formbook | 4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3

General

Target

4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe
Size

660KB
MD5

c2354b14ee0277fa1796f55b5a11b9eb
SHA1

69c1bdad6cc3eeebee5b03d404a83c4ee82111ec
SHA256

4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3
SHA512

201be588b817203ceccb70d1c6e2a1ddf4c689c95f72928fe32f404d3bf1a08753d95944a4f58ac69ded3e30b40211fcf828a6fc178181388455a299d6eba962

Score

10^/10

formbook sh rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

3.8

Campaign

sh

Decoy

westoffice.net

open-sgi.info

night-club.online

tv17404.info

0472game.com

haberlerim.net

my-web.net

360almeria.com

healthyair.cymru

anxietysupresant.info

domainprodssl1309test.com

tolgakorkmaz.com

laklapos.com

4y978g.info

entitydatabase.info

jese52.party

redstarnepal.com

internationaldrugdiscovery.com

crafting.solutions

lecodedumariage.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1980-58-0x0000000000000000-mapping.dmp	formbook
behavioral1/memory/1980-60-0x0000000000400000-0x000000000042A000-memory.dmp	formbook

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe

pid process

1980 4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe

pid process

824 4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe

pid	process
1980	4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe

pid	process
824	4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe

description	pid	process	target process
PID 824 wrote to memory of 1980	824	4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe	4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe
PID 824 wrote to memory of 1980	824	4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe	4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe
PID 824 wrote to memory of 1980	824	4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe	4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe
PID 824 wrote to memory of 1980	824	4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe	4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe
PID 824 wrote to memory of 1980	824	4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe	4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe
PID 824 wrote to memory of 1980	824	4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe	4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe
PID 824 wrote to memory of 1980	824	4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe	4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe
PID 824 wrote to memory of 1980	824	4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe	4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe
PID 824 wrote to memory of 1980	824	4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe	4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe
PID 824 wrote to memory of 1980	824	4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe	4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe
PID 824 wrote to memory of 1980	824	4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe	4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe
PID 824 wrote to memory of 1980	824	4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe	4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe
PID 824 wrote to memory of 1980	824	4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe	4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe

C:\Users\Admin\AppData\Local\Temp\4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe
"C:\Users\Admin\AppData\Local\Temp\4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:824

C:\Users\Admin\AppData\Local\Temp\4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe
"C:\Users\Admin\AppData\Local\Temp\4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1980

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/824-56-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/824-57-0x0000000075741000-0x0000000075743000-memory.dmp

Filesize
8KB

Download
memory/824-59-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/1980-58-0x0000000000000000-mapping.dmp

Download
memory/1980-60-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1980-61-0x00000000009B0000-0x0000000000CB3000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing