formbook | 7998814b84f210689bf322b6867119f150c8cc76439cdc3632c8e212fd91f5e9

General

Target

Request For Price and Availability_PDF____.exe
Size

554KB
MD5

7247c2f218df48a7bd824f33f86b1760
SHA1

675a63f975c572ce3c761688a8224e80bce90cd0
SHA256

3c37386f3be133776e9754f751b88396a17d0030105646d373e82e8e0a79fe3c
SHA512

4051997473e621298980c0a0e44548f3bd648c70ac79afb10e96ea995570f3754a600aec823abab285dd370b033f8913642316f0c87e7d97b210ee30582ea372
SSDEEP

12288:8ud04ufv0zINbr57FQ6gUNYitOrlrFpIrlO+A:Rd+f3BQ6gUGVlrgr

Score

10^/10

formbook gg62 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

gg62

Decoy

refrigerators-pk.today

jajifi.fun

fivonworld.com

rangbangs.com

server-dell.com

jefevirtual.com

jobode.info

grindhardgarage.com

gaoxiba168.com

thekotturfund.com

taberla.com

santorinieshop.com

ajptqqex.click

johnjaen.com

innovantdev.com

mjofvsea2.com

yun0796.com

rokovoko.nexus

tuabogado.gratis

jqinnovation.online

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2348-14-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/2348-18-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/2016-23-0x0000000000070000-0x000000000009F000-memory.dmp	formbook
behavioral1/memory/2016-25-0x0000000000070000-0x000000000009F000-memory.dmp	formbook

Blocklisted process makes network request 1 IoCs

Processes:

cscript.exe

flow pid process

8 2016 cscript.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2740 cmd.exe

flow	pid	process
8	2016	cscript.exe

pid	process
2740	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

Request For Price and Availability_PDF____.exeRequest For Price and Availability_PDF____.execscript.exe

description	pid	process	target process
PID 1312 set thread context of 2348	1312	Request For Price and Availability_PDF____.exe	Request For Price and Availability_PDF____.exe
PID 2348 set thread context of 1196	2348	Request For Price and Availability_PDF____.exe	Explorer.EXE
PID 2016 set thread context of 1196	2016	cscript.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 24 IoCs

Processes:

Request For Price and Availability_PDF____.execscript.exe

pid	process
2348	Request For Price and Availability_PDF____.exe
2348	Request For Price and Availability_PDF____.exe
2016	cscript.exe
2016	cscript.exe
2016	cscript.exe
2016	cscript.exe
2016	cscript.exe
2016	cscript.exe
2016	cscript.exe
2016	cscript.exe
2016	cscript.exe
2016	cscript.exe
2016	cscript.exe
2016	cscript.exe
2016	cscript.exe
2016	cscript.exe
2016	cscript.exe
2016	cscript.exe
2016	cscript.exe
2016	cscript.exe
2016	cscript.exe
2016	cscript.exe
2016	cscript.exe
2016	cscript.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1196 Explorer.EXE

pid	process
1196	Explorer.EXE

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

Request For Price and Availability_PDF____.execscript.exe

pid	process
2348	Request For Price and Availability_PDF____.exe
2348	Request For Price and Availability_PDF____.exe
2348	Request For Price and Availability_PDF____.exe
2016	cscript.exe
2016	cscript.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Request For Price and Availability_PDF____.execscript.exe

description pid process

Token: SeDebugPrivilege 2348 Request For Price and Availability_PDF____.exe
Token: SeDebugPrivilege 2016 cscript.exe

description	pid	process
Token: SeDebugPrivilege	2348	Request For Price and Availability_PDF____.exe
Token: SeDebugPrivilege	2016	cscript.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

Request For Price and Availability_PDF____.exeExplorer.EXEcscript.exe

description	pid	process	target process
PID 1312 wrote to memory of 2348	1312	Request For Price and Availability_PDF____.exe	Request For Price and Availability_PDF____.exe
PID 1312 wrote to memory of 2348	1312	Request For Price and Availability_PDF____.exe	Request For Price and Availability_PDF____.exe
PID 1312 wrote to memory of 2348	1312	Request For Price and Availability_PDF____.exe	Request For Price and Availability_PDF____.exe
PID 1312 wrote to memory of 2348	1312	Request For Price and Availability_PDF____.exe	Request For Price and Availability_PDF____.exe
PID 1312 wrote to memory of 2348	1312	Request For Price and Availability_PDF____.exe	Request For Price and Availability_PDF____.exe
PID 1312 wrote to memory of 2348	1312	Request For Price and Availability_PDF____.exe	Request For Price and Availability_PDF____.exe
PID 1312 wrote to memory of 2348	1312	Request For Price and Availability_PDF____.exe	Request For Price and Availability_PDF____.exe
PID 1196 wrote to memory of 2016	1196	Explorer.EXE	cscript.exe
PID 1196 wrote to memory of 2016	1196	Explorer.EXE	cscript.exe
PID 1196 wrote to memory of 2016	1196	Explorer.EXE	cscript.exe
PID 1196 wrote to memory of 2016	1196	Explorer.EXE	cscript.exe
PID 2016 wrote to memory of 2740	2016	cscript.exe	cmd.exe
PID 2016 wrote to memory of 2740	2016	cscript.exe	cmd.exe
PID 2016 wrote to memory of 2740	2016	cscript.exe	cmd.exe
PID 2016 wrote to memory of 2740	2016	cscript.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1196

C:\Users\Admin\AppData\Local\Temp\Request For Price and Availability_PDF____.exe
"C:\Users\Admin\AppData\Local\Temp\Request For Price and Availability_PDF____.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1312

C:\Users\Admin\AppData\Local\Temp\Request For Price and Availability_PDF____.exe
"C:\Users\Admin\AppData\Local\Temp\Request For Price and Availability_PDF____.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2348

C:\Windows\SysWOW64\cscript.exe
"C:\Windows\SysWOW64\cscript.exe"
2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2016

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\Request For Price and Availability_PDF____.exe"
3⤵
- Deletes itself
PID:2740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1196-20-0x00000000062F0000-0x00000000063E4000-memory.dmp

Filesize
976KB

Download
memory/1196-33-0x0000000007620000-0x0000000007719000-memory.dmp

Filesize
996KB

Download
memory/1196-31-0x0000000007620000-0x0000000007719000-memory.dmp

Filesize
996KB

Download
memory/1196-30-0x0000000007620000-0x0000000007719000-memory.dmp

Filesize
996KB

Download
memory/1196-26-0x00000000062F0000-0x00000000063E4000-memory.dmp

Filesize
976KB

Download
memory/1312-15-0x00000000744F0000-0x0000000074BDE000-memory.dmp

Filesize
6.9MB

Download
memory/1312-5-0x0000000004F10000-0x0000000004F50000-memory.dmp

Filesize
256KB

Download
memory/1312-7-0x00000000048E0000-0x000000000494E000-memory.dmp

Filesize
440KB

Download
memory/1312-1-0x00000000744F0000-0x0000000074BDE000-memory.dmp

Filesize
6.9MB

Download
memory/1312-2-0x0000000004F10000-0x0000000004F50000-memory.dmp

Filesize
256KB

Download
memory/1312-3-0x0000000000430000-0x0000000000444000-memory.dmp

Filesize
80KB

Download
memory/1312-4-0x00000000744F0000-0x0000000074BDE000-memory.dmp

Filesize
6.9MB

Download
memory/1312-0-0x0000000000360000-0x00000000003F0000-memory.dmp

Filesize
576KB

Download
memory/1312-6-0x0000000000460000-0x000000000046E000-memory.dmp

Filesize
56KB

Download
memory/2016-25-0x0000000000070000-0x000000000009F000-memory.dmp

Filesize
188KB

Download
memory/2016-21-0x00000000001E0000-0x0000000000202000-memory.dmp

Filesize
136KB

Download
memory/2016-22-0x00000000001E0000-0x0000000000202000-memory.dmp

Filesize
136KB

Download
memory/2016-23-0x0000000000070000-0x000000000009F000-memory.dmp

Filesize
188KB

Download
memory/2016-24-0x0000000002200000-0x0000000002503000-memory.dmp

Filesize
3.0MB

Download
memory/2016-28-0x0000000000590000-0x0000000000624000-memory.dmp

Filesize
592KB

Download
memory/2348-19-0x00000000002B0000-0x00000000002C5000-memory.dmp

Filesize
84KB

Download
memory/2348-18-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2348-16-0x00000000008D0000-0x0000000000BD3000-memory.dmp

Filesize
3.0MB

Download
memory/2348-14-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2348-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2348-10-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2348-8-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads