formbook | 71562f1899bf12998b47d4f245d62c07e152a91ee9191dfaff9a963e3fcd3f7f

General

Target

SecuriteInfo.com.Win64.PWSX-gen.17395.4795.exe
Size

552KB
MD5

46333b6ff15c92a0338fb82a3ffda095
SHA1

e0c71790f415c5894a89c72f047fc2080e920ee4
SHA256

71562f1899bf12998b47d4f245d62c07e152a91ee9191dfaff9a963e3fcd3f7f
SHA512

92644ed70c4f28a72399c98ec8c5e72ec4c073e31069a6887dc2a265f6e58c70d7c5f6919a8c1e99f922a939c899e72a4711bc87e914ad053233012e623875a0
SSDEEP

12288:GbXKERz+4rqtEmCqfupYcjyf5ITpqRiixvx4bsFslx+haSw8:GtC4utExqf6YX5ITpRixvx4oFslx+hrw

Score

10^/10

formbook urde rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

urde

Decoy

belleriacortland.com

gxzyykx.com

blocksholding.net

zhangjiyuan.com

tyfinck.com

xn--v9s.club

xn--72c9at8ec1l.com

dorismart.online

nocodeuni.com

hmmprocesos.website

quartile.agency

iansdogname.com

karengillen.com

the-bitindexprime.info

nthanisolutions.com

nakamu.online

sahityanepal.com

sinwinindustry.com

shotblastwearingparts.com

nstsuccess.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 5 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/912-56-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/912-57-0x000000000041F140-mapping.dmp	formbook
behavioral1/memory/912-59-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1056-67-0x00000000000E0000-0x000000000010F000-memory.dmp	formbook
behavioral1/memory/1056-72-0x00000000000E0000-0x000000000010F000-memory.dmp	formbook

Suspicious use of SetThreadContext 3 IoCs

Processes:

SecuriteInfo.com.Win64.PWSX-gen.17395.4795.exeCasPol.execmstp.exe

description	pid	process	target process
PID 1112 set thread context of 912	1112	SecuriteInfo.com.Win64.PWSX-gen.17395.4795.exe	CasPol.exe
PID 912 set thread context of 1444	912	CasPol.exe	Explorer.EXE
PID 1056 set thread context of 1444	1056	cmstp.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 24 IoCs

Processes:

CasPol.execmstp.exe

pid	process
912	CasPol.exe
912	CasPol.exe
1056	cmstp.exe
1056	cmstp.exe
1056	cmstp.exe
1056	cmstp.exe
1056	cmstp.exe
1056	cmstp.exe
1056	cmstp.exe
1056	cmstp.exe
1056	cmstp.exe
1056	cmstp.exe
1056	cmstp.exe
1056	cmstp.exe
1056	cmstp.exe
1056	cmstp.exe
1056	cmstp.exe
1056	cmstp.exe
1056	cmstp.exe
1056	cmstp.exe
1056	cmstp.exe
1056	cmstp.exe
1056	cmstp.exe
1056	cmstp.exe

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

CasPol.execmstp.exe

pid process

912 CasPol.exe
912 CasPol.exe
912 CasPol.exe
1056 cmstp.exe
1056 cmstp.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

CasPol.execmstp.exe

description pid process

Token: SeDebugPrivilege 912 CasPol.exe
Token: SeDebugPrivilege 1056 cmstp.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1444 Explorer.EXE
1444 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1444 Explorer.EXE
1444 Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	912	CasPol.exe
Token: SeDebugPrivilege	1056	cmstp.exe

pid	process
1444	Explorer.EXE
1444	Explorer.EXE

pid	process
1444	Explorer.EXE
1444	Explorer.EXE

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

SecuriteInfo.com.Win64.PWSX-gen.17395.4795.exeExplorer.EXEcmstp.exe

description	pid	process	target process
PID 1112 wrote to memory of 912	1112	SecuriteInfo.com.Win64.PWSX-gen.17395.4795.exe	CasPol.exe
PID 1112 wrote to memory of 912	1112	SecuriteInfo.com.Win64.PWSX-gen.17395.4795.exe	CasPol.exe
PID 1112 wrote to memory of 912	1112	SecuriteInfo.com.Win64.PWSX-gen.17395.4795.exe	CasPol.exe
PID 1112 wrote to memory of 912	1112	SecuriteInfo.com.Win64.PWSX-gen.17395.4795.exe	CasPol.exe
PID 1112 wrote to memory of 912	1112	SecuriteInfo.com.Win64.PWSX-gen.17395.4795.exe	CasPol.exe
PID 1112 wrote to memory of 912	1112	SecuriteInfo.com.Win64.PWSX-gen.17395.4795.exe	CasPol.exe
PID 1112 wrote to memory of 912	1112	SecuriteInfo.com.Win64.PWSX-gen.17395.4795.exe	CasPol.exe
PID 1444 wrote to memory of 1056	1444	Explorer.EXE	cmstp.exe
PID 1444 wrote to memory of 1056	1444	Explorer.EXE	cmstp.exe
PID 1444 wrote to memory of 1056	1444	Explorer.EXE	cmstp.exe
PID 1444 wrote to memory of 1056	1444	Explorer.EXE	cmstp.exe
PID 1444 wrote to memory of 1056	1444	Explorer.EXE	cmstp.exe
PID 1444 wrote to memory of 1056	1444	Explorer.EXE	cmstp.exe
PID 1444 wrote to memory of 1056	1444	Explorer.EXE	cmstp.exe
PID 1056 wrote to memory of 952	1056	cmstp.exe	cmd.exe
PID 1056 wrote to memory of 952	1056	cmstp.exe	cmd.exe
PID 1056 wrote to memory of 952	1056	cmstp.exe	cmd.exe
PID 1056 wrote to memory of 952	1056	cmstp.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.PWSX-gen.17395.4795.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.PWSX-gen.17395.4795.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1112
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:912
- C:\Windows\SysWOW64\cmstp.exe
  "C:\Windows\SysWOW64\cmstp.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1056
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
    3⤵
    PID:952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/912-61-0x0000000000390000-0x00000000003A4000-memory.dmp

Filesize
80KB

Download
memory/912-56-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/912-57-0x000000000041F140-mapping.dmp

Download
memory/912-59-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/912-60-0x0000000000810000-0x0000000000B13000-memory.dmp

Filesize
3.0MB

Download
memory/952-65-0x0000000000000000-mapping.dmp

Download
memory/1056-63-0x0000000000000000-mapping.dmp

Download
memory/1056-64-0x0000000075351000-0x0000000075353000-memory.dmp

Filesize
8KB

Download
memory/1056-66-0x0000000000920000-0x0000000000938000-memory.dmp

Filesize
96KB

Download
memory/1056-67-0x00000000000E0000-0x000000000010F000-memory.dmp

Filesize
188KB

Download
memory/1056-68-0x0000000001ED0000-0x00000000021D3000-memory.dmp

Filesize
3.0MB

Download
memory/1056-69-0x0000000000850000-0x00000000008E3000-memory.dmp

Filesize
588KB

Download
memory/1056-72-0x00000000000E0000-0x000000000010F000-memory.dmp

Filesize
188KB

Download
memory/1112-54-0x0000000000A10000-0x0000000000A9E000-memory.dmp

Filesize
568KB

Download
memory/1112-55-0x0000000001EA0000-0x0000000001F12000-memory.dmp

Filesize
456KB

Download
memory/1444-62-0x0000000004840000-0x00000000048FA000-memory.dmp

Filesize
744KB

Download
memory/1444-70-0x0000000004970000-0x0000000004A82000-memory.dmp

Filesize
1.1MB

Download
memory/1444-71-0x0000000004840000-0x00000000048FA000-memory.dmp

Filesize
744KB

Download
memory/1444-73-0x0000000004970000-0x0000000004A82000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads