formbook | a1447871448821c618f709b0fe2793d4ebb45d0adb007abf09db5a0a408de953

General

Target

a1447871448821c618f709b0fe2793d4ebb45d0adb007abf09db5a0a408de953.exe
Size

472KB
MD5

992ec0524b6459931751f56832343ea6
SHA1

a57e77d0f05594065af5af0a91635ab6d894a1ff
SHA256

a1447871448821c618f709b0fe2793d4ebb45d0adb007abf09db5a0a408de953
SHA512

ed30c6fa0400bb21a1d31e2b2839457e1223bc75360f6d91d6584fd6d597f85be3acb70b083496d89855def7127c4cedf7c3383e287ce6f431d8b9232f727799
SSDEEP

6144:IvpLm+ILKjat7JeFeznG0JECbr9ZQ9QUS:KLfalzntJE+I9S

Score

10^/10

formbook sh rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

3.9

Campaign

sh

Decoy

world-fireworks.com

fujiyama18.com

mottamail.com

shliangba.com

hatsuratsu-houmon.com

qdqmercados.net

wwwjsgw8.com

bcbsmedicarmarketplace.com

optio.deals

familiasorice.com

harveyfloodmitigation.com

gorelawfirmalpharetta.com

faraweb.net

biolang.net

otiebnight78.com

news3035.soccer

campbellswarehousellc.com

whyxbgjj.com

pixieanddixieadventures.com

xiongqq.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/560-141-0x0000000000400000-0x0000000000478000-memory.dmp	formbook
behavioral2/memory/560-142-0x0000000000400000-0x000000000042A000-memory.dmp	formbook

Drops file in Windows directory 2 IoCs

Processes:

a1447871448821c618f709b0fe2793d4ebb45d0adb007abf09db5a0a408de953.exea1447871448821c618f709b0fe2793d4ebb45d0adb007abf09db5a0a408de953.exe

description	ioc	process
File opened for modification	C:\Windows\win.ini	a1447871448821c618f709b0fe2793d4ebb45d0adb007abf09db5a0a408de953.exe
File opened for modification	C:\Windows\win.ini	a1447871448821c618f709b0fe2793d4ebb45d0adb007abf09db5a0a408de953.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

a1447871448821c618f709b0fe2793d4ebb45d0adb007abf09db5a0a408de953.exe

pid	process
560	a1447871448821c618f709b0fe2793d4ebb45d0adb007abf09db5a0a408de953.exe
560	a1447871448821c618f709b0fe2793d4ebb45d0adb007abf09db5a0a408de953.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

a1447871448821c618f709b0fe2793d4ebb45d0adb007abf09db5a0a408de953.exea1447871448821c618f709b0fe2793d4ebb45d0adb007abf09db5a0a408de953.exe

pid	process
752	a1447871448821c618f709b0fe2793d4ebb45d0adb007abf09db5a0a408de953.exe
752	a1447871448821c618f709b0fe2793d4ebb45d0adb007abf09db5a0a408de953.exe
560	a1447871448821c618f709b0fe2793d4ebb45d0adb007abf09db5a0a408de953.exe
560	a1447871448821c618f709b0fe2793d4ebb45d0adb007abf09db5a0a408de953.exe

Suspicious use of SendNotifyMessage 4 IoCs

Processes:

a1447871448821c618f709b0fe2793d4ebb45d0adb007abf09db5a0a408de953.exea1447871448821c618f709b0fe2793d4ebb45d0adb007abf09db5a0a408de953.exe

pid	process
752	a1447871448821c618f709b0fe2793d4ebb45d0adb007abf09db5a0a408de953.exe
752	a1447871448821c618f709b0fe2793d4ebb45d0adb007abf09db5a0a408de953.exe
560	a1447871448821c618f709b0fe2793d4ebb45d0adb007abf09db5a0a408de953.exe
560	a1447871448821c618f709b0fe2793d4ebb45d0adb007abf09db5a0a408de953.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

a1447871448821c618f709b0fe2793d4ebb45d0adb007abf09db5a0a408de953.exea1447871448821c618f709b0fe2793d4ebb45d0adb007abf09db5a0a408de953.exe

pid	process
752	a1447871448821c618f709b0fe2793d4ebb45d0adb007abf09db5a0a408de953.exe
560	a1447871448821c618f709b0fe2793d4ebb45d0adb007abf09db5a0a408de953.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

a1447871448821c618f709b0fe2793d4ebb45d0adb007abf09db5a0a408de953.exe

description	pid	process	target process
PID 752 wrote to memory of 560	752	a1447871448821c618f709b0fe2793d4ebb45d0adb007abf09db5a0a408de953.exe	a1447871448821c618f709b0fe2793d4ebb45d0adb007abf09db5a0a408de953.exe
PID 752 wrote to memory of 560	752	a1447871448821c618f709b0fe2793d4ebb45d0adb007abf09db5a0a408de953.exe	a1447871448821c618f709b0fe2793d4ebb45d0adb007abf09db5a0a408de953.exe
PID 752 wrote to memory of 560	752	a1447871448821c618f709b0fe2793d4ebb45d0adb007abf09db5a0a408de953.exe	a1447871448821c618f709b0fe2793d4ebb45d0adb007abf09db5a0a408de953.exe

C:\Users\Admin\AppData\Local\Temp\a1447871448821c618f709b0fe2793d4ebb45d0adb007abf09db5a0a408de953.exe
"C:\Users\Admin\AppData\Local\Temp\a1447871448821c618f709b0fe2793d4ebb45d0adb007abf09db5a0a408de953.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:752

C:\Users\Admin\AppData\Local\Temp\a1447871448821c618f709b0fe2793d4ebb45d0adb007abf09db5a0a408de953.exe
"C:\Users\Admin\AppData\Local\Temp\a1447871448821c618f709b0fe2793d4ebb45d0adb007abf09db5a0a408de953.exe"
2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:560

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\win.ini
Filesize
123B

MD5
6bf517432f65eb7f0d18d574bf14124c

SHA1
5b9f37c1dd1318ebbec3bd2f07c109eb9d22c727

SHA256
6e2b70dfccabf3cc651545676a3a566c9cfae03f15f772886646abce1da35b46

SHA512
7b0cb8c20034585ec8bf4b45eda5eda5993a56e24931a7426dc5a9f081ec1f82545f3e26a48a4df885c8691fc6e8026d0808aebe3cc3358ba85ddca08ac4cb06

Download Submit
memory/560-145-0x0000000077D70000-0x0000000077F13000-memory.dmp

Filesize
1.6MB

Download
memory/560-141-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/560-142-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/560-143-0x00000000051F0000-0x00000000052F0000-memory.dmp

Filesize
1024KB

Download
memory/560-144-0x00007FFBCCB30000-0x00007FFBCCD25000-memory.dmp

Filesize
2.0MB

Download
memory/560-134-0x0000000000000000-mapping.dmp

Download
memory/560-146-0x0000000021870000-0x0000000021BBA000-memory.dmp

Filesize
3.3MB

Download
memory/560-147-0x00000000051F0000-0x00000000052F0000-memory.dmp

Filesize
1024KB

Download
memory/560-148-0x0000000077D70000-0x0000000077F13000-memory.dmp

Filesize
1.6MB

Download
memory/752-138-0x00007FFBCCB30000-0x00007FFBCCD25000-memory.dmp

Filesize
2.0MB

Download
memory/752-139-0x0000000077D70000-0x0000000077F13000-memory.dmp

Filesize
1.6MB

Download
memory/752-137-0x0000000005350000-0x0000000005450000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads