formbook | b0adb7c3e887e6bcbe21abcf54851718f7eceeef31f570a76fb648ecb204cc89

General

Target

b0adb7c3e887e6bcbe21abcf54851718f7eceeef31f570a76fb648ecb204cc89.exe
Size

624KB
MD5

1852f73f39ab8c254e5a32b6dc87a4c1
SHA1

86f2cd8e3db60ce3e29b89501d2d79f802b1e35a
SHA256

b0adb7c3e887e6bcbe21abcf54851718f7eceeef31f570a76fb648ecb204cc89
SHA512

7f6114e9178010de101af204fd106a306a60d82a442b5e274e86279d196683fe53ffa00cb368bdcf873ebf4769f4db8b934f4767d9a60ebce1dd8d2699b2a866
SSDEEP

6144:DYdS4Ty2u4np1m91T7eqEP5vzL2WBCB9hJo1RAKks6:DB46wqFE0YCBRo1RABs

Score

10^/10

formbook di rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

3.8

Campaign

di

Decoy

baoxiaofan.com

bestwaycartage.com

sag-architecture.com

salamcanteen.com

clinicalpsychologistkerala.com

mttv222.com

theweproject.com

fybbracelets.net

vv666h.com

bangfupin.com

arkprojetos.com

realgoaldigger.com

pilotedphotography.com

6zonxm55.biz

gaoduanmi.com

aminahmad.com

bountymarketing.net

christopher-rennebach.com

02xjys.faith

estilomiau.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/700-58-0x0000000000000000-mapping.dmp	formbook
behavioral1/memory/700-60-0x0000000000400000-0x000000000042A000-memory.dmp	formbook

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

b0adb7c3e887e6bcbe21abcf54851718f7eceeef31f570a76fb648ecb204cc89.exe

pid process

700 b0adb7c3e887e6bcbe21abcf54851718f7eceeef31f570a76fb648ecb204cc89.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

b0adb7c3e887e6bcbe21abcf54851718f7eceeef31f570a76fb648ecb204cc89.exe

pid process

2036 b0adb7c3e887e6bcbe21abcf54851718f7eceeef31f570a76fb648ecb204cc89.exe

pid	process
700	b0adb7c3e887e6bcbe21abcf54851718f7eceeef31f570a76fb648ecb204cc89.exe

pid	process
2036	b0adb7c3e887e6bcbe21abcf54851718f7eceeef31f570a76fb648ecb204cc89.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

b0adb7c3e887e6bcbe21abcf54851718f7eceeef31f570a76fb648ecb204cc89.exe

description	pid	process	target process
PID 2036 wrote to memory of 700	2036	b0adb7c3e887e6bcbe21abcf54851718f7eceeef31f570a76fb648ecb204cc89.exe	b0adb7c3e887e6bcbe21abcf54851718f7eceeef31f570a76fb648ecb204cc89.exe
PID 2036 wrote to memory of 700	2036	b0adb7c3e887e6bcbe21abcf54851718f7eceeef31f570a76fb648ecb204cc89.exe	b0adb7c3e887e6bcbe21abcf54851718f7eceeef31f570a76fb648ecb204cc89.exe
PID 2036 wrote to memory of 700	2036	b0adb7c3e887e6bcbe21abcf54851718f7eceeef31f570a76fb648ecb204cc89.exe	b0adb7c3e887e6bcbe21abcf54851718f7eceeef31f570a76fb648ecb204cc89.exe
PID 2036 wrote to memory of 700	2036	b0adb7c3e887e6bcbe21abcf54851718f7eceeef31f570a76fb648ecb204cc89.exe	b0adb7c3e887e6bcbe21abcf54851718f7eceeef31f570a76fb648ecb204cc89.exe
PID 2036 wrote to memory of 700	2036	b0adb7c3e887e6bcbe21abcf54851718f7eceeef31f570a76fb648ecb204cc89.exe	b0adb7c3e887e6bcbe21abcf54851718f7eceeef31f570a76fb648ecb204cc89.exe
PID 2036 wrote to memory of 700	2036	b0adb7c3e887e6bcbe21abcf54851718f7eceeef31f570a76fb648ecb204cc89.exe	b0adb7c3e887e6bcbe21abcf54851718f7eceeef31f570a76fb648ecb204cc89.exe
PID 2036 wrote to memory of 700	2036	b0adb7c3e887e6bcbe21abcf54851718f7eceeef31f570a76fb648ecb204cc89.exe	b0adb7c3e887e6bcbe21abcf54851718f7eceeef31f570a76fb648ecb204cc89.exe
PID 2036 wrote to memory of 700	2036	b0adb7c3e887e6bcbe21abcf54851718f7eceeef31f570a76fb648ecb204cc89.exe	b0adb7c3e887e6bcbe21abcf54851718f7eceeef31f570a76fb648ecb204cc89.exe
PID 2036 wrote to memory of 700	2036	b0adb7c3e887e6bcbe21abcf54851718f7eceeef31f570a76fb648ecb204cc89.exe	b0adb7c3e887e6bcbe21abcf54851718f7eceeef31f570a76fb648ecb204cc89.exe
PID 2036 wrote to memory of 700	2036	b0adb7c3e887e6bcbe21abcf54851718f7eceeef31f570a76fb648ecb204cc89.exe	b0adb7c3e887e6bcbe21abcf54851718f7eceeef31f570a76fb648ecb204cc89.exe
PID 2036 wrote to memory of 700	2036	b0adb7c3e887e6bcbe21abcf54851718f7eceeef31f570a76fb648ecb204cc89.exe	b0adb7c3e887e6bcbe21abcf54851718f7eceeef31f570a76fb648ecb204cc89.exe
PID 2036 wrote to memory of 700	2036	b0adb7c3e887e6bcbe21abcf54851718f7eceeef31f570a76fb648ecb204cc89.exe	b0adb7c3e887e6bcbe21abcf54851718f7eceeef31f570a76fb648ecb204cc89.exe
PID 2036 wrote to memory of 700	2036	b0adb7c3e887e6bcbe21abcf54851718f7eceeef31f570a76fb648ecb204cc89.exe	b0adb7c3e887e6bcbe21abcf54851718f7eceeef31f570a76fb648ecb204cc89.exe

C:\Users\Admin\AppData\Local\Temp\b0adb7c3e887e6bcbe21abcf54851718f7eceeef31f570a76fb648ecb204cc89.exe
"C:\Users\Admin\AppData\Local\Temp\b0adb7c3e887e6bcbe21abcf54851718f7eceeef31f570a76fb648ecb204cc89.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Users\Admin\AppData\Local\Temp\b0adb7c3e887e6bcbe21abcf54851718f7eceeef31f570a76fb648ecb204cc89.exe
  "C:\Users\Admin\AppData\Local\Temp\b0adb7c3e887e6bcbe21abcf54851718f7eceeef31f570a76fb648ecb204cc89.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:700

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/700-58-0x0000000000000000-mapping.dmp

Download
memory/700-60-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/700-61-0x00000000007E0000-0x0000000000AE3000-memory.dmp

Filesize
3.0MB

Download
memory/2036-56-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/2036-57-0x0000000076381000-0x0000000076383000-memory.dmp

Filesize
8KB

Download
memory/2036-59-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download

Analysis

Sharing