formbook | 9784d4f3af63382e92105496844b25bc4e42e92305b7707c3fd6451c98c391f6

General

Target

tmp.exe
Size

1.0MB
MD5

22b7779314863ab98fdb44998b720eda
SHA1

613cf1c86321deac5a0a172b4290ca9b2fe1196a
SHA256

9784d4f3af63382e92105496844b25bc4e42e92305b7707c3fd6451c98c391f6
SHA512

bf133c5723b0056d5014e06207b1a1064e15c60304e14dcad0acd5427c179685ddf6a8f152406c2c8161d62530996cb89540e360f14966a9d3fb535cfd4dc68b
SSDEEP

12288:Wpl1K8tUyZmMRxEy0g6DxV54CRNCxOR3Is2OTo65dwWm2OKQqEsPEDigaDNlhXIg:FVC8hRMOTo65dwW1OKZ7PEDqNv4WaEw

Score

10^/10

formbook dr62 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dr62

Decoy

juanbrujo.com

toptasker.africa

g-labs.one

1redbuckpermonth.com

lasolutions.online

beginagainmen.com

iearn.site

leading-car.ru

codigosindiabetes.fun

6y8ud.bond

fptmarket.shop

ctjhxv3.vip

huluxia2.xyz

piggg08.uk

kms-pico-tools.com

westonandcate.com

giftrendz.com

kqwdhrendfywefdst.top

anchitchoudhary.com

sistemodasi.net

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 5 IoCs

rat

resource	yara_rule
behavioral1/memory/1484-65-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1484-70-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1484-74-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1924-77-0x0000000000080000-0x00000000000AF000-memory.dmp	formbook
behavioral1/memory/1924-79-0x0000000000080000-0x00000000000AF000-memory.dmp	formbook

Deletes itself 1 IoCs

pid	Process
1848	cmd.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1724 set thread context of 1484	1724	tmp.exe	28
PID 1484 set thread context of 1228	1484	tmp.exe	9
PID 1484 set thread context of 1228	1484	tmp.exe	9
PID 1924 set thread context of 1228	1924	cmd.exe	9

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1484	tmp.exe
1484	tmp.exe
1484	tmp.exe
1924	cmd.exe
1924	cmd.exe
1924	cmd.exe
1924	cmd.exe
1924	cmd.exe
1924	cmd.exe
1924	cmd.exe
1924	cmd.exe
1924	cmd.exe
1924	cmd.exe
1924	cmd.exe
1924	cmd.exe
1924	cmd.exe
1924	cmd.exe
1924	cmd.exe
1924	cmd.exe
1924	cmd.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1228	Explorer.EXE

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
1484	tmp.exe
1484	tmp.exe
1484	tmp.exe
1484	tmp.exe
1924	cmd.exe
1924	cmd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1484	tmp.exe
Token: SeDebugPrivilege	1924	cmd.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1228	Explorer.EXE
1228	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1228	Explorer.EXE
1228	Explorer.EXE

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 1484	1724	tmp.exe	28
PID 1724 wrote to memory of 1484	1724	tmp.exe	28
PID 1724 wrote to memory of 1484	1724	tmp.exe	28
PID 1724 wrote to memory of 1484	1724	tmp.exe	28
PID 1724 wrote to memory of 1484	1724	tmp.exe	28
PID 1724 wrote to memory of 1484	1724	tmp.exe	28
PID 1724 wrote to memory of 1484	1724	tmp.exe	28
PID 1228 wrote to memory of 1924	1228	Explorer.EXE	29
PID 1228 wrote to memory of 1924	1228	Explorer.EXE	29
PID 1228 wrote to memory of 1924	1228	Explorer.EXE	29
PID 1228 wrote to memory of 1924	1228	Explorer.EXE	29
PID 1924 wrote to memory of 1848	1924	cmd.exe	30
PID 1924 wrote to memory of 1848	1924	cmd.exe	30
PID 1924 wrote to memory of 1848	1924	cmd.exe	30
PID 1924 wrote to memory of 1848	1924	cmd.exe	30

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Users\Admin\AppData\Local\Temp\tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1724
- - C:\Users\Admin\AppData\Local\Temp\tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:1484
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\SysWOW64\cmd.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1924
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
    3⤵
    - Deletes itself
    PID:1848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1228-71-0x0000000003B50000-0x0000000003D50000-memory.dmp

Filesize
2.0MB

Download
memory/1228-87-0x0000000004AF0000-0x0000000004C18000-memory.dmp

Filesize
1.2MB

Download
memory/1228-84-0x0000000004AF0000-0x0000000004C18000-memory.dmp

Filesize
1.2MB

Download
memory/1228-83-0x0000000004AF0000-0x0000000004C18000-memory.dmp

Filesize
1.2MB

Download
memory/1228-81-0x0000000003B50000-0x0000000003D50000-memory.dmp

Filesize
2.0MB

Download
memory/1228-69-0x00000000061B0000-0x00000000062F4000-memory.dmp

Filesize
1.3MB

Download
memory/1228-73-0x0000000006300000-0x000000000643C000-memory.dmp

Filesize
1.2MB

Download
memory/1484-62-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1484-72-0x0000000000260000-0x0000000000274000-memory.dmp

Filesize
80KB

Download
memory/1484-63-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1484-64-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1484-65-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1484-67-0x0000000000840000-0x0000000000B43000-memory.dmp

Filesize
3.0MB

Download
memory/1484-68-0x0000000000210000-0x0000000000224000-memory.dmp

Filesize
80KB

Download
memory/1484-74-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1484-70-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1724-61-0x00000000007A0000-0x00000000007E0000-memory.dmp

Filesize
256KB

Download
memory/1724-58-0x00000000002D0000-0x00000000002DC000-memory.dmp

Filesize
48KB

Download
memory/1724-60-0x0000000000770000-0x0000000000776000-memory.dmp

Filesize
24KB

Download
memory/1724-59-0x00000000056F0000-0x00000000057A6000-memory.dmp

Filesize
728KB

Download
memory/1724-55-0x0000000000490000-0x00000000004AC000-memory.dmp

Filesize
112KB

Download
memory/1724-56-0x0000000004EC0000-0x0000000004F00000-memory.dmp

Filesize
256KB

Download
memory/1724-57-0x0000000004EC0000-0x0000000004F00000-memory.dmp

Filesize
256KB

Download
memory/1724-54-0x0000000000DD0000-0x0000000000ED8000-memory.dmp

Filesize
1.0MB

Download
memory/1924-78-0x0000000001E20000-0x0000000002123000-memory.dmp

Filesize
3.0MB

Download
memory/1924-79-0x0000000000080000-0x00000000000AF000-memory.dmp

Filesize
188KB

Download
memory/1924-82-0x00000000022E0000-0x0000000002373000-memory.dmp

Filesize
588KB

Download
memory/1924-77-0x0000000000080000-0x00000000000AF000-memory.dmp

Filesize
188KB

Download
memory/1924-76-0x000000004AC10000-0x000000004AC5C000-memory.dmp

Filesize
304KB

Download
memory/1924-75-0x000000004AC10000-0x000000004AC5C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing