mapping.dmp	formbook
behavioral1/memory/1128-60-0x0000000000400000-0x0000000000428000-memory.dmp	formbook

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

133ae28bce4d3af3eaf5c07b5e9f3174db465afcf33693a4382f8798d1e9e62d.exe

pid process

1128 133ae28bce4d3af3eaf5c07b5e9f3174db465afcf33693a4382f8798d1e9e62d.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

133ae28bce4d3af3eaf5c07b5e9f3174db465afcf33693a4382f8798d1e9e62d.exe

pid process

1372 133ae28bce4d3af3eaf5c07b5e9f3174db465afcf33693a4382f8798d1e9e62d.exe

pid	process
1128	133ae28bce4d3af3eaf5c07b5e9f3174db465afcf33693a4382f8798d1e9e62d.exe

pid	process
1372	133ae28bce4d3af3eaf5c07b5e9f3174db465afcf33693a4382f8798d1e9e62d.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

133ae28bce4d3af3eaf5c07b5e9f3174db465afcf33693a4382f8798d1e9e62d.exe

description	pid	process	target process
PID 1372 wrote to memory of 1128	1372	133ae28bce4d3af3eaf5c07b5e9f3174db465afcf33693a4382f8798d1e9e62d.exe	133ae28bce4d3af3eaf5c07b5e9f3174db465afcf33693a4382f8798d1e9e62d.exe
PID 1372 wrote to memory of 1128	1372	133ae28bce4d3af3eaf5c07b5e9f3174db465afcf33693a4382f8798d1e9e62d.exe	133ae28bce4d3af3eaf5c07b5e9f3174db465afcf33693a4382f8798d1e9e62d.exe
PID 1372 wrote to memory of 1128	1372	133ae28bce4d3af3eaf5c07b5e9f3174db465afcf33693a4382f8798d1e9e62d.exe	133ae28bce4d3af3eaf5c07b5e9f3174db465afcf33693a4382f8798d1e9e62d.exe
PID 1372 wrote to memory of 1128	1372	133ae28bce4d3af3eaf5c07b5e9f3174db465afcf33693a4382f8798d1e9e62d.exe	133ae28bce4d3af3eaf5c07b5e9f3174db465afcf33693a4382f8798d1e9e62d.exe
PID 1372 wrote to memory of 1128	1372	133ae28bce4d3af3eaf5c07b5e9f3174db465afcf33693a4382f8798d1e9e62d.exe	133ae28bce4d3af3eaf5c07b5e9f3174db465afcf33693a4382f8798d1e9e62d.exe
PID 1372 wrote to memory of 1128	1372	133ae28bce4d3af3eaf5c07b5e9f3174db465afcf33693a4382f8798d1e9e62d.exe	133ae28bce4d3af3eaf5c07b5e9f3174db465afcf33693a4382f8798d1e9e62d.exe
PID 1372 wrote to memory of 1128	1372	133ae28bce4d3af3eaf5c07b5e9f3174db465afcf33693a4382f8798d1e9e62d.exe	133ae28bce4d3af3eaf5c07b5e9f3174db465afcf33693a4382f8798d1e9e62d.exe
PID 1372 wrote to memory of 1128	1372	133ae28bce4d3af3eaf5c07b5e9f3174db465afcf33693a4382f8798d1e9e62d.exe	133ae28bce4d3af3eaf5c07b5e9f3174db465afcf33693a4382f8798d1e9e62d.exe
PID 1372 wrote to memory of 1128	1372	133ae28bce4d3af3eaf5c07b5e9f3174db465afcf33693a4382f8798d1e9e62d.exe	133ae28bce4d3af3eaf5c07b5e9f3174db465afcf33693a4382f8798d1e9e62d.exe
PID 1372 wrote to memory of 1128	1372	133ae28bce4d3af3eaf5c07b5e9f3174db465afcf33693a4382f8798d1e9e62d.exe	133ae28bce4d3af3eaf5c07b5e9f3174db465afcf33693a4382f8798d1e9e62d.exe
PID 1372 wrote to memory of 1128	1372	133ae28bce4d3af3eaf5c07b5e9f3174db465afcf33693a4382f8798d1e9e62d.exe	133ae28bce4d3af3eaf5c07b5e9f3174db465afcf33693a4382f8798d1e9e62d.exe
PID 1372 wrote to memory of 1128	1372	133ae28bce4d3af3eaf5c07b5e9f3174db465afcf33693a4382f8798d1e9e62d.exe	133ae28bce4d3af3eaf5c07b5e9f3174db465afcf33693a4382f8798d1e9e62d.exe
PID 1372 wrote to memory of 1128	1372	133ae28bce4d3af3eaf5c07b5e9f3174db465afcf33693a4382f8798d1e9e62d.exe	133ae28bce4d3af3eaf5c07b5e9f3174db465afcf33693a4382f8798d1e9e62d.exe

C:\Users\Admin\AppData\Local\Temp\133ae28bce4d3af3eaf5c07b5e9f3174db465afcf33693a4382f8798d1e9e62d.exe
"C:\Users\Admin\AppData\Local\Temp\133ae28bce4d3af3eaf5c07b5e9f3174db465afcf33693a4382f8798d1e9e62d.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1372

C:\Users\Admin\AppData\Local\Temp\133ae28bce4d3af3eaf5c07b5e9f3174db465afcf33693a4382f8798d1e9e62d.exe
"C:\Users\Admin\AppData\Local\Temp\133ae28bce4d3af3eaf5c07b5e9f3174db465afcf33693a4382f8798d1e9e62d.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1128

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1128-58-0x0000000000000000-mapping.dmp

Download
memory/1128-60-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1128-61-0x00000000008F0000-0x0000000000BF3000-memory.dmp

Filesize
3.0MB

Download
memory/1372-56-0x00000000002F0000-0x00000000002F7000-memory.dmp

Filesize
28KB

Download
memory/1372-57-0x0000000075B71000-0x0000000075B73000-memory.dmp

Filesize
8KB

Download
memory/1372-59-0x00000000002F0000-0x00000000002F7000-memory.dmp

Filesize
28KB

Download

Analysis

Sharing