formbook | dc39a79518c4d038803a7a7ddaf44d231b318010cf12ef9be4ed037e88b69fa7

General

Target

NEW EURO ORDER.scr
Size

1.1MB
MD5

2909b28c4af650436e18469fdc91a83f
SHA1

91ae24d9807932a980b8c0e537c12158cae24150
SHA256

dc39a79518c4d038803a7a7ddaf44d231b318010cf12ef9be4ed037e88b69fa7
SHA512

65ed07b78d5f99fcc089a2855062fcc4fb76bddde5c6e0c4ddc21376673ae96c8f53e89f69792edf32074d53e03717290b59aa794ce5025014581c5c59ab946f
SSDEEP

24576:0i6hSDohTftjLEGRFG3tmUhT4aq5CjvmLs9/Cn:0GDOTftjtWhUaLPtCn

Score

10^/10

formbook p94a rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

p94a

Decoy

wishgrove.com

parqueveiculos.com

spiderwebs.online

chulkanadham.com

cdtuan.net

zxazm.com

payment6528832.xyz

fengtaiol.com

bffsmovie.com

aliceseagerfitness.com

garisluruskonsulindo.website

analytical-gutter.net

ahcq8.com

fenyoga.com

ecleptic.cat

conjurecrafts.com

aquaway.date

apenpokkenschoonmaakbedrijf.com

zgramr.top

boweknives.site

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/5088-140-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/5088-142-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/964-149-0x0000000000CB0000-0x0000000000CDF000-memory.dmp	formbook
behavioral2/memory/964-152-0x0000000000CB0000-0x0000000000CDF000-memory.dmp	formbook

Suspicious use of SetThreadContext 3 IoCs

Processes:

NEW EURO ORDER.scrNEW EURO ORDER.scrrundll32.exe

description	pid	process	target process
PID 2472 set thread context of 5088	2472	NEW EURO ORDER.scr	NEW EURO ORDER.scr
PID 5088 set thread context of 2644	5088	NEW EURO ORDER.scr	Explorer.EXE
PID 964 set thread context of 2644	964	rundll32.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 44 IoCs

Processes:

NEW EURO ORDER.scrNEW EURO ORDER.scrrundll32.exe

pid	process
2472	NEW EURO ORDER.scr
2472	NEW EURO ORDER.scr
5088	NEW EURO ORDER.scr
5088	NEW EURO ORDER.scr
5088	NEW EURO ORDER.scr
5088	NEW EURO ORDER.scr
964	rundll32.exe
964	rundll32.exe
964	rundll32.exe
964	rundll32.exe
964	rundll32.exe
964	rundll32.exe
964	rundll32.exe
964	rundll32.exe
964	rundll32.exe
964	rundll32.exe
964	rundll32.exe
964	rundll32.exe
964	rundll32.exe
964	rundll32.exe
964	rundll32.exe
964	rundll32.exe
964	rundll32.exe
964	rundll32.exe
964	rundll32.exe
964	rundll32.exe
964	rundll32.exe
964	rundll32.exe
964	rundll32.exe
964	rundll32.exe
964	rundll32.exe
964	rundll32.exe
964	rundll32.exe
964	rundll32.exe
964	rundll32.exe
964	rundll32.exe
964	rundll32.exe
964	rundll32.exe
964	rundll32.exe
964	rundll32.exe
964	rundll32.exe
964	rundll32.exe
964	rundll32.exe
964	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

2644 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

NEW EURO ORDER.scrrundll32.exe

pid process

5088 NEW EURO ORDER.scr
5088 NEW EURO ORDER.scr
5088 NEW EURO ORDER.scr
964 rundll32.exe
964 rundll32.exe

pid	process
2644	Explorer.EXE

pid	process
5088	NEW EURO ORDER.scr
5088	NEW EURO ORDER.scr
5088	NEW EURO ORDER.scr
964	rundll32.exe
964	rundll32.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

NEW EURO ORDER.scrNEW EURO ORDER.scrrundll32.exe

description	pid	process
Token: SeDebugPrivilege	2472	NEW EURO ORDER.scr
Token: SeDebugPrivilege	5088	NEW EURO ORDER.scr
Token: SeDebugPrivilege	964	rundll32.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

NEW EURO ORDER.scrExplorer.EXErundll32.exe

description	pid	process	target process
PID 2472 wrote to memory of 3756	2472	NEW EURO ORDER.scr	NEW EURO ORDER.scr
PID 2472 wrote to memory of 3756	2472	NEW EURO ORDER.scr	NEW EURO ORDER.scr
PID 2472 wrote to memory of 3756	2472	NEW EURO ORDER.scr	NEW EURO ORDER.scr
PID 2472 wrote to memory of 5088	2472	NEW EURO ORDER.scr	NEW EURO ORDER.scr
PID 2472 wrote to memory of 5088	2472	NEW EURO ORDER.scr	NEW EURO ORDER.scr
PID 2472 wrote to memory of 5088	2472	NEW EURO ORDER.scr	NEW EURO ORDER.scr
PID 2472 wrote to memory of 5088	2472	NEW EURO ORDER.scr	NEW EURO ORDER.scr
PID 2472 wrote to memory of 5088	2472	NEW EURO ORDER.scr	NEW EURO ORDER.scr
PID 2472 wrote to memory of 5088	2472	NEW EURO ORDER.scr	NEW EURO ORDER.scr
PID 2644 wrote to memory of 964	2644	Explorer.EXE	rundll32.exe
PID 2644 wrote to memory of 964	2644	Explorer.EXE	rundll32.exe
PID 2644 wrote to memory of 964	2644	Explorer.EXE	rundll32.exe
PID 964 wrote to memory of 4404	964	rundll32.exe	cmd.exe
PID 964 wrote to memory of 4404	964	rundll32.exe	cmd.exe
PID 964 wrote to memory of 4404	964	rundll32.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2644

C:\Users\Admin\AppData\Local\Temp\NEW EURO ORDER.scr
"C:\Users\Admin\AppData\Local\Temp\NEW EURO ORDER.scr" /S
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2472

C:\Users\Admin\AppData\Local\Temp\NEW EURO ORDER.scr
"C:\Users\Admin\AppData\Local\Temp\NEW EURO ORDER.scr"
3⤵
PID:3756

C:\Users\Admin\AppData\Local\Temp\NEW EURO ORDER.scr
"C:\Users\Admin\AppData\Local\Temp\NEW EURO ORDER.scr"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:5088

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\SysWOW64\rundll32.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:964

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\NEW EURO ORDER.scr"
3⤵
PID:4404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/964-146-0x0000000000000000-mapping.dmp

Download
memory/964-152-0x0000000000CB0000-0x0000000000CDF000-memory.dmp

Filesize
188KB

Download
memory/964-151-0x0000000002A80000-0x0000000002B13000-memory.dmp

Filesize
588KB

Download
memory/964-150-0x0000000002BD0000-0x0000000002F1A000-memory.dmp

Filesize
3.3MB

Download
memory/964-148-0x0000000000850000-0x0000000000864000-memory.dmp

Filesize
80KB

Download
memory/964-149-0x0000000000CB0000-0x0000000000CDF000-memory.dmp

Filesize
188KB

Download
memory/2472-137-0x00000000083B0000-0x0000000008416000-memory.dmp

Filesize
408KB

Download
memory/2472-132-0x0000000000BB0000-0x0000000000CC8000-memory.dmp

Filesize
1.1MB

Download
memory/2472-133-0x0000000005D00000-0x00000000062A4000-memory.dmp

Filesize
5.6MB

Download
memory/2472-134-0x0000000005670000-0x0000000005702000-memory.dmp

Filesize
584KB

Download
memory/2472-135-0x0000000005720000-0x000000000572A000-memory.dmp

Filesize
40KB

Download
memory/2472-136-0x0000000008210000-0x00000000082AC000-memory.dmp

Filesize
624KB

Download
memory/2644-154-0x00000000085B0000-0x00000000086B8000-memory.dmp

Filesize
1.0MB

Download
memory/2644-153-0x00000000085B0000-0x00000000086B8000-memory.dmp

Filesize
1.0MB

Download
memory/2644-145-0x00000000083D0000-0x00000000084D4000-memory.dmp

Filesize
1.0MB

Download
memory/3756-138-0x0000000000000000-mapping.dmp

Download
memory/4404-147-0x0000000000000000-mapping.dmp

Download
memory/5088-139-0x0000000000000000-mapping.dmp

Download
memory/5088-144-0x0000000001580000-0x0000000001594000-memory.dmp

Filesize
80KB

Download
memory/5088-143-0x0000000001210000-0x000000000155A000-memory.dmp

Filesize
3.3MB

Download
memory/5088-142-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5088-140-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads