formbook | bc1c8cb700d5be15c306441325d0390344f846c226d720647d9f8d8e37f458db

General

Target

docswiftusd.exe
Size

581KB
MD5

d05875c207283bd51f30e7976fdb5382
SHA1

1bd4af46fd12de7cc7b949a0ddd238b4b247e3df
SHA256

bc1c8cb700d5be15c306441325d0390344f846c226d720647d9f8d8e37f458db
SHA512

1777eb9a79458ab0c1534a5030b103bf3586a4a470ed007612d1561b2f490f289a3ba2034bb7701c8bceb997d050fcba7b02b068a2fde310150f42ae1dcc6afc
SSDEEP

12288:+ttzX+Uw0SuNKR0f8gr2q3CU2JElF0mn8P/sGIXzRkRL1ibJSy2kmu8:+ttzlSuNKR0f8gr2q3CLu7hnqzIXCR0M

Score

10^/10

formbook sn26 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

sn26

Decoy

resenha10.bet

gulshan-rajput.com

xbus.tech

z813my.cfd

wlxzjlny.cfd

auntengotiempo.com

canada-reservation.com

thegiftcompany.shop

esthersilveirapropiedades.com

1wapws.top

ymjblnvo.cfd

termokimik.net

kushiro-artist-school.com

bmmboo.com

caceresconstructionservices.com

kentuckywalkabout.com

bringyourcart.com

miamiwinetour.com

bobcatsocial.site

thirdmind.network

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 4 IoCs

rat

resource	yara_rule
behavioral1/memory/2632-14-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/2632-18-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/2616-23-0x0000000000080000-0x00000000000AF000-memory.dmp	formbook
behavioral1/memory/2616-26-0x0000000000080000-0x00000000000AF000-memory.dmp	formbook

Deletes itself 1 IoCs

pid	Process
2236	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2100 set thread context of 2632	2100	docswiftusd.exe	30
PID 2632 set thread context of 1192	2632	docswiftusd.exe	8
PID 2616 set thread context of 1192	2616	colorcpl.exe	8

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2632	docswiftusd.exe
2632	docswiftusd.exe
2616	colorcpl.exe
2616	colorcpl.exe
2616	colorcpl.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1192	Explorer.EXE

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
2632	docswiftusd.exe
2632	docswiftusd.exe
2632	docswiftusd.exe
2616	colorcpl.exe
2616	colorcpl.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2632	docswiftusd.exe
Token: SeDebugPrivilege	2616	colorcpl.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2632	2100	docswiftusd.exe	30
PID 2100 wrote to memory of 2632	2100	docswiftusd.exe	30
PID 2100 wrote to memory of 2632	2100	docswiftusd.exe	30
PID 2100 wrote to memory of 2632	2100	docswiftusd.exe	30
PID 2100 wrote to memory of 2632	2100	docswiftusd.exe	30
PID 2100 wrote to memory of 2632	2100	docswiftusd.exe	30
PID 2100 wrote to memory of 2632	2100	docswiftusd.exe	30
PID 1192 wrote to memory of 2616	1192	Explorer.EXE	31
PID 1192 wrote to memory of 2616	1192	Explorer.EXE	31
PID 1192 wrote to memory of 2616	1192	Explorer.EXE	31
PID 1192 wrote to memory of 2616	1192	Explorer.EXE	31
PID 2616 wrote to memory of 2236	2616	colorcpl.exe	32
PID 2616 wrote to memory of 2236	2616	colorcpl.exe	32
PID 2616 wrote to memory of 2236	2616	colorcpl.exe	32
PID 2616 wrote to memory of 2236	2616	colorcpl.exe	32

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Users\Admin\AppData\Local\Temp\docswiftusd.exe
  "C:\Users\Admin\AppData\Local\Temp\docswiftusd.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2100
- - C:\Users\Admin\AppData\Local\Temp\docswiftusd.exe
    "{path}"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:2632
- C:\Windows\SysWOW64\colorcpl.exe
  "C:\Windows\SysWOW64\colorcpl.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\docswiftusd.exe"
    3⤵
    - Deletes itself
    PID:2236

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1192-20-0x00000000076A0000-0x0000000007763000-memory.dmp

Filesize
780KB

Download
memory/1192-31-0x0000000007770000-0x000000000783C000-memory.dmp

Filesize
816KB

Download
memory/1192-30-0x0000000007770000-0x000000000783C000-memory.dmp

Filesize
816KB

Download
memory/1192-29-0x0000000003BA0000-0x0000000003DA0000-memory.dmp

Filesize
2.0MB

Download
memory/1192-25-0x00000000076A0000-0x0000000007763000-memory.dmp

Filesize
780KB

Download
memory/2100-15-0x0000000074D80000-0x000000007546E000-memory.dmp

Filesize
6.9MB

Download
memory/2100-0-0x0000000074D80000-0x000000007546E000-memory.dmp

Filesize
6.9MB

Download
memory/2100-7-0x000000007EF40000-0x000000007EF50000-memory.dmp

Filesize
64KB

Download
memory/2100-8-0x0000000004D10000-0x0000000004D98000-memory.dmp

Filesize
544KB

Download
memory/2100-9-0x0000000000910000-0x0000000000944000-memory.dmp

Filesize
208KB

Download
memory/2100-1-0x0000000000CF0000-0x0000000000D88000-memory.dmp

Filesize
608KB

Download
memory/2100-6-0x0000000000320000-0x000000000032C000-memory.dmp

Filesize
48KB

Download
memory/2100-2-0x0000000074D80000-0x000000007546E000-memory.dmp

Filesize
6.9MB

Download
memory/2100-3-0x0000000005430000-0x0000000005470000-memory.dmp

Filesize
256KB

Download
memory/2100-5-0x000000007EF40000-0x000000007EF50000-memory.dmp

Filesize
64KB

Download
memory/2100-4-0x0000000005430000-0x0000000005470000-memory.dmp

Filesize
256KB

Download
memory/2616-26-0x0000000000080000-0x00000000000AF000-memory.dmp

Filesize
188KB

Download
memory/2616-28-0x00000000009E0000-0x0000000000A74000-memory.dmp

Filesize
592KB

Download
memory/2616-24-0x0000000002030000-0x0000000002333000-memory.dmp

Filesize
3.0MB

Download
memory/2616-21-0x0000000000A80000-0x0000000000A98000-memory.dmp

Filesize
96KB

Download
memory/2616-22-0x0000000000A80000-0x0000000000A98000-memory.dmp

Filesize
96KB

Download
memory/2616-23-0x0000000000080000-0x00000000000AF000-memory.dmp

Filesize
188KB

Download
memory/2632-11-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2632-19-0x0000000000200000-0x0000000000215000-memory.dmp

Filesize
84KB

Download
memory/2632-18-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2632-16-0x0000000000870000-0x0000000000B73000-memory.dmp

Filesize
3.0MB

Download
memory/2632-14-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2632-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2632-10-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing