formbook | 855a71b80b3dac1295001efd045acc65309b350cceb6663ef106f464bd086381

General

Target

855a71b80b3dac1295001efd045acc65309b350cceb6663ef106f464bd086381.exe
Size

1010KB
MD5

05249a2214929e31547ca844a72365f1
SHA1

07036b37b144e1022f7cd444903d35bcc78454d4
SHA256

855a71b80b3dac1295001efd045acc65309b350cceb6663ef106f464bd086381
SHA512

605438b5010da66fbaa00516e129d30e44bbabaebd3d866a6c37fbf976a23a50ae5423035b9dd5260c6ef3f0f3fd763d8daa264a3764ff37b77ba0e648992bf4
SSDEEP

24576:1e/qSXiEDT25Rvgi6TjHCOH+1qeimbNPLefSMfSBfSCfSvfSAfS1fSGfSTfS0fS4:wqWDaETO13img

Score

10^/10

formbook ab ke ko rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

3.9

Campaign

ab

Decoy

kirameki.online

qcgqtz.com

hodlmycoins.com

trickortreatdmv.com

idealsssi.com

637788v.com

puercha.ltd

tornikaista.com

travelcare.agency

sidecartourparis.com

smartfx89.com

studymust.com

nmucf.info

thecarltonfiles.com

autoviralprofit.com

dramaticcalculator.com

naxiehua8090.com

verway-leben.com

mkyouthpastor.com

index119.com

Extracted

Family

formbook

Version

3.9

Campaign

ko

Decoy

batatproject.com

mydaxuetang.com

clmproject.com

die-erste-werkstatt.com

constructiveproductions.com

vorhersage.net

jonathanandcolleen.com

crmparis.com

thesexpistolsvevo.com

sauna.media

osmspayments.net

320903.com

keshuotech.com

smpql.com

ssgan75.com

651bifa.com

weyena.com

lauraradu.com

carbuco.com

thejobdocs.com

Extracted

Family

formbook

Version

3.9

Campaign

ke

Decoy

weiyipa.com

thepovertyneckhillbillies.com

yxzhgs.com

carolinahaulers.com

geosondar.com

globallifi.com

eurasiantourism.com

6upgrades.com

hidwid.com

zphillipsgames.com

jodiesart.com

line2revo-butei.com

worldreviewofbooks.com

heictojpeg.com

prib.ltd

xn--comores-routire-6mb.com

fatnevermore.com

meadowlarkvoices.com

blissstreetfashion.com

karbirgidainsaat.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 6 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/908-142-0x0000000000400000-0x00000000004FC000-memory.dmp	formbook
behavioral2/memory/2196-144-0x0000000000400000-0x00000000004FC000-memory.dmp	formbook
behavioral2/memory/2196-147-0x0000000000400000-0x000000000042A000-memory.dmp	formbook
behavioral2/memory/2116-146-0x0000000000400000-0x000000000042A000-memory.dmp	formbook
behavioral2/memory/908-145-0x0000000000400000-0x000000000042A000-memory.dmp	formbook
behavioral2/memory/2116-143-0x0000000000400000-0x00000000004FC000-memory.dmp	formbook

Suspicious use of SetThreadContext 3 IoCs

Processes:

855a71b80b3dac1295001efd045acc65309b350cceb6663ef106f464bd086381.exe

description	pid	process	target process
PID 4324 set thread context of 908	4324	855a71b80b3dac1295001efd045acc65309b350cceb6663ef106f464bd086381.exe	855a71b80b3dac1295001efd045acc65309b350cceb6663ef106f464bd086381.exe
PID 4324 set thread context of 2116	4324	855a71b80b3dac1295001efd045acc65309b350cceb6663ef106f464bd086381.exe	855a71b80b3dac1295001efd045acc65309b350cceb6663ef106f464bd086381.exe
PID 4324 set thread context of 2196	4324	855a71b80b3dac1295001efd045acc65309b350cceb6663ef106f464bd086381.exe	855a71b80b3dac1295001efd045acc65309b350cceb6663ef106f464bd086381.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

855a71b80b3dac1295001efd045acc65309b350cceb6663ef106f464bd086381.exe855a71b80b3dac1295001efd045acc65309b350cceb6663ef106f464bd086381.exe855a71b80b3dac1295001efd045acc65309b350cceb6663ef106f464bd086381.exe

pid	process
2196	855a71b80b3dac1295001efd045acc65309b350cceb6663ef106f464bd086381.exe
2196	855a71b80b3dac1295001efd045acc65309b350cceb6663ef106f464bd086381.exe
2116	855a71b80b3dac1295001efd045acc65309b350cceb6663ef106f464bd086381.exe
2116	855a71b80b3dac1295001efd045acc65309b350cceb6663ef106f464bd086381.exe
908	855a71b80b3dac1295001efd045acc65309b350cceb6663ef106f464bd086381.exe
908	855a71b80b3dac1295001efd045acc65309b350cceb6663ef106f464bd086381.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

855a71b80b3dac1295001efd045acc65309b350cceb6663ef106f464bd086381.exe

pid process

4324 855a71b80b3dac1295001efd045acc65309b350cceb6663ef106f464bd086381.exe

pid	process
4324	855a71b80b3dac1295001efd045acc65309b350cceb6663ef106f464bd086381.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

855a71b80b3dac1295001efd045acc65309b350cceb6663ef106f464bd086381.exe

description	pid	process	target process
PID 4324 wrote to memory of 908	4324	855a71b80b3dac1295001efd045acc65309b350cceb6663ef106f464bd086381.exe	855a71b80b3dac1295001efd045acc65309b350cceb6663ef106f464bd086381.exe
PID 4324 wrote to memory of 908	4324	855a71b80b3dac1295001efd045acc65309b350cceb6663ef106f464bd086381.exe	855a71b80b3dac1295001efd045acc65309b350cceb6663ef106f464bd086381.exe
PID 4324 wrote to memory of 908	4324	855a71b80b3dac1295001efd045acc65309b350cceb6663ef106f464bd086381.exe	855a71b80b3dac1295001efd045acc65309b350cceb6663ef106f464bd086381.exe
PID 4324 wrote to memory of 2116	4324	855a71b80b3dac1295001efd045acc65309b350cceb6663ef106f464bd086381.exe	855a71b80b3dac1295001efd045acc65309b350cceb6663ef106f464bd086381.exe
PID 4324 wrote to memory of 2116	4324	855a71b80b3dac1295001efd045acc65309b350cceb6663ef106f464bd086381.exe	855a71b80b3dac1295001efd045acc65309b350cceb6663ef106f464bd086381.exe
PID 4324 wrote to memory of 2116	4324	855a71b80b3dac1295001efd045acc65309b350cceb6663ef106f464bd086381.exe	855a71b80b3dac1295001efd045acc65309b350cceb6663ef106f464bd086381.exe
PID 4324 wrote to memory of 2196	4324	855a71b80b3dac1295001efd045acc65309b350cceb6663ef106f464bd086381.exe	855a71b80b3dac1295001efd045acc65309b350cceb6663ef106f464bd086381.exe
PID 4324 wrote to memory of 2196	4324	855a71b80b3dac1295001efd045acc65309b350cceb6663ef106f464bd086381.exe	855a71b80b3dac1295001efd045acc65309b350cceb6663ef106f464bd086381.exe
PID 4324 wrote to memory of 2196	4324	855a71b80b3dac1295001efd045acc65309b350cceb6663ef106f464bd086381.exe	855a71b80b3dac1295001efd045acc65309b350cceb6663ef106f464bd086381.exe

C:\Users\Admin\AppData\Local\Temp\855a71b80b3dac1295001efd045acc65309b350cceb6663ef106f464bd086381.exe
"C:\Users\Admin\AppData\Local\Temp\855a71b80b3dac1295001efd045acc65309b350cceb6663ef106f464bd086381.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4324

C:\Users\Admin\AppData\Local\Temp\855a71b80b3dac1295001efd045acc65309b350cceb6663ef106f464bd086381.exe
C:\Users\Admin\AppData\Local\Temp\855a71b80b3dac1295001efd045acc65309b350cceb6663ef106f464bd086381.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:908

C:\Users\Admin\AppData\Local\Temp\855a71b80b3dac1295001efd045acc65309b350cceb6663ef106f464bd086381.exe
C:\Users\Admin\AppData\Local\Temp\855a71b80b3dac1295001efd045acc65309b350cceb6663ef106f464bd086381.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2116

C:\Users\Admin\AppData\Local\Temp\855a71b80b3dac1295001efd045acc65309b350cceb6663ef106f464bd086381.exe
C:\Users\Admin\AppData\Local\Temp\855a71b80b3dac1295001efd045acc65309b350cceb6663ef106f464bd086381.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2196

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/908-149-0x00007FFA61F90000-0x00007FFA62185000-memory.dmp

Filesize
2.0MB

Download
memory/908-135-0x0000000000000000-mapping.dmp

Download
memory/908-142-0x0000000000400000-0x00000000004FC000-memory.dmp

Filesize
1008KB

Download
memory/908-156-0x0000000006DF0000-0x000000000713A000-memory.dmp

Filesize
3.3MB

Download
memory/908-150-0x0000000077130000-0x00000000772D3000-memory.dmp

Filesize
1.6MB

Download
memory/908-145-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/908-159-0x0000000077130000-0x00000000772D3000-memory.dmp

Filesize
1.6MB

Download
memory/908-158-0x0000000000610000-0x0000000000617000-memory.dmp

Filesize
28KB

Download
memory/908-163-0x0000000077130000-0x00000000772D3000-memory.dmp

Filesize
1.6MB

Download
memory/2116-136-0x0000000000000000-mapping.dmp

Download
memory/2116-152-0x00007FFA61F90000-0x00007FFA62185000-memory.dmp

Filesize
2.0MB

Download
memory/2116-155-0x0000000006E70000-0x00000000071BA000-memory.dmp

Filesize
3.3MB

Download
memory/2116-161-0x0000000077130000-0x00000000772D3000-memory.dmp

Filesize
1.6MB

Download
memory/2116-146-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2116-143-0x0000000000400000-0x00000000004FC000-memory.dmp

Filesize
1008KB

Download
memory/2116-162-0x0000000077130000-0x00000000772D3000-memory.dmp

Filesize
1.6MB

Download
memory/2116-153-0x0000000077130000-0x00000000772D3000-memory.dmp

Filesize
1.6MB

Download
memory/2116-157-0x0000000000720000-0x0000000000727000-memory.dmp

Filesize
28KB

Download
memory/2196-151-0x0000000077130000-0x00000000772D3000-memory.dmp

Filesize
1.6MB

Download
memory/2196-154-0x0000000006F70000-0x00000000072BA000-memory.dmp

Filesize
3.3MB

Download
memory/2196-148-0x00007FFA61F90000-0x00007FFA62185000-memory.dmp

Filesize
2.0MB

Download
memory/2196-147-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2196-144-0x0000000000400000-0x00000000004FC000-memory.dmp

Filesize
1008KB

Download
memory/2196-160-0x0000000077130000-0x00000000772D3000-memory.dmp

Filesize
1.6MB

Download
memory/2196-137-0x0000000000000000-mapping.dmp

Download
memory/4324-134-0x00000000022D0000-0x00000000022D7000-memory.dmp

Filesize
28KB

Download
memory/4324-141-0x0000000077130000-0x00000000772D3000-memory.dmp

Filesize
1.6MB

Download
memory/4324-140-0x0000000077130000-0x00000000772D3000-memory.dmp

Filesize
1.6MB

Download
memory/4324-139-0x00000000022D0000-0x00000000022D7000-memory.dmp

Filesize
28KB

Download
memory/4324-138-0x00007FFA61F90000-0x00007FFA62185000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads