formbook | ffce47dda6138350897df35247a9120da87af808a9d4e80390cafc2d308d4e2c

Analysis

max time kernel
150s
max time network
152s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24/01/2023, 14:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
INVOICE.exe
Size 743KB
Sample230124-rz96msdg21
SHA256 51b75048fd9a1f0f9ad1a76c1009b3db3fd14701e7ce770370fb0f6ffaa0042f
MD5 b8578071ef790ac8a2165dfe6c69fa31
SHA1 a5994ec25899ff2953fdbdd4ea7d87601cbb7cbe
SHA512 fbc646eb7a3ab2a4948205c9394dbf429c1741da735f87983ad04e96c1532a3a3258ede7130be758e2f7703f9d851968abde6bf5744dfcdf6f3f2699f1a1a7ed
SSDEEP 12288:ReUQejkKYrubiXG+IF8zIGE8TInS396WE/6B0obD+amDpkKhPKv0j5bjxeGGGGGe:polr6Ue8PT396LgPyDmUKstb9W
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook jn21 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

jn21

Decoy

lordmikeagency.africa
d4tri.com
flareicon.com
deckandcottage.com
blg807.xyz
abctestservices.com
2022xin38.bar
cjwservicespressureexpert.com
brighampartners.com
immoswipe.net
barriedrawingpainting.com
chasingtimemovie.com
1wizzc.top
kimnguyendemo.tech
gabonais.store
hotdealz.africa
bonchuk.ru
concretizarconsorcios.com
carolynhowells.ltd
kfp0g4.shop
atkorea.online
804053.com
kldasol.shop
e-newspaper22.com
eofedigital.info
elenarudenko.ru
gravy.love
gpws.africa
gecqpq.top
1wczfu.top
dreivondertanke.xyz
childrensyoga.london
duparticuler.com
drm-kirovets.ru
c3jw1.bond
solarsolutions.capetown
themaf.app
oob.boo
expertws.com
geraldinedoculan.com
brynshoot.co.uk
invisionspayments.com
kuziranosio.com
dutakemasindonesia.com
mymcl.co.uk
intellighenta.com
codigo-postal-de-peru.com
campaigndock.com
financeng.africa
buyerbuddy.app
watersideschool.org.uk
bahislionn.com
ariellemullinsfavreau.online
christmasnetic.com
gsway.ru
impressionvivah.com
amanstore.net
suliov.online
imprentasdf.com
allyinvestmanagement.com
daylightsunlightreport.co.uk
gakioti.com
casaruraldiezleguas.com
dongfanggzs.com
midsussexprostatecancer.uk

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 5 IoCs

rat

resource	yara_rule
behavioral1/memory/688-62-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/688-63-0x000000000041F1C0-mapping.dmp	formbook
behavioral1/memory/688-65-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1776-71-0x0000000000080000-0x00000000000AF000-memory.dmp	formbook
behavioral1/memory/1776-76-0x0000000000080000-0x00000000000AF000-memory.dmp	formbook

Deletes itself 1 IoCs

pid	Process
1872	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1632 set thread context of 688	1632	INVOICE.exe	27
PID 688 set thread context of 1232	688	INVOICE.exe	13
PID 1776 set thread context of 1232	1776	help.exe	13

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
1632	INVOICE.exe
688	INVOICE.exe
688	INVOICE.exe
1776	help.exe
1776	help.exe
1776	help.exe
1776	help.exe
1776	help.exe
1776	help.exe
1776	help.exe
1776	help.exe
1776	help.exe
1776	help.exe
1776	help.exe
1776	help.exe
1776	help.exe
1776	help.exe
1776	help.exe
1776	help.exe
1776	help.exe
1776	help.exe
1776	help.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1232	Explorer.EXE

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
688	INVOICE.exe
688	INVOICE.exe
688	INVOICE.exe
1776	help.exe
1776	help.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1632	INVOICE.exe
Token: SeDebugPrivilege	688	INVOICE.exe
Token: SeDebugPrivilege	1776	help.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1232	Explorer.EXE
1232	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1232	Explorer.EXE
1232	Explorer.EXE

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 688	1632	INVOICE.exe	27
PID 1632 wrote to memory of 688	1632	INVOICE.exe	27
PID 1632 wrote to memory of 688	1632	INVOICE.exe	27
PID 1632 wrote to memory of 688	1632	INVOICE.exe	27
PID 1632 wrote to memory of 688	1632	INVOICE.exe	27
PID 1632 wrote to memory of 688	1632	INVOICE.exe	27
PID 1632 wrote to memory of 688	1632	INVOICE.exe	27
PID 1232 wrote to memory of 1776	1232	Explorer.EXE	40
PID 1232 wrote to memory of 1776	1232	Explorer.EXE	40
PID 1232 wrote to memory of 1776	1232	Explorer.EXE	40
PID 1232 wrote to memory of 1776	1232	Explorer.EXE	40
PID 1776 wrote to memory of 1872	1776	help.exe	41
PID 1776 wrote to memory of 1872	1776	help.exe	41
PID 1776 wrote to memory of 1872	1776	help.exe	41
PID 1776 wrote to memory of 1872	1776	help.exe	41

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Users\Admin\AppData\Local\Temp\INVOICE.exe
  "C:\Users\Admin\AppData\Local\Temp\INVOICE.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1632
- - C:\Users\Admin\AppData\Local\Temp\INVOICE.exe
    "{path}"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:688
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:576
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:588
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:908
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:1944
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:1252
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:1824
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:1080
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:816
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:276
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:764
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:1332
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:1816
- C:\Windows\SysWOW64\help.exe
  "C:\Windows\SysWOW64\help.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1776
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\INVOICE.exe"
    3⤵
    - Deletes itself
    PID:1872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/688-66-0x0000000000860000-0x0000000000B63000-memory.dmp

Download

memory/688-67-0x0000000000220000-0x0000000000235000-memory.dmp

Download

memory/688-65-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/688-62-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/688-59-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/688-60-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1232-75-0x00000000029B0000-0x0000000002A76000-memory.dmp

Download

memory/1232-68-0x0000000006250000-0x00000000063EB000-memory.dmp

Download

memory/1232-77-0x00000000029B0000-0x0000000002A76000-memory.dmp

Download

memory/1632-57-0x0000000004ED0000-0x0000000004F56000-memory.dmp

Download

memory/1632-55-0x00000000761F1000-0x00000000761F3000-memory.dmp

Download

memory/1632-54-0x0000000001210000-0x00000000012D0000-memory.dmp

Download

memory/1632-58-0x00000000006A0000-0x00000000006D4000-memory.dmp

Download

memory/1632-56-0x0000000000330000-0x000000000033E000-memory.dmp

Download

memory/1776-71-0x0000000000080000-0x00000000000AF000-memory.dmp

Download

memory/1776-73-0x0000000000930000-0x0000000000C33000-memory.dmp

Download

memory/1776-74-0x0000000000650000-0x00000000006E4000-memory.dmp

Download

memory/1776-76-0x0000000000080000-0x00000000000AF000-memory.dmp

Download

memory/1776-70-0x0000000000920000-0x0000000000926000-memory.dmp

Download