formbook | 4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3

General

Target

4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe
Size

660KB
MD5

c2354b14ee0277fa1796f55b5a11b9eb
SHA1

69c1bdad6cc3eeebee5b03d404a83c4ee82111ec
SHA256

4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3
SHA512

201be588b817203ceccb70d1c6e2a1ddf4c689c95f72928fe32f404d3bf1a08753d95944a4f58ac69ded3e30b40211fcf828a6fc178181388455a299d6eba962

Score

10^/10

formbook sh rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

3.8

Campaign

sh

Decoy

westoffice.net

open-sgi.info

night-club.online

tv17404.info

0472game.com

haberlerim.net

my-web.net

360almeria.com

healthyair.cymru

anxietysupresant.info

domainprodssl1309test.com

tolgakorkmaz.com

laklapos.com

4y978g.info

entitydatabase.info

jese52.party

redstarnepal.com

internationaldrugdiscovery.com

crafting.solutions

lecodedumariage.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4564-133-0x0000000000000000-mapping.dmp	formbook
behavioral2/memory/4564-135-0x0000000000400000-0x000000000042A000-memory.dmp	formbook

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe

pid	process
4564	4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe
4564	4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe

pid process

2324 4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe

pid	process
2324	4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe

description	pid	process	target process
PID 2324 wrote to memory of 4564	2324	4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe	4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe
PID 2324 wrote to memory of 4564	2324	4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe	4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe
PID 2324 wrote to memory of 4564	2324	4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe	4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe
PID 2324 wrote to memory of 4564	2324	4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe	4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe
PID 2324 wrote to memory of 4564	2324	4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe	4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe
PID 2324 wrote to memory of 4564	2324	4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe	4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe
PID 2324 wrote to memory of 4564	2324	4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe	4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe
PID 2324 wrote to memory of 4564	2324	4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe	4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe
PID 2324 wrote to memory of 4564	2324	4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe	4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe
PID 2324 wrote to memory of 4564	2324	4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe	4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe
PID 2324 wrote to memory of 4564	2324	4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe	4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe
PID 2324 wrote to memory of 4564	2324	4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe	4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe

C:\Users\Admin\AppData\Local\Temp\4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe
"C:\Users\Admin\AppData\Local\Temp\4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2324

C:\Users\Admin\AppData\Local\Temp\4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe
"C:\Users\Admin\AppData\Local\Temp\4c232865c8c3a6049c76dca22b24e0efe649979cd87c553430ae701e0caef1c3.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4564

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2324-132-0x00000000005C0000-0x00000000005C6000-memory.dmp

Filesize
24KB

Download
memory/2324-134-0x00000000005C0000-0x00000000005C6000-memory.dmp

Filesize
24KB

Download
memory/4564-133-0x0000000000000000-mapping.dmp

Download
memory/4564-135-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4564-136-0x0000000000C90000-0x0000000000FDA000-memory.dmp

Filesize
3.3MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads