formbook | d8a138fbcb8fd354203f749dcd8e70f21a19af4935bb3cd9f34fa3ac74ce561b

General

Target

c643ce9cf3045a605b3ed588dc7e992de791468c841013fcdb310e751b237ad3.exe
Size

718KB
MD5

d67d9bf7354e7969abe6a4ced998b145
SHA1

12ac15d5eb62eb68f88d6bd149497a57e43e6fa2
SHA256

c643ce9cf3045a605b3ed588dc7e992de791468c841013fcdb310e751b237ad3
SHA512

e7c15ba7dbbdd0d7ea7103079feead806252dbf80a0d129f15c400614703e3380d1c6c68984dad1f932d5ef7d10a28867667ee5fc13413498546ad41d3806204
SSDEEP

12288:0ZgjjkkCS3OydyH73bJ4gnVfo2ZQTR23onxpQH3oJSAT1i1NFW49Mx:0ZgjjkkCSPySN2ZQk4nxQ3cF0Mx

Score

10^/10

formbook btrd rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

btrd

Decoy

toulouse.gold

launchyouglobal.com

margarita-services.com

dasnail.club

casa-hilo.com

hardscapesofflorida.com

thepositivitypulse.com

kkmyanev.cfd

love6ace22.top

castorcruise.com

chch6.com

h59f07jy.cfd

saatvikteerthyatra.com

fxsecuretrading-option.com

mostbet-k1o.click

36-m.beauty

ko-or-a-news.com

eurekatextile.com

gynlkj.com

deepsouthcraftsman.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/4752-140-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1620 set thread context of 4752	1620	c643ce9cf3045a605b3ed588dc7e992de791468c841013fcdb310e751b237ad3.exe	95

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1620	c643ce9cf3045a605b3ed588dc7e992de791468c841013fcdb310e751b237ad3.exe
1620	c643ce9cf3045a605b3ed588dc7e992de791468c841013fcdb310e751b237ad3.exe
1620	c643ce9cf3045a605b3ed588dc7e992de791468c841013fcdb310e751b237ad3.exe
1620	c643ce9cf3045a605b3ed588dc7e992de791468c841013fcdb310e751b237ad3.exe
1620	c643ce9cf3045a605b3ed588dc7e992de791468c841013fcdb310e751b237ad3.exe
1620	c643ce9cf3045a605b3ed588dc7e992de791468c841013fcdb310e751b237ad3.exe
1620	c643ce9cf3045a605b3ed588dc7e992de791468c841013fcdb310e751b237ad3.exe
1620	c643ce9cf3045a605b3ed588dc7e992de791468c841013fcdb310e751b237ad3.exe
4752	c643ce9cf3045a605b3ed588dc7e992de791468c841013fcdb310e751b237ad3.exe
4752	c643ce9cf3045a605b3ed588dc7e992de791468c841013fcdb310e751b237ad3.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1620	c643ce9cf3045a605b3ed588dc7e992de791468c841013fcdb310e751b237ad3.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 2184	1620	c643ce9cf3045a605b3ed588dc7e992de791468c841013fcdb310e751b237ad3.exe	91
PID 1620 wrote to memory of 2184	1620	c643ce9cf3045a605b3ed588dc7e992de791468c841013fcdb310e751b237ad3.exe	91
PID 1620 wrote to memory of 2184	1620	c643ce9cf3045a605b3ed588dc7e992de791468c841013fcdb310e751b237ad3.exe	91
PID 1620 wrote to memory of 2312	1620	c643ce9cf3045a605b3ed588dc7e992de791468c841013fcdb310e751b237ad3.exe	92
PID 1620 wrote to memory of 2312	1620	c643ce9cf3045a605b3ed588dc7e992de791468c841013fcdb310e751b237ad3.exe	92
PID 1620 wrote to memory of 2312	1620	c643ce9cf3045a605b3ed588dc7e992de791468c841013fcdb310e751b237ad3.exe	92
PID 1620 wrote to memory of 2500	1620	c643ce9cf3045a605b3ed588dc7e992de791468c841013fcdb310e751b237ad3.exe	93
PID 1620 wrote to memory of 2500	1620	c643ce9cf3045a605b3ed588dc7e992de791468c841013fcdb310e751b237ad3.exe	93
PID 1620 wrote to memory of 2500	1620	c643ce9cf3045a605b3ed588dc7e992de791468c841013fcdb310e751b237ad3.exe	93
PID 1620 wrote to memory of 2108	1620	c643ce9cf3045a605b3ed588dc7e992de791468c841013fcdb310e751b237ad3.exe	94
PID 1620 wrote to memory of 2108	1620	c643ce9cf3045a605b3ed588dc7e992de791468c841013fcdb310e751b237ad3.exe	94
PID 1620 wrote to memory of 2108	1620	c643ce9cf3045a605b3ed588dc7e992de791468c841013fcdb310e751b237ad3.exe	94
PID 1620 wrote to memory of 4752	1620	c643ce9cf3045a605b3ed588dc7e992de791468c841013fcdb310e751b237ad3.exe	95
PID 1620 wrote to memory of 4752	1620	c643ce9cf3045a605b3ed588dc7e992de791468c841013fcdb310e751b237ad3.exe	95
PID 1620 wrote to memory of 4752	1620	c643ce9cf3045a605b3ed588dc7e992de791468c841013fcdb310e751b237ad3.exe	95
PID 1620 wrote to memory of 4752	1620	c643ce9cf3045a605b3ed588dc7e992de791468c841013fcdb310e751b237ad3.exe	95
PID 1620 wrote to memory of 4752	1620	c643ce9cf3045a605b3ed588dc7e992de791468c841013fcdb310e751b237ad3.exe	95
PID 1620 wrote to memory of 4752	1620	c643ce9cf3045a605b3ed588dc7e992de791468c841013fcdb310e751b237ad3.exe	95

C:\Users\Admin\AppData\Local\Temp\c643ce9cf3045a605b3ed588dc7e992de791468c841013fcdb310e751b237ad3.exe
"C:\Users\Admin\AppData\Local\Temp\c643ce9cf3045a605b3ed588dc7e992de791468c841013fcdb310e751b237ad3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Users\Admin\AppData\Local\Temp\c643ce9cf3045a605b3ed588dc7e992de791468c841013fcdb310e751b237ad3.exe
  "C:\Users\Admin\AppData\Local\Temp\c643ce9cf3045a605b3ed588dc7e992de791468c841013fcdb310e751b237ad3.exe"
  2⤵
  PID:2184
- C:\Users\Admin\AppData\Local\Temp\c643ce9cf3045a605b3ed588dc7e992de791468c841013fcdb310e751b237ad3.exe
  "C:\Users\Admin\AppData\Local\Temp\c643ce9cf3045a605b3ed588dc7e992de791468c841013fcdb310e751b237ad3.exe"
  2⤵
  PID:2312
- C:\Users\Admin\AppData\Local\Temp\c643ce9cf3045a605b3ed588dc7e992de791468c841013fcdb310e751b237ad3.exe
  "C:\Users\Admin\AppData\Local\Temp\c643ce9cf3045a605b3ed588dc7e992de791468c841013fcdb310e751b237ad3.exe"
  2⤵
  PID:2500
- C:\Users\Admin\AppData\Local\Temp\c643ce9cf3045a605b3ed588dc7e992de791468c841013fcdb310e751b237ad3.exe
  "C:\Users\Admin\AppData\Local\Temp\c643ce9cf3045a605b3ed588dc7e992de791468c841013fcdb310e751b237ad3.exe"
  2⤵
  PID:2108
- C:\Users\Admin\AppData\Local\Temp\c643ce9cf3045a605b3ed588dc7e992de791468c841013fcdb310e751b237ad3.exe
  "C:\Users\Admin\AppData\Local\Temp\c643ce9cf3045a605b3ed588dc7e992de791468c841013fcdb310e751b237ad3.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1620-133-0x00000000009F0000-0x0000000000AAA000-memory.dmp

Filesize
744KB

Download
memory/1620-134-0x0000000005850000-0x0000000005DF4000-memory.dmp

Filesize
5.6MB

Download
memory/1620-135-0x0000000005340000-0x00000000053D2000-memory.dmp

Filesize
584KB

Download
memory/1620-136-0x0000000005330000-0x000000000533A000-memory.dmp

Filesize
40KB

Download
memory/1620-137-0x0000000005550000-0x0000000005560000-memory.dmp

Filesize
64KB

Download
memory/1620-138-0x0000000005550000-0x0000000005560000-memory.dmp

Filesize
64KB

Download
memory/1620-139-0x0000000008350000-0x00000000083EC000-memory.dmp

Filesize
624KB

Download
memory/4752-140-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4752-142-0x0000000001C10000-0x0000000001F5A000-memory.dmp

Filesize
3.3MB

Download

Analysis

Sharing