formbook | 89d2909907c3d2b6d07e0b7cec15705f783ec6df833ca12ef42eeb7c147686cf

General

Target

Documents.exe
Size

599KB
MD5

aab26eba1f556bd11895e4704aaedd34
SHA1

de4a5a4b15952761044f90aaf2a3e348fa243c3f
SHA256

89d2909907c3d2b6d07e0b7cec15705f783ec6df833ca12ef42eeb7c147686cf
SHA512

84e6a51d2d4f65af68db92ba214de1f8edd7f2568799c364cee2a30fc77106e73bd8e07e8b4fb0e3a0a54cb803fde791fb28eb941a1996de6d043eee5113a897
SSDEEP

12288:deQPMKqnAoON2bvuG9liBAZd8E5A8DSjA/OqW:deQPwnKEumliADp5ADhqW

Score

10^/10

formbook m82 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

m82

Decoy

jamesdevereux.com

artificialturfminneapolis.com

hongmeiyan.com

lojaderoupasbr.com

yit.africa

austinrelocationexpert.com

saiva.page

exitsategy.com

chochonux.com

klosterbraeu-unterliezheim.com

byseymanur.com

sblwarwickshire.co.uk

brazimaid.com

ciogame.com

bronzesailing.com

dwkapl.xyz

022dyd.com

compassandpathwriting.com

alphabet1x.com

selfcleaninghairbrush.co.uk

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 4 IoCs

rat

resource	yara_rule
behavioral1/memory/1708-64-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1708-68-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1940-73-0x0000000000080000-0x00000000000AF000-memory.dmp	formbook
behavioral1/memory/1940-75-0x0000000000080000-0x00000000000AF000-memory.dmp	formbook

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2012 set thread context of 1708	2012	Documents.exe	27
PID 1708 set thread context of 1396	1708	RegSvcs.exe	12
PID 1940 set thread context of 1396	1940	msdt.exe	12

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
1708	RegSvcs.exe
1708	RegSvcs.exe
1940	msdt.exe
1940	msdt.exe
1940	msdt.exe
1940	msdt.exe
1940	msdt.exe
1940	msdt.exe
1940	msdt.exe
1940	msdt.exe
1940	msdt.exe
1940	msdt.exe
1940	msdt.exe
1940	msdt.exe
1940	msdt.exe
1940	msdt.exe
1940	msdt.exe
1940	msdt.exe
1940	msdt.exe
1940	msdt.exe
1940	msdt.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1396	Explorer.EXE

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
1708	RegSvcs.exe
1708	RegSvcs.exe
1708	RegSvcs.exe
1940	msdt.exe
1940	msdt.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2012	Documents.exe
Token: SeDebugPrivilege	1708	RegSvcs.exe
Token: SeDebugPrivilege	1940	msdt.exe
Token: SeShutdownPrivilege	1396	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1396	Explorer.EXE
1396	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1396	Explorer.EXE
1396	Explorer.EXE

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 1708	2012	Documents.exe	27
PID 2012 wrote to memory of 1708	2012	Documents.exe	27
PID 2012 wrote to memory of 1708	2012	Documents.exe	27
PID 2012 wrote to memory of 1708	2012	Documents.exe	27
PID 2012 wrote to memory of 1708	2012	Documents.exe	27
PID 2012 wrote to memory of 1708	2012	Documents.exe	27
PID 2012 wrote to memory of 1708	2012	Documents.exe	27
PID 2012 wrote to memory of 1708	2012	Documents.exe	27
PID 2012 wrote to memory of 1708	2012	Documents.exe	27
PID 2012 wrote to memory of 1708	2012	Documents.exe	27
PID 1396 wrote to memory of 1940	1396	Explorer.EXE	28
PID 1396 wrote to memory of 1940	1396	Explorer.EXE	28
PID 1396 wrote to memory of 1940	1396	Explorer.EXE	28
PID 1396 wrote to memory of 1940	1396	Explorer.EXE	28
PID 1940 wrote to memory of 656	1940	msdt.exe	29
PID 1940 wrote to memory of 656	1940	msdt.exe	29
PID 1940 wrote to memory of 656	1940	msdt.exe	29
PID 1940 wrote to memory of 656	1940	msdt.exe	29

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Users\Admin\AppData\Local\Temp\Documents.exe
  "C:\Users\Admin\AppData\Local\Temp\Documents.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2012
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "{path}"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:1708
- C:\Windows\SysWOW64\msdt.exe
  "C:\Windows\SysWOW64\msdt.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    PID:656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1396-82-0x00000000069D0000-0x0000000006AF2000-memory.dmp

Filesize
1.1MB

Download
memory/1396-80-0x00000000069D0000-0x0000000006AF2000-memory.dmp

Filesize
1.1MB

Download
memory/1396-79-0x00000000069D0000-0x0000000006AF2000-memory.dmp

Filesize
1.1MB

Download
memory/1396-76-0x0000000004C40000-0x0000000004D1E000-memory.dmp

Filesize
888KB

Download
memory/1396-69-0x0000000004C40000-0x0000000004D1E000-memory.dmp

Filesize
888KB

Download
memory/1708-68-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1708-66-0x0000000000BB0000-0x0000000000EB3000-memory.dmp

Filesize
3.0MB

Download
memory/1708-61-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1708-62-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1708-63-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1708-64-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1708-67-0x0000000000190000-0x00000000001A5000-memory.dmp

Filesize
84KB

Download
memory/1940-74-0x00000000023F0000-0x00000000026F3000-memory.dmp

Filesize
3.0MB

Download
memory/1940-70-0x0000000000EF0000-0x0000000000FE4000-memory.dmp

Filesize
976KB

Download
memory/1940-71-0x0000000000EF0000-0x0000000000FE4000-memory.dmp

Filesize
976KB

Download
memory/1940-73-0x0000000000080000-0x00000000000AF000-memory.dmp

Filesize
188KB

Download
memory/1940-75-0x0000000000080000-0x00000000000AF000-memory.dmp

Filesize
188KB

Download
memory/1940-77-0x0000000000590000-0x0000000000624000-memory.dmp

Filesize
592KB

Download
memory/2012-60-0x0000000002020000-0x0000000002054000-memory.dmp

Filesize
208KB

Download
memory/2012-59-0x0000000005D60000-0x0000000005DE4000-memory.dmp

Filesize
528KB

Download
memory/2012-54-0x0000000000990000-0x0000000000A2C000-memory.dmp

Filesize
624KB

Download
memory/2012-58-0x000000007EF40000-0x000000007EF50000-memory.dmp

Filesize
64KB

Download
memory/2012-57-0x000000007EF40000-0x000000007EF50000-memory.dmp

Filesize
64KB

Download
memory/2012-56-0x00000000004F0000-0x00000000004FC000-memory.dmp

Filesize
48KB

Download
memory/2012-55-0x0000000004E00000-0x0000000004E40000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing