formbook | 8e1579332c108b91cf104ac63a80be9cabcd918086bcd27248e59467776fc863

General

Target

8e1579332c108b91cf104ac63a80be9cabcd918086bcd27248e59467776fc863exe_JC.exe
Size

689KB
MD5

549506be461e63f925b424b2f6011916
SHA1

809e73cea714e24c15f65c27eff6371723149323
SHA256

8e1579332c108b91cf104ac63a80be9cabcd918086bcd27248e59467776fc863
SHA512

0c254f269004b3999284fb9e4bacc71082be27d7a178106bcb9150e2bf66723d98f0755fae8eda8f05ed24aeabf8ef49eb91556ed417b7c6ecec6dcbb04ad6b4
SSDEEP

12288:S5MYH1VTW4TmZnXmQtXQ7SHbtvTug/gjtkb9:S6wrbTmJmQtXQ7S7tvTuacCb9

Score

10^/10

formbook sy22 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

sy22

Decoy

vinteligencia.com

displayfridges.fun

completetip.com

giallozafferrano.com

jizihao1.com

mysticheightstrail.com

fourseasonslb.com

kjnala.shop

mosiacwall.com

vandistreet.com

gracefullytouchedartistry.com

hbiwhwr.shop

mfmz.net

hrmbrillianz.com

funwarsztat.com

polewithcandy.com

ourrajasthan.com

wilhouettteamerica.com

johnnystintshop.com

asgnelwin.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/1368-142-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4856 set thread context of 1368	4856	8e1579332c108b91cf104ac63a80be9cabcd918086bcd27248e59467776fc863exe_JC.exe	93

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4856	8e1579332c108b91cf104ac63a80be9cabcd918086bcd27248e59467776fc863exe_JC.exe
4856	8e1579332c108b91cf104ac63a80be9cabcd918086bcd27248e59467776fc863exe_JC.exe
4856	8e1579332c108b91cf104ac63a80be9cabcd918086bcd27248e59467776fc863exe_JC.exe
4856	8e1579332c108b91cf104ac63a80be9cabcd918086bcd27248e59467776fc863exe_JC.exe
4856	8e1579332c108b91cf104ac63a80be9cabcd918086bcd27248e59467776fc863exe_JC.exe
4856	8e1579332c108b91cf104ac63a80be9cabcd918086bcd27248e59467776fc863exe_JC.exe
1368	8e1579332c108b91cf104ac63a80be9cabcd918086bcd27248e59467776fc863exe_JC.exe
1368	8e1579332c108b91cf104ac63a80be9cabcd918086bcd27248e59467776fc863exe_JC.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4856	8e1579332c108b91cf104ac63a80be9cabcd918086bcd27248e59467776fc863exe_JC.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 1612	4856	8e1579332c108b91cf104ac63a80be9cabcd918086bcd27248e59467776fc863exe_JC.exe	90
PID 4856 wrote to memory of 1612	4856	8e1579332c108b91cf104ac63a80be9cabcd918086bcd27248e59467776fc863exe_JC.exe	90
PID 4856 wrote to memory of 1612	4856	8e1579332c108b91cf104ac63a80be9cabcd918086bcd27248e59467776fc863exe_JC.exe	90
PID 4856 wrote to memory of 1424	4856	8e1579332c108b91cf104ac63a80be9cabcd918086bcd27248e59467776fc863exe_JC.exe	91
PID 4856 wrote to memory of 1424	4856	8e1579332c108b91cf104ac63a80be9cabcd918086bcd27248e59467776fc863exe_JC.exe	91
PID 4856 wrote to memory of 1424	4856	8e1579332c108b91cf104ac63a80be9cabcd918086bcd27248e59467776fc863exe_JC.exe	91
PID 4856 wrote to memory of 3092	4856	8e1579332c108b91cf104ac63a80be9cabcd918086bcd27248e59467776fc863exe_JC.exe	92
PID 4856 wrote to memory of 3092	4856	8e1579332c108b91cf104ac63a80be9cabcd918086bcd27248e59467776fc863exe_JC.exe	92
PID 4856 wrote to memory of 3092	4856	8e1579332c108b91cf104ac63a80be9cabcd918086bcd27248e59467776fc863exe_JC.exe	92
PID 4856 wrote to memory of 1368	4856	8e1579332c108b91cf104ac63a80be9cabcd918086bcd27248e59467776fc863exe_JC.exe	93
PID 4856 wrote to memory of 1368	4856	8e1579332c108b91cf104ac63a80be9cabcd918086bcd27248e59467776fc863exe_JC.exe	93
PID 4856 wrote to memory of 1368	4856	8e1579332c108b91cf104ac63a80be9cabcd918086bcd27248e59467776fc863exe_JC.exe	93
PID 4856 wrote to memory of 1368	4856	8e1579332c108b91cf104ac63a80be9cabcd918086bcd27248e59467776fc863exe_JC.exe	93
PID 4856 wrote to memory of 1368	4856	8e1579332c108b91cf104ac63a80be9cabcd918086bcd27248e59467776fc863exe_JC.exe	93
PID 4856 wrote to memory of 1368	4856	8e1579332c108b91cf104ac63a80be9cabcd918086bcd27248e59467776fc863exe_JC.exe	93

C:\Users\Admin\AppData\Local\Temp\8e1579332c108b91cf104ac63a80be9cabcd918086bcd27248e59467776fc863exe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\8e1579332c108b91cf104ac63a80be9cabcd918086bcd27248e59467776fc863exe_JC.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Users\Admin\AppData\Local\Temp\8e1579332c108b91cf104ac63a80be9cabcd918086bcd27248e59467776fc863exe_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\8e1579332c108b91cf104ac63a80be9cabcd918086bcd27248e59467776fc863exe_JC.exe"
  2⤵
  PID:1612
- C:\Users\Admin\AppData\Local\Temp\8e1579332c108b91cf104ac63a80be9cabcd918086bcd27248e59467776fc863exe_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\8e1579332c108b91cf104ac63a80be9cabcd918086bcd27248e59467776fc863exe_JC.exe"
  2⤵
  PID:1424
- C:\Users\Admin\AppData\Local\Temp\8e1579332c108b91cf104ac63a80be9cabcd918086bcd27248e59467776fc863exe_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\8e1579332c108b91cf104ac63a80be9cabcd918086bcd27248e59467776fc863exe_JC.exe"
  2⤵
  PID:3092
- C:\Users\Admin\AppData\Local\Temp\8e1579332c108b91cf104ac63a80be9cabcd918086bcd27248e59467776fc863exe_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\8e1579332c108b91cf104ac63a80be9cabcd918086bcd27248e59467776fc863exe_JC.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1368-142-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1368-145-0x00000000019B0000-0x0000000001CFA000-memory.dmp

Filesize
3.3MB

Download
memory/4856-133-0x0000000074800000-0x0000000074FB0000-memory.dmp

Filesize
7.7MB

Download
memory/4856-134-0x0000000000950000-0x0000000000A02000-memory.dmp

Filesize
712KB

Download
memory/4856-135-0x00000000058D0000-0x0000000005E74000-memory.dmp

Filesize
5.6MB

Download
memory/4856-136-0x0000000005400000-0x0000000005492000-memory.dmp

Filesize
584KB

Download
memory/4856-137-0x00000000055E0000-0x00000000055F0000-memory.dmp

Filesize
64KB

Download
memory/4856-138-0x00000000054B0000-0x00000000054BA000-memory.dmp

Filesize
40KB

Download
memory/4856-139-0x0000000074800000-0x0000000074FB0000-memory.dmp

Filesize
7.7MB

Download
memory/4856-140-0x00000000055E0000-0x00000000055F0000-memory.dmp

Filesize
64KB

Download
memory/4856-141-0x000000000AA50000-0x000000000AAEC000-memory.dmp

Filesize
624KB

Download
memory/4856-144-0x0000000074800000-0x0000000074FB0000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing