formbook | ca2f01c6f516bbdf05aed26b9da20d6710a6c2f32e846a2ded654bd5f09cb01c

General

Target

tmp.exe
Size

572KB
MD5

e882b8df405f9651962b3e983ed78274
SHA1

698190d6b80c99e4e73323e8cfce0c9265b68d14
SHA256

ca2f01c6f516bbdf05aed26b9da20d6710a6c2f32e846a2ded654bd5f09cb01c
SHA512

0ca40788e3cd1e2c5b07ce7b0e5d50f2d3ac0f7b8c068b04128a4febe21ed83319cb28d1f16feb226facbfac99f7e82c1fecb0d9f1b66a47800264d7f29abd18
SSDEEP

12288:sE7+Q549dCqWkCW9zV9fO7X3TPetnzUMaSr:Br4rLWkNV9fObDPetzUU

Score

10^/10

formbook he09 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

he09

Decoy

clhear.com

maythunguyen.com

xiongmaoaijia.com

kembangzadsloh.xyz

speedwagner.com

360bedroom.com

campereurorg.top

cwxg2.site

mcdlibre.live

globigprimecompanylimited.com

1707102023-stripe.com

xhfj5.site

mugiwaranousopp.xyz

texmasco.com

sc9999.net

lite.team

8xb898.com

cibecuetowing.top

mgplatinemlak.xyz

southwestharborkeyword.top

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 4 IoCs

rat

resource	yara_rule
behavioral2/memory/2140-12-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/2140-17-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/1380-23-0x0000000000860000-0x000000000088F000-memory.dmp	formbook
behavioral2/memory/1380-25-0x0000000000860000-0x000000000088F000-memory.dmp	formbook

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4504 set thread context of 2140	4504	tmp.exe	96
PID 2140 set thread context of 3532	2140	tmp.exe	51
PID 1380 set thread context of 3532	1380	mstsc.exe	51

Suspicious behavior: EnumeratesProcesses 50 IoCs

pid	Process
2140	tmp.exe
2140	tmp.exe
2140	tmp.exe
2140	tmp.exe
1380	mstsc.exe
1380	mstsc.exe
1380	mstsc.exe
1380	mstsc.exe
1380	mstsc.exe
1380	mstsc.exe
1380	mstsc.exe
1380	mstsc.exe
1380	mstsc.exe
1380	mstsc.exe
1380	mstsc.exe
1380	mstsc.exe
1380	mstsc.exe
1380	mstsc.exe
1380	mstsc.exe
1380	mstsc.exe
1380	mstsc.exe
1380	mstsc.exe
1380	mstsc.exe
1380	mstsc.exe
1380	mstsc.exe
1380	mstsc.exe
1380	mstsc.exe
1380	mstsc.exe
1380	mstsc.exe
1380	mstsc.exe
1380	mstsc.exe
1380	mstsc.exe
1380	mstsc.exe
1380	mstsc.exe
1380	mstsc.exe
1380	mstsc.exe
1380	mstsc.exe
1380	mstsc.exe
1380	mstsc.exe
1380	mstsc.exe
1380	mstsc.exe
1380	mstsc.exe
1380	mstsc.exe
1380	mstsc.exe
1380	mstsc.exe
1380	mstsc.exe
1380	mstsc.exe
1380	mstsc.exe
1380	mstsc.exe
1380	mstsc.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
2140	tmp.exe
2140	tmp.exe
2140	tmp.exe
1380	mstsc.exe
1380	mstsc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2140	tmp.exe
Token: SeDebugPrivilege	1380	mstsc.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3532	Explorer.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 2140	4504	tmp.exe	96
PID 4504 wrote to memory of 2140	4504	tmp.exe	96
PID 4504 wrote to memory of 2140	4504	tmp.exe	96
PID 4504 wrote to memory of 2140	4504	tmp.exe	96
PID 4504 wrote to memory of 2140	4504	tmp.exe	96
PID 4504 wrote to memory of 2140	4504	tmp.exe	96
PID 3532 wrote to memory of 1380	3532	Explorer.EXE	97
PID 3532 wrote to memory of 1380	3532	Explorer.EXE	97
PID 3532 wrote to memory of 1380	3532	Explorer.EXE	97
PID 1380 wrote to memory of 404	1380	mstsc.exe	99
PID 1380 wrote to memory of 404	1380	mstsc.exe	99
PID 1380 wrote to memory of 404	1380	mstsc.exe	99

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3532
- C:\Users\Admin\AppData\Local\Temp\tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4504
- - C:\Users\Admin\AppData\Local\Temp\tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:2140
- C:\Windows\SysWOW64\mstsc.exe
  "C:\Windows\SysWOW64\mstsc.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1380
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
    3⤵
    PID:404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1380-20-0x0000000000050000-0x000000000018A000-memory.dmp

Filesize
1.2MB

Download
memory/1380-27-0x00000000026C0000-0x0000000002753000-memory.dmp

Filesize
588KB

Download
memory/1380-25-0x0000000000860000-0x000000000088F000-memory.dmp

Filesize
188KB

Download
memory/1380-24-0x0000000002790000-0x0000000002ADA000-memory.dmp

Filesize
3.3MB

Download
memory/1380-23-0x0000000000860000-0x000000000088F000-memory.dmp

Filesize
188KB

Download
memory/1380-22-0x0000000000050000-0x000000000018A000-memory.dmp

Filesize
1.2MB

Download
memory/2140-15-0x0000000001830000-0x0000000001B7A000-memory.dmp

Filesize
3.3MB

Download
memory/2140-12-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2140-18-0x0000000001810000-0x0000000001824000-memory.dmp

Filesize
80KB

Download
memory/2140-17-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3532-19-0x0000000009170000-0x000000000923D000-memory.dmp

Filesize
820KB

Download
memory/3532-28-0x0000000009170000-0x000000000923D000-memory.dmp

Filesize
820KB

Download
memory/3532-35-0x0000000009530000-0x00000000096B0000-memory.dmp

Filesize
1.5MB

Download
memory/3532-32-0x0000000009530000-0x00000000096B0000-memory.dmp

Filesize
1.5MB

Download
memory/3532-31-0x0000000009530000-0x00000000096B0000-memory.dmp

Filesize
1.5MB

Download
memory/4504-5-0x0000000005300000-0x000000000530A000-memory.dmp

Filesize
40KB

Download
memory/4504-8-0x00000000057D0000-0x00000000057DC000-memory.dmp

Filesize
48KB

Download
memory/4504-7-0x00000000057C0000-0x00000000057C8000-memory.dmp

Filesize
32KB

Download
memory/4504-6-0x0000000005420000-0x0000000005434000-memory.dmp

Filesize
80KB

Download
memory/4504-11-0x00000000748F0000-0x00000000750A0000-memory.dmp

Filesize
7.7MB

Download
memory/4504-4-0x0000000005450000-0x0000000005460000-memory.dmp

Filesize
64KB

Download
memory/4504-3-0x0000000005250000-0x00000000052E2000-memory.dmp

Filesize
584KB

Download
memory/4504-2-0x0000000005800000-0x0000000005DA4000-memory.dmp

Filesize
5.6MB

Download
memory/4504-1-0x00000000007D0000-0x0000000000864000-memory.dmp

Filesize
592KB

Download
memory/4504-9-0x0000000006C30000-0x0000000006C9E000-memory.dmp

Filesize
440KB

Download
memory/4504-0-0x00000000748F0000-0x00000000750A0000-memory.dmp

Filesize
7.7MB

Download
memory/4504-14-0x00000000748F0000-0x00000000750A0000-memory.dmp

Filesize
7.7MB

Download
memory/4504-10-0x0000000009390000-0x000000000942C000-memory.dmp

Filesize
624KB

Download

Analysis

Sharing