formbook | 7998814b84f210689bf322b6867119f150c8cc76439cdc3632c8e212fd91f5e9

General

Target

Request For Price and Availability_PDF____.exe
Size

554KB
MD5

7247c2f218df48a7bd824f33f86b1760
SHA1

675a63f975c572ce3c761688a8224e80bce90cd0
SHA256

3c37386f3be133776e9754f751b88396a17d0030105646d373e82e8e0a79fe3c
SHA512

4051997473e621298980c0a0e44548f3bd648c70ac79afb10e96ea995570f3754a600aec823abab285dd370b033f8913642316f0c87e7d97b210ee30582ea372
SSDEEP

12288:8ud04ufv0zINbr57FQ6gUNYitOrlrFpIrlO+A:Rd+f3BQ6gUGVlrgr

Score

10^/10

formbook gg62 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

gg62

Decoy

refrigerators-pk.today

jajifi.fun

fivonworld.com

rangbangs.com

server-dell.com

jefevirtual.com

jobode.info

grindhardgarage.com

gaoxiba168.com

thekotturfund.com

taberla.com

santorinieshop.com

ajptqqex.click

johnjaen.com

innovantdev.com

mjofvsea2.com

yun0796.com

rokovoko.nexus

tuabogado.gratis

jqinnovation.online

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/664-9-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/664-14-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/4804-19-0x0000000000110000-0x000000000013F000-memory.dmp	formbook
behavioral2/memory/4804-21-0x0000000000110000-0x000000000013F000-memory.dmp	formbook

Suspicious use of SetThreadContext 3 IoCs

Processes:

Request For Price and Availability_PDF____.exeRequest For Price and Availability_PDF____.exemsdt.exe

description	pid	process	target process
PID 4796 set thread context of 664	4796	Request For Price and Availability_PDF____.exe	Request For Price and Availability_PDF____.exe
PID 664 set thread context of 3132	664	Request For Price and Availability_PDF____.exe	Explorer.EXE
PID 4804 set thread context of 3132	4804	msdt.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 44 IoCs

Processes:

Request For Price and Availability_PDF____.exemsdt.exe

pid	process
664	Request For Price and Availability_PDF____.exe
664	Request For Price and Availability_PDF____.exe
664	Request For Price and Availability_PDF____.exe
664	Request For Price and Availability_PDF____.exe
4804	msdt.exe
4804	msdt.exe
4804	msdt.exe
4804	msdt.exe
4804	msdt.exe
4804	msdt.exe
4804	msdt.exe
4804	msdt.exe
4804	msdt.exe
4804	msdt.exe
4804	msdt.exe
4804	msdt.exe
4804	msdt.exe
4804	msdt.exe
4804	msdt.exe
4804	msdt.exe
4804	msdt.exe
4804	msdt.exe
4804	msdt.exe
4804	msdt.exe
4804	msdt.exe
4804	msdt.exe
4804	msdt.exe
4804	msdt.exe
4804	msdt.exe
4804	msdt.exe
4804	msdt.exe
4804	msdt.exe
4804	msdt.exe
4804	msdt.exe
4804	msdt.exe
4804	msdt.exe
4804	msdt.exe
4804	msdt.exe
4804	msdt.exe
4804	msdt.exe
4804	msdt.exe
4804	msdt.exe
4804	msdt.exe
4804	msdt.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

3132 Explorer.EXE

pid	process
3132	Explorer.EXE

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

Request For Price and Availability_PDF____.exemsdt.exe

pid	process
664	Request For Price and Availability_PDF____.exe
664	Request For Price and Availability_PDF____.exe
664	Request For Price and Availability_PDF____.exe
4804	msdt.exe
4804	msdt.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Request For Price and Availability_PDF____.exemsdt.exe

description pid process

Token: SeDebugPrivilege 664 Request For Price and Availability_PDF____.exe
Token: SeDebugPrivilege 4804 msdt.exe

description	pid	process
Token: SeDebugPrivilege	664	Request For Price and Availability_PDF____.exe
Token: SeDebugPrivilege	4804	msdt.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Request For Price and Availability_PDF____.exeExplorer.EXEmsdt.exe

description	pid	process	target process
PID 4796 wrote to memory of 664	4796	Request For Price and Availability_PDF____.exe	Request For Price and Availability_PDF____.exe
PID 4796 wrote to memory of 664	4796	Request For Price and Availability_PDF____.exe	Request For Price and Availability_PDF____.exe
PID 4796 wrote to memory of 664	4796	Request For Price and Availability_PDF____.exe	Request For Price and Availability_PDF____.exe
PID 4796 wrote to memory of 664	4796	Request For Price and Availability_PDF____.exe	Request For Price and Availability_PDF____.exe
PID 4796 wrote to memory of 664	4796	Request For Price and Availability_PDF____.exe	Request For Price and Availability_PDF____.exe
PID 4796 wrote to memory of 664	4796	Request For Price and Availability_PDF____.exe	Request For Price and Availability_PDF____.exe
PID 3132 wrote to memory of 4804	3132	Explorer.EXE	msdt.exe
PID 3132 wrote to memory of 4804	3132	Explorer.EXE	msdt.exe
PID 3132 wrote to memory of 4804	3132	Explorer.EXE	msdt.exe
PID 4804 wrote to memory of 3908	4804	msdt.exe	cmd.exe
PID 4804 wrote to memory of 3908	4804	msdt.exe	cmd.exe
PID 4804 wrote to memory of 3908	4804	msdt.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3132

C:\Users\Admin\AppData\Local\Temp\Request For Price and Availability_PDF____.exe
"C:\Users\Admin\AppData\Local\Temp\Request For Price and Availability_PDF____.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4796

C:\Users\Admin\AppData\Local\Temp\Request For Price and Availability_PDF____.exe
"C:\Users\Admin\AppData\Local\Temp\Request For Price and Availability_PDF____.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:664

C:\Windows\SysWOW64\msdt.exe
"C:\Windows\SysWOW64\msdt.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4804

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\Request For Price and Availability_PDF____.exe"
3⤵
PID:3908

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/664-9-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/664-15-0x0000000000E20000-0x0000000000E35000-memory.dmp

Filesize
84KB

Download
memory/664-14-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/664-12-0x00000000012C0000-0x000000000160A000-memory.dmp

Filesize
3.3MB

Download
memory/3132-26-0x0000000008030000-0x000000000818D000-memory.dmp

Filesize
1.4MB

Download
memory/3132-25-0x0000000008030000-0x000000000818D000-memory.dmp

Filesize
1.4MB

Download
memory/3132-22-0x0000000008B50000-0x0000000008CDA000-memory.dmp

Filesize
1.5MB

Download
memory/3132-16-0x0000000008B50000-0x0000000008CDA000-memory.dmp

Filesize
1.5MB

Download
memory/4796-6-0x00000000052E0000-0x000000000537C000-memory.dmp

Filesize
624KB

Download
memory/4796-3-0x0000000005020000-0x00000000050B2000-memory.dmp

Filesize
584KB

Download
memory/4796-11-0x0000000074860000-0x0000000075010000-memory.dmp

Filesize
7.7MB

Download
memory/4796-7-0x0000000074860000-0x0000000075010000-memory.dmp

Filesize
7.7MB

Download
memory/4796-0-0x0000000074860000-0x0000000075010000-memory.dmp

Filesize
7.7MB

Download
memory/4796-5-0x00000000051D0000-0x00000000051DA000-memory.dmp

Filesize
40KB

Download
memory/4796-4-0x0000000005230000-0x0000000005240000-memory.dmp

Filesize
64KB

Download
memory/4796-8-0x0000000005230000-0x0000000005240000-memory.dmp

Filesize
64KB

Download
memory/4796-1-0x0000000000600000-0x0000000000690000-memory.dmp

Filesize
576KB

Download
memory/4796-2-0x0000000005680000-0x0000000005C24000-memory.dmp

Filesize
5.6MB

Download
memory/4804-17-0x00000000009F0000-0x0000000000A47000-memory.dmp

Filesize
348KB

Download
memory/4804-21-0x0000000000110000-0x000000000013F000-memory.dmp

Filesize
188KB

Download
memory/4804-20-0x00000000024A0000-0x00000000027EA000-memory.dmp

Filesize
3.3MB

Download
memory/4804-24-0x0000000002280000-0x0000000002314000-memory.dmp

Filesize
592KB

Download
memory/4804-19-0x0000000000110000-0x000000000013F000-memory.dmp

Filesize
188KB

Download
memory/4804-18-0x00000000009F0000-0x0000000000A47000-memory.dmp

Filesize
348KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads