formbook | 2358f255cb8390a108fca6934209b56e8f72eb08dbb3708431c449fffe8338e5

General

Target

PRE ALERT KUL-BKI PNUE00951848 4511679901 Maritime n Industrial AE 455681 264-43349902 N7351 20 NOV - DDP TERMS.exe
Size

737KB
MD5

5a31e71dbdb0b31c5af2b1c1c32936ce
SHA1

aecf6320581856198779afec0c1e816961e9757d
SHA256

2358f255cb8390a108fca6934209b56e8f72eb08dbb3708431c449fffe8338e5
SHA512

0bd1fc5ded778006ebbc2d6e9288dd5665b26bebb209d7ba40e8a08aa8c36eda35ef227b39958b493f06a06ddbea477b571332b2dd86c67c0806d71bf128341b
SSDEEP

12288:A79xzQKbXOJz0XXLyw+5iCxJ2rvvLTr8aSVd1Jkx1r7HrcFxJ+O2NimOMt+:lfz0HAiCubvLTar1Jkx1r7HrcFmO2NiQ

Score

10^/10

formbook c29i rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

c29i

Decoy

chrestheryulelog.com

awesomecustomerservice.com

4455m.net

vonek76k.com

zwelishaprojects.africa

bbangnmoolgogi.com

howickmenswears.com

ba225.com

ipl2018livescore.com

ohprovider.co.uk

handymanservices.shop

1wzxtq.top

busy-people-gifts.com

invited.rsvp

heihei.fun

micloudlogin.page

hwyi1319.com

alitechnologyes.com

hysminai.com

liuyikj.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/932-65-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/932-69-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/268-75-0x00000000000C0000-0x00000000000EF000-memory.dmp	formbook

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1600 set thread context of 932	1600	PRE ALERT KUL-BKI PNUE00951848 4511679901 Maritime n Industrial AE 455681 264-43349902 N7351 20 NOV - DDP TERMS.exe	27
PID 932 set thread context of 1244	932	PRE ALERT KUL-BKI PNUE00951848 4511679901 Maritime n Industrial AE 455681 264-43349902 N7351 20 NOV - DDP TERMS.exe	14

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
932	PRE ALERT KUL-BKI PNUE00951848 4511679901 Maritime n Industrial AE 455681 264-43349902 N7351 20 NOV - DDP TERMS.exe
932	PRE ALERT KUL-BKI PNUE00951848 4511679901 Maritime n Industrial AE 455681 264-43349902 N7351 20 NOV - DDP TERMS.exe
268	systray.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1244	Explorer.EXE

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
932	PRE ALERT KUL-BKI PNUE00951848 4511679901 Maritime n Industrial AE 455681 264-43349902 N7351 20 NOV - DDP TERMS.exe
932	PRE ALERT KUL-BKI PNUE00951848 4511679901 Maritime n Industrial AE 455681 264-43349902 N7351 20 NOV - DDP TERMS.exe
932	PRE ALERT KUL-BKI PNUE00951848 4511679901 Maritime n Industrial AE 455681 264-43349902 N7351 20 NOV - DDP TERMS.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	932	PRE ALERT KUL-BKI PNUE00951848 4511679901 Maritime n Industrial AE 455681 264-43349902 N7351 20 NOV - DDP TERMS.exe
Token: SeDebugPrivilege	268	systray.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 932	1600	PRE ALERT KUL-BKI PNUE00951848 4511679901 Maritime n Industrial AE 455681 264-43349902 N7351 20 NOV - DDP TERMS.exe	27
PID 1600 wrote to memory of 932	1600	PRE ALERT KUL-BKI PNUE00951848 4511679901 Maritime n Industrial AE 455681 264-43349902 N7351 20 NOV - DDP TERMS.exe	27
PID 1600 wrote to memory of 932	1600	PRE ALERT KUL-BKI PNUE00951848 4511679901 Maritime n Industrial AE 455681 264-43349902 N7351 20 NOV - DDP TERMS.exe	27
PID 1600 wrote to memory of 932	1600	PRE ALERT KUL-BKI PNUE00951848 4511679901 Maritime n Industrial AE 455681 264-43349902 N7351 20 NOV - DDP TERMS.exe	27
PID 1600 wrote to memory of 932	1600	PRE ALERT KUL-BKI PNUE00951848 4511679901 Maritime n Industrial AE 455681 264-43349902 N7351 20 NOV - DDP TERMS.exe	27
PID 1600 wrote to memory of 932	1600	PRE ALERT KUL-BKI PNUE00951848 4511679901 Maritime n Industrial AE 455681 264-43349902 N7351 20 NOV - DDP TERMS.exe	27
PID 1600 wrote to memory of 932	1600	PRE ALERT KUL-BKI PNUE00951848 4511679901 Maritime n Industrial AE 455681 264-43349902 N7351 20 NOV - DDP TERMS.exe	27
PID 1244 wrote to memory of 268	1244	Explorer.EXE	28
PID 1244 wrote to memory of 268	1244	Explorer.EXE	28
PID 1244 wrote to memory of 268	1244	Explorer.EXE	28
PID 1244 wrote to memory of 268	1244	Explorer.EXE	28

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Users\Admin\AppData\Local\Temp\PRE ALERT KUL-BKI PNUE00951848 4511679901 Maritime n Industrial AE 455681 264-43349902 N7351 20 NOV - DDP TERMS.exe
  "C:\Users\Admin\AppData\Local\Temp\PRE ALERT KUL-BKI PNUE00951848 4511679901 Maritime n Industrial AE 455681 264-43349902 N7351 20 NOV - DDP TERMS.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1600
- - C:\Users\Admin\AppData\Local\Temp\PRE ALERT KUL-BKI PNUE00951848 4511679901 Maritime n Industrial AE 455681 264-43349902 N7351 20 NOV - DDP TERMS.exe
    "C:\Users\Admin\AppData\Local\Temp\PRE ALERT KUL-BKI PNUE00951848 4511679901 Maritime n Industrial AE 455681 264-43349902 N7351 20 NOV - DDP TERMS.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:932
- C:\Windows\SysWOW64\systray.exe
  "C:\Windows\SysWOW64\systray.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:268

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/268-76-0x0000000000B20000-0x0000000000E23000-memory.dmp

Filesize
3.0MB

Download
memory/268-75-0x00000000000C0000-0x00000000000EF000-memory.dmp

Filesize
188KB

Download
memory/268-72-0x0000000000FA0000-0x0000000000FA5000-memory.dmp

Filesize
20KB

Download
memory/268-71-0x0000000000FA0000-0x0000000000FA5000-memory.dmp

Filesize
20KB

Download
memory/932-63-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/932-69-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/932-68-0x0000000000140000-0x0000000000154000-memory.dmp

Filesize
80KB

Download
memory/932-67-0x0000000000E50000-0x0000000001153000-memory.dmp

Filesize
3.0MB

Download
memory/932-62-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/932-65-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/932-64-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1244-70-0x0000000004790000-0x0000000004876000-memory.dmp

Filesize
920KB

Download
memory/1600-61-0x0000000000A80000-0x0000000000AB8000-memory.dmp

Filesize
224KB

Download
memory/1600-60-0x0000000005A10000-0x0000000005A8C000-memory.dmp

Filesize
496KB

Download
memory/1600-59-0x0000000004DD0000-0x0000000004E10000-memory.dmp

Filesize
256KB

Download
memory/1600-54-0x0000000000D90000-0x0000000000E4E000-memory.dmp

Filesize
760KB

Download
memory/1600-58-0x0000000000370000-0x000000000037C000-memory.dmp

Filesize
48KB

Download
memory/1600-57-0x0000000004DD0000-0x0000000004E10000-memory.dmp

Filesize
256KB

Download
memory/1600-56-0x0000000000360000-0x000000000036E000-memory.dmp

Filesize
56KB

Download
memory/1600-55-0x0000000004DD0000-0x0000000004E10000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing