formbook | 19212e9ee735e4b773671add4df8b9ac059ce9d59011238044b17643ad8e14fe

General

Target

Inv_7623980.exe
Size

711KB
MD5

9fefd93d8530102d9b1689d0aa233e51
SHA1

6c3f12a9fa864ac8c783da3f2a5b75254a692f85
SHA256

3017b026d0925919ad8085d523f83235fa84ead58d1399576e60e6183003820e
SHA512

45754db3bd5cc9d11d42f5b226efceac2b9694188e5843ccc28b103b005776e92b859f0fcdb7a192b7ed22fd00001ee21c15def22446c8deb07e2375a9ccb3e5
SSDEEP

12288:4MqBGppnzSOTzo6rv625OPX4EaxKqHcTZK9Mlr:9q0pBSOTc6Dn5MX4uq8Zz

Score

10^/10

formbook m82 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

m82

Decoy

jamesdevereux.com

artificialturfminneapolis.com

hongmeiyan.com

lojaderoupasbr.com

yit.africa

austinrelocationexpert.com

saiva.page

exitsategy.com

chochonux.com

klosterbraeu-unterliezheim.com

byseymanur.com

sblwarwickshire.co.uk

brazimaid.com

ciogame.com

bronzesailing.com

dwkapl.xyz

022dyd.com

compassandpathwriting.com

alphabet1x.com

selfcleaninghairbrush.co.uk

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1412-64-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1412-67-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/268-72-0x0000000000080000-0x00000000000AF000-memory.dmp	formbook
behavioral1/memory/268-74-0x0000000000080000-0x00000000000AF000-memory.dmp	formbook

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1740 cmd.exe

pid	process
1740	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

Inv_7623980.exeInv_7623980.exemstsc.exe

description	pid	process	target process
PID 1072 set thread context of 1412	1072	Inv_7623980.exe	Inv_7623980.exe
PID 1412 set thread context of 1356	1412	Inv_7623980.exe	Explorer.EXE
PID 268 set thread context of 1356	268	mstsc.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

Inv_7623980.exemstsc.exe

pid	process
1412	Inv_7623980.exe
1412	Inv_7623980.exe
268	mstsc.exe
268	mstsc.exe
268	mstsc.exe
268	mstsc.exe
268	mstsc.exe
268	mstsc.exe
268	mstsc.exe
268	mstsc.exe
268	mstsc.exe
268	mstsc.exe
268	mstsc.exe
268	mstsc.exe
268	mstsc.exe
268	mstsc.exe
268	mstsc.exe
268	mstsc.exe
268	mstsc.exe
268	mstsc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1356 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

Inv_7623980.exemstsc.exe

pid process

1412 Inv_7623980.exe
1412 Inv_7623980.exe
1412 Inv_7623980.exe
268 mstsc.exe
268 mstsc.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Inv_7623980.exemstsc.exe

description pid process

Token: SeDebugPrivilege 1412 Inv_7623980.exe
Token: SeDebugPrivilege 268 mstsc.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1356 Explorer.EXE
1356 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1356 Explorer.EXE
1356 Explorer.EXE

pid	process
1356	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	1412	Inv_7623980.exe
Token: SeDebugPrivilege	268	mstsc.exe

pid	process
1356	Explorer.EXE
1356	Explorer.EXE

pid	process
1356	Explorer.EXE
1356	Explorer.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

Inv_7623980.exeExplorer.EXEmstsc.exe

description	pid	process	target process
PID 1072 wrote to memory of 1412	1072	Inv_7623980.exe	Inv_7623980.exe
PID 1072 wrote to memory of 1412	1072	Inv_7623980.exe	Inv_7623980.exe
PID 1072 wrote to memory of 1412	1072	Inv_7623980.exe	Inv_7623980.exe
PID 1072 wrote to memory of 1412	1072	Inv_7623980.exe	Inv_7623980.exe
PID 1072 wrote to memory of 1412	1072	Inv_7623980.exe	Inv_7623980.exe
PID 1072 wrote to memory of 1412	1072	Inv_7623980.exe	Inv_7623980.exe
PID 1072 wrote to memory of 1412	1072	Inv_7623980.exe	Inv_7623980.exe
PID 1356 wrote to memory of 268	1356	Explorer.EXE	mstsc.exe
PID 1356 wrote to memory of 268	1356	Explorer.EXE	mstsc.exe
PID 1356 wrote to memory of 268	1356	Explorer.EXE	mstsc.exe
PID 1356 wrote to memory of 268	1356	Explorer.EXE	mstsc.exe
PID 268 wrote to memory of 1740	268	mstsc.exe	cmd.exe
PID 268 wrote to memory of 1740	268	mstsc.exe	cmd.exe
PID 268 wrote to memory of 1740	268	mstsc.exe	cmd.exe
PID 268 wrote to memory of 1740	268	mstsc.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1356

C:\Users\Admin\AppData\Local\Temp\Inv_7623980.exe
"C:\Users\Admin\AppData\Local\Temp\Inv_7623980.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1072

C:\Users\Admin\AppData\Local\Temp\Inv_7623980.exe
"C:\Users\Admin\AppData\Local\Temp\Inv_7623980.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1412

C:\Windows\SysWOW64\mstsc.exe
"C:\Windows\SysWOW64\mstsc.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:268

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\Inv_7623980.exe"
3⤵
- Deletes itself
PID:1740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/268-70-0x0000000000630000-0x0000000000734000-memory.dmp

Filesize
1.0MB

Download
memory/268-76-0x0000000002040000-0x00000000020D4000-memory.dmp

Filesize
592KB

Download
memory/268-74-0x0000000000080000-0x00000000000AF000-memory.dmp

Filesize
188KB

Download
memory/268-73-0x0000000002270000-0x0000000002573000-memory.dmp

Filesize
3.0MB

Download
memory/268-72-0x0000000000080000-0x00000000000AF000-memory.dmp

Filesize
188KB

Download
memory/268-71-0x0000000000630000-0x0000000000734000-memory.dmp

Filesize
1.0MB

Download
memory/1072-60-0x00000000008B0000-0x00000000008E8000-memory.dmp

Filesize
224KB

Download
memory/1072-56-0x0000000000410000-0x000000000041E000-memory.dmp

Filesize
56KB

Download
memory/1072-55-0x0000000004DF0000-0x0000000004E30000-memory.dmp

Filesize
256KB

Download
memory/1072-57-0x0000000004DF0000-0x0000000004E30000-memory.dmp

Filesize
256KB

Download
memory/1072-58-0x0000000000420000-0x000000000042A000-memory.dmp

Filesize
40KB

Download
memory/1072-59-0x0000000005CC0000-0x0000000005D30000-memory.dmp

Filesize
448KB

Download
memory/1072-54-0x0000000000DB0000-0x0000000000E68000-memory.dmp

Filesize
736KB

Download
memory/1356-69-0x0000000003EF0000-0x0000000003FD8000-memory.dmp

Filesize
928KB

Download
memory/1356-77-0x0000000006F50000-0x0000000007088000-memory.dmp

Filesize
1.2MB

Download
memory/1356-78-0x0000000006F50000-0x0000000007088000-memory.dmp

Filesize
1.2MB

Download
memory/1356-80-0x0000000006F50000-0x0000000007088000-memory.dmp

Filesize
1.2MB

Download
memory/1412-68-0x00000000002D0000-0x00000000002E5000-memory.dmp

Filesize
84KB

Download
memory/1412-67-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1412-66-0x0000000000910000-0x0000000000C13000-memory.dmp

Filesize
3.0MB

Download
memory/1412-64-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1412-63-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1412-61-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1412-62-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads