formbook | bf694c0a4856be7c6e88f8d018a2d3223b740f060e9c0f8da51df710c895860a

General

Target

4504b6bca11f1bb8cd7ee7f9695ae149.exe
Size

75KB
MD5

4504b6bca11f1bb8cd7ee7f9695ae149
SHA1

b4db331aff8b3f0af7bb85c62eee8cbf94a01242
SHA256

bf694c0a4856be7c6e88f8d018a2d3223b740f060e9c0f8da51df710c895860a
SHA512

f8edc6b9a704d7c2921c151e0057c0054cfdfbeee5f2a70553016dea89c2918825131d54d930d6594832484f7b8b5fc80416745de2a357b69f3abc2f4fcf5504

Score

10^/10

formbook s3s3 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

s3s3

Decoy

tvielotus.com

teesta.xyz

talentrecruitor.com

pamaungipb.com

xn--90ahkh6a6b8b.site

910carolina.com

toyotaecoyouth-dev.com

invetnables.com

gdexc.com

ssw168.com

householdmould.com

mqttradar.xyz

t333c.com

thepausestudio.com

evershedsutherlands.com

asbdataplus.com

preddylilthingz.com

jepwu.com

tvlido.com

artovus.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1980-61-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1980-62-0x000000000041F110-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

4504b6bca11f1bb8cd7ee7f9695ae149.exe

description pid process target process

PID 1428 set thread context of 1980 1428 4504b6bca11f1bb8cd7ee7f9695ae149.exe 4504b6bca11f1bb8cd7ee7f9695ae149.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

4504b6bca11f1bb8cd7ee7f9695ae149.exe4504b6bca11f1bb8cd7ee7f9695ae149.exe

pid process

1428 4504b6bca11f1bb8cd7ee7f9695ae149.exe
1980 4504b6bca11f1bb8cd7ee7f9695ae149.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

4504b6bca11f1bb8cd7ee7f9695ae149.exe

description pid process

Token: SeDebugPrivilege 1428 4504b6bca11f1bb8cd7ee7f9695ae149.exe

description	pid	process	target process
PID 1428 set thread context of 1980	1428	4504b6bca11f1bb8cd7ee7f9695ae149.exe	4504b6bca11f1bb8cd7ee7f9695ae149.exe

pid	process
1428	4504b6bca11f1bb8cd7ee7f9695ae149.exe
1980	4504b6bca11f1bb8cd7ee7f9695ae149.exe

description	pid	process
Token: SeDebugPrivilege	1428	4504b6bca11f1bb8cd7ee7f9695ae149.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

4504b6bca11f1bb8cd7ee7f9695ae149.exe

description	pid	process	target process
PID 1428 wrote to memory of 1980	1428	4504b6bca11f1bb8cd7ee7f9695ae149.exe	4504b6bca11f1bb8cd7ee7f9695ae149.exe
PID 1428 wrote to memory of 1980	1428	4504b6bca11f1bb8cd7ee7f9695ae149.exe	4504b6bca11f1bb8cd7ee7f9695ae149.exe
PID 1428 wrote to memory of 1980	1428	4504b6bca11f1bb8cd7ee7f9695ae149.exe	4504b6bca11f1bb8cd7ee7f9695ae149.exe
PID 1428 wrote to memory of 1980	1428	4504b6bca11f1bb8cd7ee7f9695ae149.exe	4504b6bca11f1bb8cd7ee7f9695ae149.exe
PID 1428 wrote to memory of 1980	1428	4504b6bca11f1bb8cd7ee7f9695ae149.exe	4504b6bca11f1bb8cd7ee7f9695ae149.exe
PID 1428 wrote to memory of 1980	1428	4504b6bca11f1bb8cd7ee7f9695ae149.exe	4504b6bca11f1bb8cd7ee7f9695ae149.exe
PID 1428 wrote to memory of 1980	1428	4504b6bca11f1bb8cd7ee7f9695ae149.exe	4504b6bca11f1bb8cd7ee7f9695ae149.exe

C:\Users\Admin\AppData\Local\Temp\4504b6bca11f1bb8cd7ee7f9695ae149.exe
"C:\Users\Admin\AppData\Local\Temp\4504b6bca11f1bb8cd7ee7f9695ae149.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1428

C:\Users\Admin\AppData\Local\Temp\4504b6bca11f1bb8cd7ee7f9695ae149.exe
C:\Users\Admin\AppData\Local\Temp\4504b6bca11f1bb8cd7ee7f9695ae149.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1428-54-0x00000000013A0000-0x00000000013B8000-memory.dmp

Filesize
96KB

Download
memory/1428-55-0x0000000076391000-0x0000000076393000-memory.dmp

Filesize
8KB

Download
memory/1428-56-0x00000000053A0000-0x0000000005446000-memory.dmp

Filesize
664KB

Download
memory/1428-57-0x0000000000B70000-0x0000000000BBC000-memory.dmp

Filesize
304KB

Download
memory/1980-58-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1980-59-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1980-61-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1980-62-0x000000000041F110-mapping.dmp

Download
memory/1980-63-0x0000000000900000-0x0000000000C03000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing