formbook | 6e6dab1a248e5205aca778a9e1e2135f7f888cbd5d1edf4debe0efb6cda89fa7

General

Target

6e6dab1a248e5205aca778a9e1e2135f7f888cbd5d1edf4debe0efb6cda89fa7.exe
Size

553KB
MD5

0a980f3bf229381c16b1a756fbf5f5c7
SHA1

94df4edd4f776b4fe2f32b198373b13641dcbec0
SHA256

6e6dab1a248e5205aca778a9e1e2135f7f888cbd5d1edf4debe0efb6cda89fa7
SHA512

2cb0d46940e40ac9451b252ec205786689e74c3dd549fd48883989ac9e1f8b292d8695c624ef5d86c848e0858c446f6fe86a47cffd9aee001fcd945855687666
SSDEEP

12288:JxKCYox8CiJoyRo3a5BUwnYZ/eZD2JZoxEkigK:PKpoK5Ro3wBXnM/eZcZoe

Score

10^/10

formbook urde rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

urde

Decoy

belleriacortland.com

gxzyykx.com

blocksholding.net

zhangjiyuan.com

tyfinck.com

xn--v9s.club

xn--72c9at8ec1l.com

dorismart.online

nocodeuni.com

hmmprocesos.website

quartile.agency

iansdogname.com

karengillen.com

the-bitindexprime.info

nthanisolutions.com

nakamu.online

sahityanepal.com

sinwinindustry.com

shotblastwearingparts.com

nstsuccess.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 6 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1048-56-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1048-57-0x000000000041F140-mapping.dmp	formbook
behavioral1/memory/1048-59-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1048-67-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/2012-71-0x0000000000110000-0x000000000013F000-memory.dmp	formbook
behavioral1/memory/2012-76-0x0000000000110000-0x000000000013F000-memory.dmp	formbook

Suspicious use of SetThreadContext 4 IoCs

Processes:

6e6dab1a248e5205aca778a9e1e2135f7f888cbd5d1edf4debe0efb6cda89fa7.exeCasPol.exerundll32.exe

description	pid	process	target process
PID 1784 set thread context of 1048	1784	6e6dab1a248e5205aca778a9e1e2135f7f888cbd5d1edf4debe0efb6cda89fa7.exe	CasPol.exe
PID 1048 set thread context of 1220	1048	CasPol.exe	Explorer.EXE
PID 1048 set thread context of 1220	1048	CasPol.exe	Explorer.EXE
PID 2012 set thread context of 1220	2012	rundll32.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 24 IoCs

Processes:

CasPol.exerundll32.exe

pid	process
1048	CasPol.exe
1048	CasPol.exe
1048	CasPol.exe
2012	rundll32.exe
2012	rundll32.exe
2012	rundll32.exe
2012	rundll32.exe
2012	rundll32.exe
2012	rundll32.exe
2012	rundll32.exe
2012	rundll32.exe
2012	rundll32.exe
2012	rundll32.exe
2012	rundll32.exe
2012	rundll32.exe
2012	rundll32.exe
2012	rundll32.exe
2012	rundll32.exe
2012	rundll32.exe
2012	rundll32.exe
2012	rundll32.exe
2012	rundll32.exe
2012	rundll32.exe
2012	rundll32.exe

Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

CasPol.exerundll32.exe

pid process

1048 CasPol.exe
1048 CasPol.exe
1048 CasPol.exe
1048 CasPol.exe
2012 rundll32.exe
2012 rundll32.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

6e6dab1a248e5205aca778a9e1e2135f7f888cbd5d1edf4debe0efb6cda89fa7.exeCasPol.exerundll32.exe

description	pid	process
Token: SeDebugPrivilege	1784	6e6dab1a248e5205aca778a9e1e2135f7f888cbd5d1edf4debe0efb6cda89fa7.exe
Token: SeDebugPrivilege	1048	CasPol.exe
Token: SeDebugPrivilege	2012	rundll32.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1220 Explorer.EXE
1220 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1220 Explorer.EXE
1220 Explorer.EXE

pid	process
1220	Explorer.EXE
1220	Explorer.EXE

pid	process
1220	Explorer.EXE
1220	Explorer.EXE

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

6e6dab1a248e5205aca778a9e1e2135f7f888cbd5d1edf4debe0efb6cda89fa7.exeExplorer.EXErundll32.exe

description	pid	process	target process
PID 1784 wrote to memory of 1048	1784	6e6dab1a248e5205aca778a9e1e2135f7f888cbd5d1edf4debe0efb6cda89fa7.exe	CasPol.exe
PID 1784 wrote to memory of 1048	1784	6e6dab1a248e5205aca778a9e1e2135f7f888cbd5d1edf4debe0efb6cda89fa7.exe	CasPol.exe
PID 1784 wrote to memory of 1048	1784	6e6dab1a248e5205aca778a9e1e2135f7f888cbd5d1edf4debe0efb6cda89fa7.exe	CasPol.exe
PID 1784 wrote to memory of 1048	1784	6e6dab1a248e5205aca778a9e1e2135f7f888cbd5d1edf4debe0efb6cda89fa7.exe	CasPol.exe
PID 1784 wrote to memory of 1048	1784	6e6dab1a248e5205aca778a9e1e2135f7f888cbd5d1edf4debe0efb6cda89fa7.exe	CasPol.exe
PID 1784 wrote to memory of 1048	1784	6e6dab1a248e5205aca778a9e1e2135f7f888cbd5d1edf4debe0efb6cda89fa7.exe	CasPol.exe
PID 1784 wrote to memory of 1048	1784	6e6dab1a248e5205aca778a9e1e2135f7f888cbd5d1edf4debe0efb6cda89fa7.exe	CasPol.exe
PID 1220 wrote to memory of 2012	1220	Explorer.EXE	rundll32.exe
PID 1220 wrote to memory of 2012	1220	Explorer.EXE	rundll32.exe
PID 1220 wrote to memory of 2012	1220	Explorer.EXE	rundll32.exe
PID 1220 wrote to memory of 2012	1220	Explorer.EXE	rundll32.exe
PID 1220 wrote to memory of 2012	1220	Explorer.EXE	rundll32.exe
PID 1220 wrote to memory of 2012	1220	Explorer.EXE	rundll32.exe
PID 1220 wrote to memory of 2012	1220	Explorer.EXE	rundll32.exe
PID 2012 wrote to memory of 2004	2012	rundll32.exe	cmd.exe
PID 2012 wrote to memory of 2004	2012	rundll32.exe	cmd.exe
PID 2012 wrote to memory of 2004	2012	rundll32.exe	cmd.exe
PID 2012 wrote to memory of 2004	2012	rundll32.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1220

C:\Users\Admin\AppData\Local\Temp\6e6dab1a248e5205aca778a9e1e2135f7f888cbd5d1edf4debe0efb6cda89fa7.exe
"C:\Users\Admin\AppData\Local\Temp\6e6dab1a248e5205aca778a9e1e2135f7f888cbd5d1edf4debe0efb6cda89fa7.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1784

C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1048

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\SysWOW64\rundll32.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2012

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
3⤵
PID:2004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1048-67-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1048-56-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1048-64-0x00000000001D0000-0x00000000001E4000-memory.dmp

Filesize
80KB

Download
memory/1048-57-0x000000000041F140-mapping.dmp

Download
memory/1048-59-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1048-60-0x0000000000A00000-0x0000000000D03000-memory.dmp

Filesize
3.0MB

Download
memory/1048-61-0x0000000000180000-0x0000000000194000-memory.dmp

Filesize
80KB

Download
memory/1220-74-0x0000000006870000-0x0000000006946000-memory.dmp

Filesize
856KB

Download
memory/1220-65-0x0000000006200000-0x00000000062D5000-memory.dmp

Filesize
852KB

Download
memory/1220-75-0x0000000006200000-0x00000000062D5000-memory.dmp

Filesize
852KB

Download
memory/1220-62-0x0000000005F60000-0x0000000006037000-memory.dmp

Filesize
860KB

Download
memory/1220-77-0x0000000006870000-0x0000000006946000-memory.dmp

Filesize
856KB

Download
memory/1784-54-0x0000000000920000-0x00000000009AE000-memory.dmp

Filesize
568KB

Download
memory/1784-55-0x000000001A650000-0x000000001A6C2000-memory.dmp

Filesize
456KB

Download
memory/2004-69-0x0000000000000000-mapping.dmp

Download
memory/2012-66-0x0000000000000000-mapping.dmp

Download
memory/2012-72-0x00000000020A0000-0x00000000023A3000-memory.dmp

Filesize
3.0MB

Download
memory/2012-73-0x0000000001DA0000-0x0000000001E33000-memory.dmp

Filesize
588KB

Download
memory/2012-71-0x0000000000110000-0x000000000013F000-memory.dmp

Filesize
188KB

Download
memory/2012-70-0x00000000007B0000-0x00000000007BE000-memory.dmp

Filesize
56KB

Download
memory/2012-76-0x0000000000110000-0x000000000013F000-memory.dmp

Filesize
188KB

Download
memory/2012-68-0x00000000753C1000-0x00000000753C3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads