formbook | ba9b013506b8a73739901db161488cb054b2e4c56bd81330ed21958e3a5d5c56

General

Target

ba9b013506b8a73739901db161488cb054b2e4c56bd81330ed21958e3a5d5c56.exe
Size

745KB
MD5

7f048f0a041c3cd706eed4e8790b55ef
SHA1

7c6beddbd23a6008772bf79d52f71c002272b201
SHA256

ba9b013506b8a73739901db161488cb054b2e4c56bd81330ed21958e3a5d5c56
SHA512

bd4d75e240c1568456135088355357842746a78fe1e6ada05b65f877fa9401ebca5a0122a2b1e414df029f7953c20d2b4d01e64403635a6dd2a0088b2ba017d0
SSDEEP

12288:7wlfSmomPZef0stYJ07fpKE618Sa7bZtPGGCnFXTJa4XPtqvyuP/N:qomxiyexNe8F7bvYvQFXN

Score

10^/10

formbook w086 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

w086

Decoy

F6jSz+l9QmYXguG/xUipf/6ixrik

cQZre8twfBVOOJgLenGTGA==

pG5kW2/wqwEOCVxZ

KORXeYwt7wF8J3BR

HL0ZdBMjeHet

TR57b4Yi6wJ8J3BR

fRyK2yaqeDRGHiQTTw==

RwhsqfRxABNZS59wenGTGA==

GuZaY4H4ahcWKjUdVg==

I5C4/Wyz3fglj+o=

Te5QPEu3NjZ0P58LenGTGA==

M9YJLwifZIi9pfnj2Nj/kA6+ZlU=

c/JFdRndG8f/HiQTTw==

nMmcD1UjeHet

QWR7+9Rh8/l8J3BR

9MD+BzOyI6mXtM4w6LMyEA==

WABgaYPqdJzl2TviGbdH

02OexRebqj3+U2kXhQ0=

j17M2R3/fQwFHiQTTw==

dQpReYss5/l8J3BR

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

ba9b013506b8a73739901db161488cb054b2e4c56bd81330ed21958e3a5d5c56.exe

description	pid	process	target process
PID 548 set thread context of 4572	548	ba9b013506b8a73739901db161488cb054b2e4c56bd81330ed21958e3a5d5c56.exe	ba9b013506b8a73739901db161488cb054b2e4c56bd81330ed21958e3a5d5c56.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

ba9b013506b8a73739901db161488cb054b2e4c56bd81330ed21958e3a5d5c56.exeba9b013506b8a73739901db161488cb054b2e4c56bd81330ed21958e3a5d5c56.exe

pid	process
548	ba9b013506b8a73739901db161488cb054b2e4c56bd81330ed21958e3a5d5c56.exe
548	ba9b013506b8a73739901db161488cb054b2e4c56bd81330ed21958e3a5d5c56.exe
4572	ba9b013506b8a73739901db161488cb054b2e4c56bd81330ed21958e3a5d5c56.exe
4572	ba9b013506b8a73739901db161488cb054b2e4c56bd81330ed21958e3a5d5c56.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ba9b013506b8a73739901db161488cb054b2e4c56bd81330ed21958e3a5d5c56.exe

description pid process

Token: SeDebugPrivilege 548 ba9b013506b8a73739901db161488cb054b2e4c56bd81330ed21958e3a5d5c56.exe

description	pid	process
Token: SeDebugPrivilege	548	ba9b013506b8a73739901db161488cb054b2e4c56bd81330ed21958e3a5d5c56.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

ba9b013506b8a73739901db161488cb054b2e4c56bd81330ed21958e3a5d5c56.exe

description	pid	process	target process
PID 548 wrote to memory of 4676	548	ba9b013506b8a73739901db161488cb054b2e4c56bd81330ed21958e3a5d5c56.exe	ba9b013506b8a73739901db161488cb054b2e4c56bd81330ed21958e3a5d5c56.exe
PID 548 wrote to memory of 4676	548	ba9b013506b8a73739901db161488cb054b2e4c56bd81330ed21958e3a5d5c56.exe	ba9b013506b8a73739901db161488cb054b2e4c56bd81330ed21958e3a5d5c56.exe
PID 548 wrote to memory of 4676	548	ba9b013506b8a73739901db161488cb054b2e4c56bd81330ed21958e3a5d5c56.exe	ba9b013506b8a73739901db161488cb054b2e4c56bd81330ed21958e3a5d5c56.exe
PID 548 wrote to memory of 4572	548	ba9b013506b8a73739901db161488cb054b2e4c56bd81330ed21958e3a5d5c56.exe	ba9b013506b8a73739901db161488cb054b2e4c56bd81330ed21958e3a5d5c56.exe
PID 548 wrote to memory of 4572	548	ba9b013506b8a73739901db161488cb054b2e4c56bd81330ed21958e3a5d5c56.exe	ba9b013506b8a73739901db161488cb054b2e4c56bd81330ed21958e3a5d5c56.exe
PID 548 wrote to memory of 4572	548	ba9b013506b8a73739901db161488cb054b2e4c56bd81330ed21958e3a5d5c56.exe	ba9b013506b8a73739901db161488cb054b2e4c56bd81330ed21958e3a5d5c56.exe
PID 548 wrote to memory of 4572	548	ba9b013506b8a73739901db161488cb054b2e4c56bd81330ed21958e3a5d5c56.exe	ba9b013506b8a73739901db161488cb054b2e4c56bd81330ed21958e3a5d5c56.exe
PID 548 wrote to memory of 4572	548	ba9b013506b8a73739901db161488cb054b2e4c56bd81330ed21958e3a5d5c56.exe	ba9b013506b8a73739901db161488cb054b2e4c56bd81330ed21958e3a5d5c56.exe
PID 548 wrote to memory of 4572	548	ba9b013506b8a73739901db161488cb054b2e4c56bd81330ed21958e3a5d5c56.exe	ba9b013506b8a73739901db161488cb054b2e4c56bd81330ed21958e3a5d5c56.exe

C:\Users\Admin\AppData\Local\Temp\ba9b013506b8a73739901db161488cb054b2e4c56bd81330ed21958e3a5d5c56.exe
"C:\Users\Admin\AppData\Local\Temp\ba9b013506b8a73739901db161488cb054b2e4c56bd81330ed21958e3a5d5c56.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:548

C:\Users\Admin\AppData\Local\Temp\ba9b013506b8a73739901db161488cb054b2e4c56bd81330ed21958e3a5d5c56.exe
"C:\Users\Admin\AppData\Local\Temp\ba9b013506b8a73739901db161488cb054b2e4c56bd81330ed21958e3a5d5c56.exe"
2⤵
PID:4676

C:\Users\Admin\AppData\Local\Temp\ba9b013506b8a73739901db161488cb054b2e4c56bd81330ed21958e3a5d5c56.exe
"C:\Users\Admin\AppData\Local\Temp\ba9b013506b8a73739901db161488cb054b2e4c56bd81330ed21958e3a5d5c56.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4572

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/548-132-0x00000000007C0000-0x0000000000880000-memory.dmp

Filesize
768KB

Download
memory/548-133-0x0000000005930000-0x0000000005ED4000-memory.dmp

Filesize
5.6MB

Download
memory/548-134-0x0000000005250000-0x00000000052E2000-memory.dmp

Filesize
584KB

Download
memory/548-135-0x0000000005220000-0x000000000522A000-memory.dmp

Filesize
40KB

Download
memory/548-136-0x0000000007520000-0x00000000075BC000-memory.dmp

Filesize
624KB

Download
memory/4572-138-0x0000000000000000-mapping.dmp

Download
memory/4572-139-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4572-141-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4572-142-0x0000000000401000-0x000000000042F000-memory.dmp

Filesize
184KB

Download
memory/4572-143-0x0000000001430000-0x000000000177A000-memory.dmp

Filesize
3.3MB

Download
memory/4676-137-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads