formbook | a5b3f39420dfafa9d157f75e980c1fd8742ab42ec71d4170a8e1752589c5c83d

General

Target

a5b3f39420dfafa9d157f75e980c1fd8742ab42ec71d4170a8e1752589c5c83d.exe
Size

814KB
MD5

421d4235271bffd240fdacab7aef2072
SHA1

147e8565f1c5bf2983a22a6f0ff633b8258889ea
SHA256

a5b3f39420dfafa9d157f75e980c1fd8742ab42ec71d4170a8e1752589c5c83d
SHA512

49ed35df288546a899ea9d412bc37c0918f2df6904dd4c2d08cf44f944808d8b63b2d8596c6b25ae874dadce083bc787a1d31c5f93653b337df163052351498d
SSDEEP

12288:QvCvsM4OEHslgDaN6ntfS3LeMjKrWwESUcxjJ8w9MllpcgoYRFdvKl1+HzZH+zaa:4YCzxTMjMUcxt8wOcNyFdcAHtaTm

Score

10^/10

formbook ng04 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ng04

Decoy

tevimaq.com

easterspecialtystore.com

smartlever.tech

10312.uk

tanjawiharbi.co.uk

471338.com

horusventure.com

empress-care.com

sinrian.com

465951.com

aemsti.com

nxcourier.com

stargatefarms.com

lalyquainvestment.com

dailysportsadvice.com

justlistmoore.com

stoneonroll.online

tatianakolomiets.com

barcodebbm.com

protectorship.world

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2084-139-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

a5b3f39420dfafa9d157f75e980c1fd8742ab42ec71d4170a8e1752589c5c83d.exe

description	pid	process	target process
PID 4964 set thread context of 2084	4964	a5b3f39420dfafa9d157f75e980c1fd8742ab42ec71d4170a8e1752589c5c83d.exe	a5b3f39420dfafa9d157f75e980c1fd8742ab42ec71d4170a8e1752589c5c83d.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

a5b3f39420dfafa9d157f75e980c1fd8742ab42ec71d4170a8e1752589c5c83d.exea5b3f39420dfafa9d157f75e980c1fd8742ab42ec71d4170a8e1752589c5c83d.exe

pid	process
4964	a5b3f39420dfafa9d157f75e980c1fd8742ab42ec71d4170a8e1752589c5c83d.exe
4964	a5b3f39420dfafa9d157f75e980c1fd8742ab42ec71d4170a8e1752589c5c83d.exe
2084	a5b3f39420dfafa9d157f75e980c1fd8742ab42ec71d4170a8e1752589c5c83d.exe
2084	a5b3f39420dfafa9d157f75e980c1fd8742ab42ec71d4170a8e1752589c5c83d.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a5b3f39420dfafa9d157f75e980c1fd8742ab42ec71d4170a8e1752589c5c83d.exe

description pid process

Token: SeDebugPrivilege 4964 a5b3f39420dfafa9d157f75e980c1fd8742ab42ec71d4170a8e1752589c5c83d.exe

description	pid	process
Token: SeDebugPrivilege	4964	a5b3f39420dfafa9d157f75e980c1fd8742ab42ec71d4170a8e1752589c5c83d.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

a5b3f39420dfafa9d157f75e980c1fd8742ab42ec71d4170a8e1752589c5c83d.exe

description	pid	process	target process
PID 4964 wrote to memory of 1708	4964	a5b3f39420dfafa9d157f75e980c1fd8742ab42ec71d4170a8e1752589c5c83d.exe	a5b3f39420dfafa9d157f75e980c1fd8742ab42ec71d4170a8e1752589c5c83d.exe
PID 4964 wrote to memory of 1708	4964	a5b3f39420dfafa9d157f75e980c1fd8742ab42ec71d4170a8e1752589c5c83d.exe	a5b3f39420dfafa9d157f75e980c1fd8742ab42ec71d4170a8e1752589c5c83d.exe
PID 4964 wrote to memory of 1708	4964	a5b3f39420dfafa9d157f75e980c1fd8742ab42ec71d4170a8e1752589c5c83d.exe	a5b3f39420dfafa9d157f75e980c1fd8742ab42ec71d4170a8e1752589c5c83d.exe
PID 4964 wrote to memory of 2084	4964	a5b3f39420dfafa9d157f75e980c1fd8742ab42ec71d4170a8e1752589c5c83d.exe	a5b3f39420dfafa9d157f75e980c1fd8742ab42ec71d4170a8e1752589c5c83d.exe
PID 4964 wrote to memory of 2084	4964	a5b3f39420dfafa9d157f75e980c1fd8742ab42ec71d4170a8e1752589c5c83d.exe	a5b3f39420dfafa9d157f75e980c1fd8742ab42ec71d4170a8e1752589c5c83d.exe
PID 4964 wrote to memory of 2084	4964	a5b3f39420dfafa9d157f75e980c1fd8742ab42ec71d4170a8e1752589c5c83d.exe	a5b3f39420dfafa9d157f75e980c1fd8742ab42ec71d4170a8e1752589c5c83d.exe
PID 4964 wrote to memory of 2084	4964	a5b3f39420dfafa9d157f75e980c1fd8742ab42ec71d4170a8e1752589c5c83d.exe	a5b3f39420dfafa9d157f75e980c1fd8742ab42ec71d4170a8e1752589c5c83d.exe
PID 4964 wrote to memory of 2084	4964	a5b3f39420dfafa9d157f75e980c1fd8742ab42ec71d4170a8e1752589c5c83d.exe	a5b3f39420dfafa9d157f75e980c1fd8742ab42ec71d4170a8e1752589c5c83d.exe
PID 4964 wrote to memory of 2084	4964	a5b3f39420dfafa9d157f75e980c1fd8742ab42ec71d4170a8e1752589c5c83d.exe	a5b3f39420dfafa9d157f75e980c1fd8742ab42ec71d4170a8e1752589c5c83d.exe

C:\Users\Admin\AppData\Local\Temp\a5b3f39420dfafa9d157f75e980c1fd8742ab42ec71d4170a8e1752589c5c83d.exe
"C:\Users\Admin\AppData\Local\Temp\a5b3f39420dfafa9d157f75e980c1fd8742ab42ec71d4170a8e1752589c5c83d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4964

C:\Users\Admin\AppData\Local\Temp\a5b3f39420dfafa9d157f75e980c1fd8742ab42ec71d4170a8e1752589c5c83d.exe
"C:\Users\Admin\AppData\Local\Temp\a5b3f39420dfafa9d157f75e980c1fd8742ab42ec71d4170a8e1752589c5c83d.exe"
2⤵
PID:1708

C:\Users\Admin\AppData\Local\Temp\a5b3f39420dfafa9d157f75e980c1fd8742ab42ec71d4170a8e1752589c5c83d.exe
"C:\Users\Admin\AppData\Local\Temp\a5b3f39420dfafa9d157f75e980c1fd8742ab42ec71d4170a8e1752589c5c83d.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2084

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1708-137-0x0000000000000000-mapping.dmp

Download
memory/2084-138-0x0000000000000000-mapping.dmp

Download
memory/2084-139-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2084-140-0x00000000012A0000-0x00000000015EA000-memory.dmp

Filesize
3.3MB

Download
memory/4964-132-0x0000000000680000-0x0000000000752000-memory.dmp

Filesize
840KB

Download
memory/4964-133-0x00000000055F0000-0x0000000005B94000-memory.dmp

Filesize
5.6MB

Download
memory/4964-134-0x00000000050F0000-0x0000000005182000-memory.dmp

Filesize
584KB

Download
memory/4964-135-0x00000000051B0000-0x00000000051BA000-memory.dmp

Filesize
40KB

Download
memory/4964-136-0x000000000B500000-0x000000000B59C000-memory.dmp

Filesize
624KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads