formbook | 4167987df2a1b3583bc8cf5a97fb1cebf68ccbc9a627e8b5c156d30413ebb139

General

Target

DHL Consignment Details_pdf.exe
Size

1.0MB
MD5

a3f9e308045c0becd406e09bc06acc08
SHA1

5d8df88d170f59ebe6ebbe3c816406cda30a64f7
SHA256

4167987df2a1b3583bc8cf5a97fb1cebf68ccbc9a627e8b5c156d30413ebb139
SHA512

375c7cf2c03841eb7bc9113da6294e9a05a4a65c88b77e0f9f1d5161e84814ed6302b0a42f3882c339e149fb4cc94803b39f114780fbbc8ec238d9130e09976f
SSDEEP

24576:rhfC0AD3BXx4qpgqNzB/eV6meR+K1VQljpDpF07:EnBXx4oJBWV6meAEQZpm

Score

10^/10

formbook g28p rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

g28p

Decoy

whhmgs.asia

wellmedcaredirect.net

beggarded.com

wtpjiv.site

todo-celulares.com

parkitny.net

43345.top

pro-genie.com

cwdxz.com

cbc-inc.xyz

healthspots.net

rulil.top

pyramidaudit.solutions

k8sb15.live

hempaware.report

usclink.life

stayefs.net

05262.top

shop-izakaya-jin.com

iccworldcupnews.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 5 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/772-64-0x000000000041F100-mapping.dmp	formbook
behavioral1/memory/772-63-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/772-66-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1368-72-0x0000000000080000-0x00000000000AF000-memory.dmp	formbook
behavioral1/memory/1368-75-0x0000000000080000-0x00000000000AF000-memory.dmp	formbook

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

628 cmd.exe

pid	process
628	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

DHL Consignment Details_pdf.exeDHL Consignment Details_pdf.exenetsh.exe

description	pid	process	target process
PID 1956 set thread context of 772	1956	DHL Consignment Details_pdf.exe	DHL Consignment Details_pdf.exe
PID 772 set thread context of 1204	772	DHL Consignment Details_pdf.exe	Explorer.EXE
PID 1368 set thread context of 1204	1368	netsh.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

DHL Consignment Details_pdf.exenetsh.exe

pid	process
772	DHL Consignment Details_pdf.exe
772	DHL Consignment Details_pdf.exe
1368	netsh.exe
1368	netsh.exe
1368	netsh.exe
1368	netsh.exe
1368	netsh.exe
1368	netsh.exe
1368	netsh.exe
1368	netsh.exe
1368	netsh.exe
1368	netsh.exe
1368	netsh.exe
1368	netsh.exe
1368	netsh.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1204 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

DHL Consignment Details_pdf.exenetsh.exe

pid process

772 DHL Consignment Details_pdf.exe
772 DHL Consignment Details_pdf.exe
772 DHL Consignment Details_pdf.exe
1368 netsh.exe
1368 netsh.exe

pid	process
1204	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

DHL Consignment Details_pdf.exenetsh.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	772	DHL Consignment Details_pdf.exe
Token: SeDebugPrivilege	1368	netsh.exe
Token: SeShutdownPrivilege	1204	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1204 Explorer.EXE
1204 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1204 Explorer.EXE
1204 Explorer.EXE

pid	process
1204	Explorer.EXE
1204	Explorer.EXE

pid	process
1204	Explorer.EXE
1204	Explorer.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

DHL Consignment Details_pdf.exeExplorer.EXEnetsh.exe

description	pid	process	target process
PID 1956 wrote to memory of 772	1956	DHL Consignment Details_pdf.exe	DHL Consignment Details_pdf.exe
PID 1956 wrote to memory of 772	1956	DHL Consignment Details_pdf.exe	DHL Consignment Details_pdf.exe
PID 1956 wrote to memory of 772	1956	DHL Consignment Details_pdf.exe	DHL Consignment Details_pdf.exe
PID 1956 wrote to memory of 772	1956	DHL Consignment Details_pdf.exe	DHL Consignment Details_pdf.exe
PID 1956 wrote to memory of 772	1956	DHL Consignment Details_pdf.exe	DHL Consignment Details_pdf.exe
PID 1956 wrote to memory of 772	1956	DHL Consignment Details_pdf.exe	DHL Consignment Details_pdf.exe
PID 1956 wrote to memory of 772	1956	DHL Consignment Details_pdf.exe	DHL Consignment Details_pdf.exe
PID 1204 wrote to memory of 1368	1204	Explorer.EXE	netsh.exe
PID 1204 wrote to memory of 1368	1204	Explorer.EXE	netsh.exe
PID 1204 wrote to memory of 1368	1204	Explorer.EXE	netsh.exe
PID 1204 wrote to memory of 1368	1204	Explorer.EXE	netsh.exe
PID 1368 wrote to memory of 628	1368	netsh.exe	cmd.exe
PID 1368 wrote to memory of 628	1368	netsh.exe	cmd.exe
PID 1368 wrote to memory of 628	1368	netsh.exe	cmd.exe
PID 1368 wrote to memory of 628	1368	netsh.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\DHL Consignment Details_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\DHL Consignment Details_pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1956

C:\Users\Admin\AppData\Local\Temp\DHL Consignment Details_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\DHL Consignment Details_pdf.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:772

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1204

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:1960

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:1692

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:696

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:1196

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:1776

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:1740

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:1544

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:840

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:280

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:1864

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\SysWOW64\netsh.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1368

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\DHL Consignment Details_pdf.exe"
3⤵
- Deletes itself
PID:628

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/628-74-0x0000000000000000-mapping.dmp

Download
memory/772-67-0x0000000000920000-0x0000000000C23000-memory.dmp

Filesize
3.0MB

Download
memory/772-68-0x0000000000170000-0x0000000000184000-memory.dmp

Filesize
80KB

Download
memory/772-60-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/772-61-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/772-64-0x000000000041F100-mapping.dmp

Download
memory/772-63-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/772-66-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1204-78-0x0000000003E30000-0x0000000003ED7000-memory.dmp

Filesize
668KB

Download
memory/1204-77-0x0000000003E30000-0x0000000003ED7000-memory.dmp

Filesize
668KB

Download
memory/1204-69-0x00000000060D0000-0x00000000061B6000-memory.dmp

Filesize
920KB

Download
memory/1368-72-0x0000000000080000-0x00000000000AF000-memory.dmp

Filesize
188KB

Download
memory/1368-70-0x0000000000000000-mapping.dmp

Download
memory/1368-71-0x0000000000D80000-0x0000000000D9B000-memory.dmp

Filesize
108KB

Download
memory/1368-73-0x00000000021A0000-0x00000000024A3000-memory.dmp

Filesize
3.0MB

Download
memory/1368-75-0x0000000000080000-0x00000000000AF000-memory.dmp

Filesize
188KB

Download
memory/1368-76-0x0000000000AF0000-0x0000000000B83000-memory.dmp

Filesize
588KB

Download
memory/1956-59-0x0000000004B80000-0x0000000004C02000-memory.dmp

Filesize
520KB

Download
memory/1956-58-0x0000000007FE0000-0x000000000809A000-memory.dmp

Filesize
744KB

Download
memory/1956-54-0x0000000000E40000-0x0000000000F48000-memory.dmp

Filesize
1.0MB

Download
memory/1956-57-0x0000000000510000-0x000000000051E000-memory.dmp

Filesize
56KB

Download
memory/1956-56-0x00000000004F0000-0x000000000050A000-memory.dmp

Filesize
104KB

Download
memory/1956-55-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads