formbook | c1f8453f87478046ab531b8f9b6cc326ed23945f498be57528cb2eb64794127e

General

Target

c1f8453f87478046ab531b8f9b6cc326ed23945f498be57528cb2eb64794127e.exe
Size

420KB
MD5

8881c8955f0fd9d56453761f4ec30650
SHA1

54dbf85c651292408517e3988b9715b977217294
SHA256

c1f8453f87478046ab531b8f9b6cc326ed23945f498be57528cb2eb64794127e
SHA512

5a33c1590e395523b46fa6ee08319c5e9783e233eed64b92a8f68b2a7b8e321bcfae37bdd9eb23c87bca663f48cbd4e66bf9768471672e680a9e70d1fbc6f774
SSDEEP

6144:JwrMUTpmlTBl76qjNLxWC7n8zfCzl/8dhMGGn+p9z:KzklT2qjNLxWC4WzR8a+

Score

10^/10

formbook cu rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

3.9

Campaign

cu

Decoy

szmsdwl.com

sansurftowntesting.rocks

mixingtheworld.com

jagadhribartanbhandar.com

albanypieshop.com

tago.ltd

lmwellnessgroup.com

xn--vb0bj6jvrexvt.com

180pe.com

1l1threecome.men

visualgraphicarts.science

ecofitlife.com

kearneygeneralcontracting.com

stmarysbandclub.info

jinshucaijing.com

mariahdawson.com

tophoteluniverse.com

yastudent.com

fastrautoservice.com

fslgt.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/584-64-0x0000000000400000-0x000000000042A000-memory.dmp	formbook
behavioral1/memory/584-62-0x0000000000400000-0x0000000000469000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

c1f8453f87478046ab531b8f9b6cc326ed23945f498be57528cb2eb64794127e.exe

description	pid	process	target process
PID 1716 set thread context of 584	1716	c1f8453f87478046ab531b8f9b6cc326ed23945f498be57528cb2eb64794127e.exe	c1f8453f87478046ab531b8f9b6cc326ed23945f498be57528cb2eb64794127e.exe

Drops file in Windows directory 2 IoCs

Processes:

c1f8453f87478046ab531b8f9b6cc326ed23945f498be57528cb2eb64794127e.exec1f8453f87478046ab531b8f9b6cc326ed23945f498be57528cb2eb64794127e.exe

description	ioc	process
File opened for modification	C:\Windows\win.ini	c1f8453f87478046ab531b8f9b6cc326ed23945f498be57528cb2eb64794127e.exe
File opened for modification	C:\Windows\win.ini	c1f8453f87478046ab531b8f9b6cc326ed23945f498be57528cb2eb64794127e.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

c1f8453f87478046ab531b8f9b6cc326ed23945f498be57528cb2eb64794127e.exe

pid process

584 c1f8453f87478046ab531b8f9b6cc326ed23945f498be57528cb2eb64794127e.exe

pid	process
584	c1f8453f87478046ab531b8f9b6cc326ed23945f498be57528cb2eb64794127e.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

c1f8453f87478046ab531b8f9b6cc326ed23945f498be57528cb2eb64794127e.exec1f8453f87478046ab531b8f9b6cc326ed23945f498be57528cb2eb64794127e.exe

pid	process
1716	c1f8453f87478046ab531b8f9b6cc326ed23945f498be57528cb2eb64794127e.exe
584	c1f8453f87478046ab531b8f9b6cc326ed23945f498be57528cb2eb64794127e.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

c1f8453f87478046ab531b8f9b6cc326ed23945f498be57528cb2eb64794127e.exe

description	pid	process	target process
PID 1716 wrote to memory of 584	1716	c1f8453f87478046ab531b8f9b6cc326ed23945f498be57528cb2eb64794127e.exe	c1f8453f87478046ab531b8f9b6cc326ed23945f498be57528cb2eb64794127e.exe
PID 1716 wrote to memory of 584	1716	c1f8453f87478046ab531b8f9b6cc326ed23945f498be57528cb2eb64794127e.exe	c1f8453f87478046ab531b8f9b6cc326ed23945f498be57528cb2eb64794127e.exe
PID 1716 wrote to memory of 584	1716	c1f8453f87478046ab531b8f9b6cc326ed23945f498be57528cb2eb64794127e.exe	c1f8453f87478046ab531b8f9b6cc326ed23945f498be57528cb2eb64794127e.exe
PID 1716 wrote to memory of 584	1716	c1f8453f87478046ab531b8f9b6cc326ed23945f498be57528cb2eb64794127e.exe	c1f8453f87478046ab531b8f9b6cc326ed23945f498be57528cb2eb64794127e.exe

C:\Users\Admin\AppData\Local\Temp\c1f8453f87478046ab531b8f9b6cc326ed23945f498be57528cb2eb64794127e.exe
"C:\Users\Admin\AppData\Local\Temp\c1f8453f87478046ab531b8f9b6cc326ed23945f498be57528cb2eb64794127e.exe"
1⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1716

C:\Users\Admin\AppData\Local\Temp\c1f8453f87478046ab531b8f9b6cc326ed23945f498be57528cb2eb64794127e.exe
"C:\Users\Admin\AppData\Local\Temp\c1f8453f87478046ab531b8f9b6cc326ed23945f498be57528cb2eb64794127e.exe"
2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:584

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\win.ini
Filesize
509B

MD5
d2a2412bddba16d60ec63bd9550d933f

SHA1
deb3d3bdc9055f0b4909b31d3048446848fae0e1

SHA256
79ff2254e38192be1626d05bec6c82e10c85e1cf91df7440c4c443380a1e877a

SHA512
8fecada107f72e59e43a689eeb8e2e18fa6134d0941c122025ed5bd00e5eab8114d7125bd289505be75641385a0c3f112d402c693f142c3ddc870d5fa8116e31

Download Submit
memory/584-62-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/584-57-0x0000000000000000-mapping.dmp

Download
memory/584-83-0x00000000770C0000-0x0000000077269000-memory.dmp

Filesize
1.7MB

Download
memory/584-86-0x00000000772B0000-0x0000000077386000-memory.dmp

Filesize
856KB

Download
memory/584-75-0x000000001F920000-0x000000001FC23000-memory.dmp

Filesize
3.0MB

Download
memory/584-64-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1716-77-0x00000000772A0000-0x0000000077420000-memory.dmp

Filesize
1.5MB

Download
memory/1716-82-0x00000000772A0000-0x0000000077420000-memory.dmp

Filesize
1.5MB

Download
memory/1716-69-0x00000000772A0000-0x0000000077420000-memory.dmp

Filesize
1.5MB

Download
memory/1716-70-0x00000000772A0000-0x0000000077420000-memory.dmp

Filesize
1.5MB

Download
memory/1716-68-0x00000000772A0000-0x0000000077420000-memory.dmp

Filesize
1.5MB

Download
memory/1716-71-0x00000000772A0000-0x0000000077420000-memory.dmp

Filesize
1.5MB

Download
memory/1716-73-0x00000000772A0000-0x0000000077420000-memory.dmp

Filesize
1.5MB

Download
memory/1716-66-0x00000000772A0000-0x0000000077420000-memory.dmp

Filesize
1.5MB

Download
memory/1716-76-0x00000000772A0000-0x0000000077420000-memory.dmp

Filesize
1.5MB

Download
memory/1716-56-0x00000000757E1000-0x00000000757E3000-memory.dmp

Filesize
8KB

Download
memory/1716-78-0x00000000772A0000-0x0000000077420000-memory.dmp

Filesize
1.5MB

Download
memory/1716-79-0x00000000772A0000-0x0000000077420000-memory.dmp

Filesize
1.5MB

Download
memory/1716-80-0x00000000772A0000-0x0000000077420000-memory.dmp

Filesize
1.5MB

Download
memory/1716-67-0x00000000772A0000-0x0000000077420000-memory.dmp

Filesize
1.5MB

Download
memory/1716-84-0x00000000772A0000-0x0000000077420000-memory.dmp

Filesize
1.5MB

Download
memory/1716-85-0x00000000772A0000-0x0000000077420000-memory.dmp

Filesize
1.5MB

Download
memory/1716-65-0x00000000772A0000-0x0000000077420000-memory.dmp

Filesize
1.5MB

Download
memory/1716-88-0x00000000772A0000-0x0000000077420000-memory.dmp

Filesize
1.5MB

Download
memory/1716-90-0x00000000772A0000-0x0000000077420000-memory.dmp

Filesize
1.5MB

Download
memory/1716-89-0x00000000772A0000-0x0000000077420000-memory.dmp

Filesize
1.5MB

Download
memory/1716-87-0x00000000772A0000-0x0000000077420000-memory.dmp

Filesize
1.5MB

Download
memory/1716-63-0x00000000770C0000-0x0000000077269000-memory.dmp

Filesize
1.7MB

Download
memory/1716-81-0x00000000772A0000-0x0000000077420000-memory.dmp

Filesize
1.5MB

Download
memory/1716-74-0x00000000772A0000-0x0000000077420000-memory.dmp

Filesize
1.5MB

Download
memory/1716-72-0x00000000772A0000-0x0000000077420000-memory.dmp

Filesize
1.5MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads