formbook | fefa8c6ef6331d4b932fbc04b108033a6b64fa6938b41135d6154ff42b9efa39

General

Target

new order list.exe
Size

730KB
MD5

0cfb2efa5a22c4cc99842471db6f415a
SHA1

83a61f8dffaa6aa5ed1959b6c1f2eb803b102a26
SHA256

2327b28e657d08e4b9db8e6523523c1b6898bdd4080bd26ad017e4f00d23a6c0
SHA512

a10efc13b736f8036346e7b34019bd57a07862623b5822e3eefa48427731ddf0fa55fee1aa2f9de170569371c397a4eed0a710915c1cee58361f72c9325b4378
SSDEEP

12288:pqdaPk2IkegET9jsIBMNjnNNOhAe/S0pE+tM5eo3BxXcYiI20t4AVYvSZE7GCGQe:p8xTsIBMNjnNNOhAe/S0DpWBmPI20mAd

Score

10^/10

formbook eu69 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

eu69

Decoy

brightonbase.com

gamingcomputersunder1000.com

electriccarcharging.xyz

buysystems.co.uk

cansuk.online

smartykids-center.ru

gmmcustoms.com

klyrio.com

chemical-pomp-media.com

investorenprojekte.com

blogsaudeemdia.com

learning-m365.com

attache.gay

limpiezasturisticas.com

garagedoorprices.shop

amyzoellers.com

eguzkiagroup.com

phe.sk

efefhappen.buzz

raretables.co.uk

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 4 IoCs

rat

resource	yara_rule
behavioral1/memory/1064-63-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1064-67-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/472-72-0x0000000000080000-0x00000000000AF000-memory.dmp	formbook
behavioral1/memory/472-74-0x0000000000080000-0x00000000000AF000-memory.dmp	formbook

Deletes itself 1 IoCs

pid	Process
832	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1408 set thread context of 1064	1408	new order list.exe	29
PID 1064 set thread context of 1212	1064	new order list.exe	16
PID 472 set thread context of 1212	472	netsh.exe	16

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
1408	new order list.exe
1064	new order list.exe
1064	new order list.exe
472	netsh.exe
472	netsh.exe
472	netsh.exe
472	netsh.exe
472	netsh.exe
472	netsh.exe
472	netsh.exe
472	netsh.exe
472	netsh.exe
472	netsh.exe
472	netsh.exe
472	netsh.exe
472	netsh.exe
472	netsh.exe
472	netsh.exe
472	netsh.exe
472	netsh.exe
472	netsh.exe
472	netsh.exe
472	netsh.exe
472	netsh.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1212	Explorer.EXE

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
1064	new order list.exe
1064	new order list.exe
1064	new order list.exe
472	netsh.exe
472	netsh.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1408	new order list.exe
Token: SeDebugPrivilege	1064	new order list.exe
Token: SeDebugPrivilege	472	netsh.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1212	Explorer.EXE
1212	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1212	Explorer.EXE
1212	Explorer.EXE

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 564	1408	new order list.exe	28
PID 1408 wrote to memory of 564	1408	new order list.exe	28
PID 1408 wrote to memory of 564	1408	new order list.exe	28
PID 1408 wrote to memory of 564	1408	new order list.exe	28
PID 1408 wrote to memory of 564	1408	new order list.exe	28
PID 1408 wrote to memory of 564	1408	new order list.exe	28
PID 1408 wrote to memory of 564	1408	new order list.exe	28
PID 1408 wrote to memory of 1064	1408	new order list.exe	29
PID 1408 wrote to memory of 1064	1408	new order list.exe	29
PID 1408 wrote to memory of 1064	1408	new order list.exe	29
PID 1408 wrote to memory of 1064	1408	new order list.exe	29
PID 1408 wrote to memory of 1064	1408	new order list.exe	29
PID 1408 wrote to memory of 1064	1408	new order list.exe	29
PID 1408 wrote to memory of 1064	1408	new order list.exe	29
PID 1408 wrote to memory of 1064	1408	new order list.exe	29
PID 1408 wrote to memory of 1064	1408	new order list.exe	29
PID 1408 wrote to memory of 1064	1408	new order list.exe	29
PID 1212 wrote to memory of 472	1212	Explorer.EXE	30
PID 1212 wrote to memory of 472	1212	Explorer.EXE	30
PID 1212 wrote to memory of 472	1212	Explorer.EXE	30
PID 1212 wrote to memory of 472	1212	Explorer.EXE	30
PID 472 wrote to memory of 832	472	netsh.exe	31
PID 472 wrote to memory of 832	472	netsh.exe	31
PID 472 wrote to memory of 832	472	netsh.exe	31
PID 472 wrote to memory of 832	472	netsh.exe	31

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Users\Admin\AppData\Local\Temp\new order list.exe
  "C:\Users\Admin\AppData\Local\Temp\new order list.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1408
- - C:\Users\Admin\AppData\Local\Temp\new order list.exe
    "{path}"
    3⤵
    PID:564
- - C:\Users\Admin\AppData\Local\Temp\new order list.exe
    "{path}"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:1064
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\SysWOW64\netsh.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:472
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\new order list.exe"
    3⤵
    - Deletes itself
    PID:832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/472-70-0x0000000000D80000-0x0000000000D9B000-memory.dmp

Filesize
108KB

Download
memory/472-76-0x0000000000C10000-0x0000000000CA4000-memory.dmp

Filesize
592KB

Download
memory/472-74-0x0000000000080000-0x00000000000AF000-memory.dmp

Filesize
188KB

Download
memory/472-73-0x00000000021A0000-0x00000000024A3000-memory.dmp

Filesize
3.0MB

Download
memory/472-72-0x0000000000080000-0x00000000000AF000-memory.dmp

Filesize
188KB

Download
memory/472-71-0x0000000000D80000-0x0000000000D9B000-memory.dmp

Filesize
108KB

Download
memory/1064-60-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1064-62-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1064-63-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1064-66-0x00000000008F0000-0x0000000000BF3000-memory.dmp

Filesize
3.0MB

Download
memory/1064-67-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1064-68-0x00000000001F0000-0x0000000000205000-memory.dmp

Filesize
84KB

Download
memory/1064-61-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1212-77-0x0000000004B60000-0x0000000004C2C000-memory.dmp

Filesize
816KB

Download
memory/1212-65-0x0000000000010000-0x0000000000020000-memory.dmp

Filesize
64KB

Download
memory/1212-69-0x0000000004970000-0x0000000004A8D000-memory.dmp

Filesize
1.1MB

Download
memory/1212-80-0x0000000004B60000-0x0000000004C2C000-memory.dmp

Filesize
816KB

Download
memory/1212-78-0x0000000004B60000-0x0000000004C2C000-memory.dmp

Filesize
816KB

Download
memory/1408-54-0x0000000001160000-0x000000000121C000-memory.dmp

Filesize
752KB

Download
memory/1408-56-0x00000000003A0000-0x00000000003AE000-memory.dmp

Filesize
56KB

Download
memory/1408-55-0x0000000004D00000-0x0000000004D40000-memory.dmp

Filesize
256KB

Download
memory/1408-57-0x0000000004D00000-0x0000000004D40000-memory.dmp

Filesize
256KB

Download
memory/1408-58-0x00000000051B0000-0x0000000005238000-memory.dmp

Filesize
544KB

Download
memory/1408-59-0x00000000010E0000-0x0000000001114000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing