formbook | 201b2f41c62365df33280901cebbdefbd7bf70b35afe43d1a91f50e68c67e4d9

Analysis

max time kernel
157s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
07/06/2022, 09:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
042PRL1988.exe
Size 712KB
Sample220607-lch6radae2
SHA256 201b2f41c62365df33280901cebbdefbd7bf70b35afe43d1a91f50e68c67e4d9
MD5 fe39ac9725c175bb08f2564c62598864
SHA1 b099b99391f9184da265abe67fc20b588b32206f
SHA512 7cb20b8f9d82e7deb50779bcda1cd2736f2a1fa1c634aeb9c963296fe2ecd3bec94b149f4e468ff1217c89f781b273b6efbb4afc22f0a88eac38eb5a3c9e2355
MD5 SHA1 SHA512

Score

10^/10

formbook h06r rat spyware stealer suricata trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

h06r

Decoy

zhiguanchang6.com
allgoodsmoke.com
tunescrybe.com
galabet591.com
booster210569.biz
artyswarehouse.com
nhm0w.com
omnetgroup.com
moyp10.xyz
login-redirect-instagram.com
cupmes.xyz
jdbowers.com
esacertificate.net
buckedupdrinks.com
survivorshealthsecrets.com
heyuan07.xyz
axecaliburs.com
anjimodernjudy.com
crozx.com
capitaltexts.com
sweatdrips.com
danas-shoes.com
tms-web.net
vienners.com
littlecaesarsmenuprices.info
cg-rus.com
huftrad.site
kita-sehat.online
stablescores.com
beautybodyhaus.com
nhomkinhhanoi.biz
moomoomio.com
porn1332.xyz
baidu-space.com
ebucket.biz
platfix.info
induslux.com
spynose.cloud
foolball007.xyz
jnqczy.com
thisisdancecity.com
rabota-webcams.online
honestmoose.net
quicktargetmarketing.online
touchscreentest.net
mspforenterprise.com
melodywhitebeauty.com
parkeerzoeker.com
ykwia.net
tikviewsellers.com
belorin.com
launchpadusa.tech
accessbet.xyz
betking.site
deltadrivingacademy.com
gerardmartinezminguell.cat
mjsgja.xyz
inertia9.site
quackmail.xyz
sttitus.site
etorex.com
lcfet.com
zjs7333593apple.com
jsmmgo.com
ohyama-dc.net

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Formbook Payload 4 IoCs

rat

resource	yara_rule
behavioral2/memory/1032-138-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/1032-144-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/460-148-0x0000000000760000-0x000000000078F000-memory.dmp	formbook
behavioral2/memory/460-151-0x0000000000760000-0x000000000078F000-memory.dmp	formbook

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1208 set thread context of 1032	1208	042PRL1988.exe	80
PID 1032 set thread context of 1060	1032	042PRL1988.exe	29
PID 460 set thread context of 1060	460	help.exe	29

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
1208	042PRL1988.exe
1208	042PRL1988.exe
1032	042PRL1988.exe
1032	042PRL1988.exe
1032	042PRL1988.exe
1032	042PRL1988.exe
460	help.exe
460	help.exe
460	help.exe
460	help.exe
460	help.exe
460	help.exe
460	help.exe
460	help.exe
460	help.exe
460	help.exe
460	help.exe
460	help.exe
460	help.exe
460	help.exe
460	help.exe
460	help.exe
460	help.exe
460	help.exe
460	help.exe
460	help.exe
460	help.exe
460	help.exe
460	help.exe
460	help.exe
460	help.exe
460	help.exe
460	help.exe
460	help.exe
460	help.exe
460	help.exe
460	help.exe
460	help.exe
460	help.exe
460	help.exe
460	help.exe
460	help.exe
460	help.exe
460	help.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1060	Explorer.EXE

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
1032	042PRL1988.exe
1032	042PRL1988.exe
1032	042PRL1988.exe
460	help.exe
460	help.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1208	042PRL1988.exe
Token: SeDebugPrivilege	1032	042PRL1988.exe
Token: SeDebugPrivilege	460	help.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 564	1208	042PRL1988.exe	81
PID 1208 wrote to memory of 564	1208	042PRL1988.exe	81
PID 1208 wrote to memory of 564	1208	042PRL1988.exe	81
PID 1208 wrote to memory of 1032	1208	042PRL1988.exe	80
PID 1208 wrote to memory of 1032	1208	042PRL1988.exe	80
PID 1208 wrote to memory of 1032	1208	042PRL1988.exe	80
PID 1208 wrote to memory of 1032	1208	042PRL1988.exe	80
PID 1208 wrote to memory of 1032	1208	042PRL1988.exe	80
PID 1208 wrote to memory of 1032	1208	042PRL1988.exe	80
PID 1060 wrote to memory of 460	1060	Explorer.EXE	95
PID 1060 wrote to memory of 460	1060	Explorer.EXE	95
PID 1060 wrote to memory of 460	1060	Explorer.EXE	95
PID 460 wrote to memory of 2040	460	help.exe	97
PID 460 wrote to memory of 2040	460	help.exe	97
PID 460 wrote to memory of 2040	460	help.exe	97

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Users\Admin\AppData\Local\Temp\042PRL1988.exe
  "C:\Users\Admin\AppData\Local\Temp\042PRL1988.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1208
- - C:\Users\Admin\AppData\Local\Temp\042PRL1988.exe
    "C:\Users\Admin\AppData\Local\Temp\042PRL1988.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:1032
- - C:\Users\Admin\AppData\Local\Temp\042PRL1988.exe
    "C:\Users\Admin\AppData\Local\Temp\042PRL1988.exe"
    3⤵
    PID:564
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:2836
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:1340
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:780
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:3232
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:4700
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:4776
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:3312
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:2576
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:4280
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:4672
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:2272
- C:\Windows\SysWOW64\help.exe
  "C:\Windows\SysWOW64\help.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:460
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\042PRL1988.exe"
    3⤵
    PID:2040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/460-151-0x0000000000760000-0x000000000078F000-memory.dmp

Download

memory/460-149-0x0000000000F70000-0x0000000001004000-memory.dmp

Download

memory/460-147-0x0000000001070000-0x00000000013BA000-memory.dmp

Download

memory/460-148-0x0000000000760000-0x000000000078F000-memory.dmp

Download

memory/460-146-0x0000000000610000-0x0000000000617000-memory.dmp

Download

memory/1032-141-0x0000000001C70000-0x0000000001C85000-memory.dmp

Download

memory/1032-138-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1032-140-0x00000000018F0000-0x0000000001C3A000-memory.dmp

Download

memory/1032-144-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1060-152-0x0000000002C50000-0x0000000002D71000-memory.dmp

Download

memory/1060-142-0x0000000002760000-0x000000000282E000-memory.dmp

Download

memory/1060-150-0x0000000002C50000-0x0000000002D71000-memory.dmp

Download

memory/1208-133-0x0000000005620000-0x000000000562A000-memory.dmp

Download

memory/1208-134-0x0000000008D80000-0x0000000008E1C000-memory.dmp

Download

memory/1208-135-0x0000000009340000-0x00000000093A6000-memory.dmp

Download

memory/1208-132-0x0000000005460000-0x00000000054F2000-memory.dmp

Download

memory/1208-131-0x0000000005970000-0x0000000005F14000-memory.dmp

Download

memory/1208-130-0x0000000000A10000-0x0000000000AC8000-memory.dmp

Download