formbook | bc1c8cb700d5be15c306441325d0390344f846c226d720647d9f8d8e37f458db

General

Target

docswiftusd.exe
Size

581KB
MD5

d05875c207283bd51f30e7976fdb5382
SHA1

1bd4af46fd12de7cc7b949a0ddd238b4b247e3df
SHA256

bc1c8cb700d5be15c306441325d0390344f846c226d720647d9f8d8e37f458db
SHA512

1777eb9a79458ab0c1534a5030b103bf3586a4a470ed007612d1561b2f490f289a3ba2034bb7701c8bceb997d050fcba7b02b068a2fde310150f42ae1dcc6afc
SSDEEP

12288:+ttzX+Uw0SuNKR0f8gr2q3CU2JElF0mn8P/sGIXzRkRL1ibJSy2kmu8:+ttzlSuNKR0f8gr2q3CLu7hnqzIXCR0M

Score

10^/10

formbook sn26 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

sn26

Decoy

resenha10.bet

gulshan-rajput.com

xbus.tech

z813my.cfd

wlxzjlny.cfd

auntengotiempo.com

canada-reservation.com

thegiftcompany.shop

esthersilveirapropiedades.com

1wapws.top

ymjblnvo.cfd

termokimik.net

kushiro-artist-school.com

bmmboo.com

caceresconstructionservices.com

kentuckywalkabout.com

bringyourcart.com

miamiwinetour.com

bobcatsocial.site

thirdmind.network

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 4 IoCs

rat

resource	yara_rule
behavioral2/memory/548-15-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/548-19-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/552-25-0x00000000010A0000-0x00000000010CF000-memory.dmp	formbook
behavioral2/memory/552-27-0x00000000010A0000-0x00000000010CF000-memory.dmp	formbook

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1132 set thread context of 548	1132	docswiftusd.exe	97
PID 548 set thread context of 3244	548	docswiftusd.exe	31
PID 552 set thread context of 3244	552	ipconfig.exe	31

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
552	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
548	docswiftusd.exe
548	docswiftusd.exe
548	docswiftusd.exe
548	docswiftusd.exe
552	ipconfig.exe
552	ipconfig.exe
552	ipconfig.exe
552	ipconfig.exe
552	ipconfig.exe
552	ipconfig.exe
552	ipconfig.exe
552	ipconfig.exe
552	ipconfig.exe
552	ipconfig.exe
552	ipconfig.exe
552	ipconfig.exe
552	ipconfig.exe
552	ipconfig.exe
552	ipconfig.exe
552	ipconfig.exe
552	ipconfig.exe
552	ipconfig.exe
552	ipconfig.exe
552	ipconfig.exe
552	ipconfig.exe
552	ipconfig.exe
552	ipconfig.exe
552	ipconfig.exe
552	ipconfig.exe
552	ipconfig.exe
552	ipconfig.exe
552	ipconfig.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3244	Explorer.EXE

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
548	docswiftusd.exe
548	docswiftusd.exe
548	docswiftusd.exe
552	ipconfig.exe
552	ipconfig.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	548	docswiftusd.exe
Token: SeShutdownPrivilege	3244	Explorer.EXE
Token: SeCreatePagefilePrivilege	3244	Explorer.EXE
Token: SeDebugPrivilege	552	ipconfig.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3244	Explorer.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 548	1132	docswiftusd.exe	97
PID 1132 wrote to memory of 548	1132	docswiftusd.exe	97
PID 1132 wrote to memory of 548	1132	docswiftusd.exe	97
PID 1132 wrote to memory of 548	1132	docswiftusd.exe	97
PID 1132 wrote to memory of 548	1132	docswiftusd.exe	97
PID 1132 wrote to memory of 548	1132	docswiftusd.exe	97
PID 3244 wrote to memory of 552	3244	Explorer.EXE	98
PID 3244 wrote to memory of 552	3244	Explorer.EXE	98
PID 3244 wrote to memory of 552	3244	Explorer.EXE	98
PID 552 wrote to memory of 5024	552	ipconfig.exe	99
PID 552 wrote to memory of 5024	552	ipconfig.exe	99
PID 552 wrote to memory of 5024	552	ipconfig.exe	99

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3244
- C:\Users\Admin\AppData\Local\Temp\docswiftusd.exe
  "C:\Users\Admin\AppData\Local\Temp\docswiftusd.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1132
- - C:\Users\Admin\AppData\Local\Temp\docswiftusd.exe
    "{path}"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:548
- C:\Windows\SysWOW64\ipconfig.exe
  "C:\Windows\SysWOW64\ipconfig.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Gathers network information
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:552
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\docswiftusd.exe"
    3⤵
    PID:5024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/548-15-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/548-20-0x0000000001830000-0x0000000001845000-memory.dmp

Filesize
84KB

Download
memory/548-19-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/548-17-0x0000000001970000-0x0000000001CBA000-memory.dmp

Filesize
3.3MB

Download
memory/552-30-0x0000000001750000-0x00000000017E4000-memory.dmp

Filesize
592KB

Download
memory/552-27-0x00000000010A0000-0x00000000010CF000-memory.dmp

Filesize
188KB

Download
memory/552-26-0x0000000001970000-0x0000000001CBA000-memory.dmp

Filesize
3.3MB

Download
memory/552-25-0x00000000010A0000-0x00000000010CF000-memory.dmp

Filesize
188KB

Download
memory/552-24-0x0000000000480000-0x000000000048B000-memory.dmp

Filesize
44KB

Download
memory/552-23-0x0000000000480000-0x000000000048B000-memory.dmp

Filesize
44KB

Download
memory/1132-7-0x0000000004F70000-0x0000000004FC6000-memory.dmp

Filesize
344KB

Download
memory/1132-6-0x0000000004EF0000-0x0000000004EFA000-memory.dmp

Filesize
40KB

Download
memory/1132-12-0x000000007F4A0000-0x000000007F4B0000-memory.dmp

Filesize
64KB

Download
memory/1132-13-0x00000000063B0000-0x0000000006438000-memory.dmp

Filesize
544KB

Download
memory/1132-14-0x0000000006440000-0x0000000006474000-memory.dmp

Filesize
208KB

Download
memory/1132-10-0x000000007F4A0000-0x000000007F4B0000-memory.dmp

Filesize
64KB

Download
memory/1132-9-0x0000000004C20000-0x0000000004C30000-memory.dmp

Filesize
64KB

Download
memory/1132-8-0x0000000074B90000-0x0000000075340000-memory.dmp

Filesize
7.7MB

Download
memory/1132-1-0x0000000000260000-0x00000000002F8000-memory.dmp

Filesize
608KB

Download
memory/1132-0-0x0000000074B90000-0x0000000075340000-memory.dmp

Filesize
7.7MB

Download
memory/1132-22-0x0000000074B90000-0x0000000075340000-memory.dmp

Filesize
7.7MB

Download
memory/1132-11-0x00000000051A0000-0x00000000051AC000-memory.dmp

Filesize
48KB

Download
memory/1132-5-0x0000000004C20000-0x0000000004C30000-memory.dmp

Filesize
64KB

Download
memory/1132-4-0x0000000004D60000-0x0000000004DF2000-memory.dmp

Filesize
584KB

Download
memory/1132-3-0x0000000005310000-0x00000000058B4000-memory.dmp

Filesize
5.6MB

Download
memory/1132-2-0x0000000004CC0000-0x0000000004D5C000-memory.dmp

Filesize
624KB

Download
memory/3244-28-0x0000000008500000-0x0000000008606000-memory.dmp

Filesize
1.0MB

Download
memory/3244-21-0x0000000008500000-0x0000000008606000-memory.dmp

Filesize
1.0MB

Download
memory/3244-31-0x0000000006E30000-0x0000000006ED5000-memory.dmp

Filesize
660KB

Download
memory/3244-32-0x0000000006E30000-0x0000000006ED5000-memory.dmp

Filesize
660KB

Download
memory/3244-34-0x0000000006E30000-0x0000000006ED5000-memory.dmp

Filesize
660KB

Download

Analysis

Sharing