formbook | 7998814b84f210689bf322b6867119f150c8cc76439cdc3632c8e212fd91f5e9

General

Target

Request For Price and Availability_PDF____.exe
Size

554KB
MD5

7247c2f218df48a7bd824f33f86b1760
SHA1

675a63f975c572ce3c761688a8224e80bce90cd0
SHA256

3c37386f3be133776e9754f751b88396a17d0030105646d373e82e8e0a79fe3c
SHA512

4051997473e621298980c0a0e44548f3bd648c70ac79afb10e96ea995570f3754a600aec823abab285dd370b033f8913642316f0c87e7d97b210ee30582ea372
SSDEEP

12288:8ud04ufv0zINbr57FQ6gUNYitOrlrFpIrlO+A:Rd+f3BQ6gUGVlrgr

Score

10^/10

formbook gg62 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

gg62

Decoy

refrigerators-pk.today

jajifi.fun

fivonworld.com

rangbangs.com

server-dell.com

jefevirtual.com

jobode.info

grindhardgarage.com

gaoxiba168.com

thekotturfund.com

taberla.com

santorinieshop.com

ajptqqex.click

johnjaen.com

innovantdev.com

mjofvsea2.com

yun0796.com

rokovoko.nexus

tuabogado.gratis

jqinnovation.online

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 5 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2168-12-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/2168-16-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/2168-20-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/2476-26-0x0000000000080000-0x00000000000AF000-memory.dmp	formbook
behavioral1/memory/2476-28-0x0000000000080000-0x00000000000AF000-memory.dmp	formbook

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2680 cmd.exe

pid	process
2680	cmd.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

Request For Price and Availability_PDF____.exeRequest For Price and Availability_PDF____.execontrol.exe

description	pid	process	target process
PID 1396 set thread context of 2168	1396	Request For Price and Availability_PDF____.exe	Request For Price and Availability_PDF____.exe
PID 2168 set thread context of 1280	2168	Request For Price and Availability_PDF____.exe	Explorer.EXE
PID 2168 set thread context of 1280	2168	Request For Price and Availability_PDF____.exe	Explorer.EXE
PID 2476 set thread context of 1280	2476	control.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 23 IoCs

Processes:

Request For Price and Availability_PDF____.execontrol.exe

pid	process
2168	Request For Price and Availability_PDF____.exe
2168	Request For Price and Availability_PDF____.exe
2168	Request For Price and Availability_PDF____.exe
2476	control.exe
2476	control.exe
2476	control.exe
2476	control.exe
2476	control.exe
2476	control.exe
2476	control.exe
2476	control.exe
2476	control.exe
2476	control.exe
2476	control.exe
2476	control.exe
2476	control.exe
2476	control.exe
2476	control.exe
2476	control.exe
2476	control.exe
2476	control.exe
2476	control.exe
2476	control.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1280 Explorer.EXE

pid	process
1280	Explorer.EXE

Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

Request For Price and Availability_PDF____.execontrol.exe

pid	process
2168	Request For Price and Availability_PDF____.exe
2168	Request For Price and Availability_PDF____.exe
2168	Request For Price and Availability_PDF____.exe
2168	Request For Price and Availability_PDF____.exe
2476	control.exe
2476	control.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Request For Price and Availability_PDF____.execontrol.exe

description pid process

Token: SeDebugPrivilege 2168 Request For Price and Availability_PDF____.exe
Token: SeDebugPrivilege 2476 control.exe

description	pid	process
Token: SeDebugPrivilege	2168	Request For Price and Availability_PDF____.exe
Token: SeDebugPrivilege	2476	control.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

Request For Price and Availability_PDF____.exeExplorer.EXEcontrol.exe

description	pid	process	target process
PID 1396 wrote to memory of 2168	1396	Request For Price and Availability_PDF____.exe	Request For Price and Availability_PDF____.exe
PID 1396 wrote to memory of 2168	1396	Request For Price and Availability_PDF____.exe	Request For Price and Availability_PDF____.exe
PID 1396 wrote to memory of 2168	1396	Request For Price and Availability_PDF____.exe	Request For Price and Availability_PDF____.exe
PID 1396 wrote to memory of 2168	1396	Request For Price and Availability_PDF____.exe	Request For Price and Availability_PDF____.exe
PID 1396 wrote to memory of 2168	1396	Request For Price and Availability_PDF____.exe	Request For Price and Availability_PDF____.exe
PID 1396 wrote to memory of 2168	1396	Request For Price and Availability_PDF____.exe	Request For Price and Availability_PDF____.exe
PID 1396 wrote to memory of 2168	1396	Request For Price and Availability_PDF____.exe	Request For Price and Availability_PDF____.exe
PID 1280 wrote to memory of 2476	1280	Explorer.EXE	control.exe
PID 1280 wrote to memory of 2476	1280	Explorer.EXE	control.exe
PID 1280 wrote to memory of 2476	1280	Explorer.EXE	control.exe
PID 1280 wrote to memory of 2476	1280	Explorer.EXE	control.exe
PID 2476 wrote to memory of 2680	2476	control.exe	cmd.exe
PID 2476 wrote to memory of 2680	2476	control.exe	cmd.exe
PID 2476 wrote to memory of 2680	2476	control.exe	cmd.exe
PID 2476 wrote to memory of 2680	2476	control.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1280

C:\Users\Admin\AppData\Local\Temp\Request For Price and Availability_PDF____.exe
"C:\Users\Admin\AppData\Local\Temp\Request For Price and Availability_PDF____.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1396

C:\Users\Admin\AppData\Local\Temp\Request For Price and Availability_PDF____.exe
"C:\Users\Admin\AppData\Local\Temp\Request For Price and Availability_PDF____.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2168

C:\Windows\SysWOW64\control.exe
"C:\Windows\SysWOW64\control.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2476

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\Request For Price and Availability_PDF____.exe"
3⤵
- Deletes itself
PID:2680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1280-36-0x0000000009230000-0x000000000939A000-memory.dmp

Filesize
1.4MB

Download
memory/1280-22-0x0000000008750000-0x0000000008860000-memory.dmp

Filesize
1.1MB

Download
memory/1280-25-0x00000000083C0000-0x00000000084E2000-memory.dmp

Filesize
1.1MB

Download
memory/1280-29-0x0000000008750000-0x0000000008860000-memory.dmp

Filesize
1.1MB

Download
memory/1280-18-0x00000000083C0000-0x00000000084E2000-memory.dmp

Filesize
1.1MB

Download
memory/1280-33-0x0000000009230000-0x000000000939A000-memory.dmp

Filesize
1.4MB

Download
memory/1280-34-0x0000000009230000-0x000000000939A000-memory.dmp

Filesize
1.4MB

Download
memory/1396-4-0x0000000073CE0000-0x00000000743CE000-memory.dmp

Filesize
6.9MB

Download
memory/1396-7-0x0000000004D70000-0x0000000004DDE000-memory.dmp

Filesize
440KB

Download
memory/1396-6-0x00000000003B0000-0x00000000003BE000-memory.dmp

Filesize
56KB

Download
memory/1396-5-0x0000000004DE0000-0x0000000004E20000-memory.dmp

Filesize
256KB

Download
memory/1396-3-0x0000000000340000-0x0000000000354000-memory.dmp

Filesize
80KB

Download
memory/1396-13-0x0000000073CE0000-0x00000000743CE000-memory.dmp

Filesize
6.9MB

Download
memory/1396-2-0x0000000004DE0000-0x0000000004E20000-memory.dmp

Filesize
256KB

Download
memory/1396-0-0x0000000000BC0000-0x0000000000C50000-memory.dmp

Filesize
576KB

Download
memory/1396-1-0x0000000073CE0000-0x00000000743CE000-memory.dmp

Filesize
6.9MB

Download
memory/2168-16-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2168-12-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2168-21-0x00000000002C0000-0x00000000002D5000-memory.dmp

Filesize
84KB

Download
memory/2168-17-0x0000000000270000-0x0000000000285000-memory.dmp

Filesize
84KB

Download
memory/2168-20-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2168-8-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2168-14-0x0000000000C50000-0x0000000000F53000-memory.dmp

Filesize
3.0MB

Download
memory/2168-9-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2168-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2476-23-0x0000000000EC0000-0x0000000000EDF000-memory.dmp

Filesize
124KB

Download
memory/2476-28-0x0000000000080000-0x00000000000AF000-memory.dmp

Filesize
188KB

Download
memory/2476-31-0x0000000000950000-0x00000000009E4000-memory.dmp

Filesize
592KB

Download
memory/2476-27-0x0000000000BB0000-0x0000000000EB3000-memory.dmp

Filesize
3.0MB

Download
memory/2476-26-0x0000000000080000-0x00000000000AF000-memory.dmp

Filesize
188KB

Download
memory/2476-24-0x0000000000EC0000-0x0000000000EDF000-memory.dmp

Filesize
124KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads