formbook | bd72f09ed9f35ab1327aef7ca8f0fc9ed6f696a0ec120e5ab4eca3ca32fa74b9

General

Target

4UWmsYiIC0tdIFk.exe
Size

639KB
MD5

c53f831c0cfef4921d4236c6435a0481
SHA1

961318099fa7615e9cf70cd87508df982cb13d97
SHA256

4c60c35f29e69092f5e26e18d43f332f00f33be5006dfb0f9e8cc7327ec6db92
SHA512

c4b45588aa914d3f11c1c9b5225bf9f47fb41dc06cc6572fc9e7666d74b60d4b9a0160c1f46fbd9841ce493b6ed1e8a864ae4459da9397ac8d2908dc98c20fbf
SSDEEP

12288:10KoFwl0ECedQwZTAO8zfkWdebsqC5oAawLOfk5ukR:+KoU0ECepZcOl9sqCZabfs

Score

10^/10

formbook ns03 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ns03

Decoy

dipity.tech

agathis.fun

ekaterinai.store

elizabethsbookshelf.com

smilesustainably.com

tapeworm.xyz

beatricesswarthout.xyz

nsrpackersandpackers.in

yedxec.xyz

gildedbeautyaesthitics.com

hanibalbechar.com

fichaphuman.net

adilosk.shop

geezaran.com

ventasemail.com

phonecasesdirect.store

rctjuc.shop

sukimossmanagement.com

caller-id.today

kft07.vip

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2084-11-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/2084-16-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/4652-21-0x0000000000390000-0x00000000003BF000-memory.dmp	formbook
behavioral2/memory/4652-23-0x0000000000390000-0x00000000003BF000-memory.dmp	formbook

Suspicious use of SetThreadContext 3 IoCs

Processes:

4UWmsYiIC0tdIFk.exe4UWmsYiIC0tdIFk.execscript.exe

description	pid	process	target process
PID 3508 set thread context of 2084	3508	4UWmsYiIC0tdIFk.exe	4UWmsYiIC0tdIFk.exe
PID 2084 set thread context of 3520	2084	4UWmsYiIC0tdIFk.exe	Explorer.EXE
PID 4652 set thread context of 3520	4652	cscript.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 58 IoCs

Processes:

4UWmsYiIC0tdIFk.execscript.exe

pid	process
2084	4UWmsYiIC0tdIFk.exe
2084	4UWmsYiIC0tdIFk.exe
2084	4UWmsYiIC0tdIFk.exe
2084	4UWmsYiIC0tdIFk.exe
4652	cscript.exe
4652	cscript.exe
4652	cscript.exe
4652	cscript.exe
4652	cscript.exe
4652	cscript.exe
4652	cscript.exe
4652	cscript.exe
4652	cscript.exe
4652	cscript.exe
4652	cscript.exe
4652	cscript.exe
4652	cscript.exe
4652	cscript.exe
4652	cscript.exe
4652	cscript.exe
4652	cscript.exe
4652	cscript.exe
4652	cscript.exe
4652	cscript.exe
4652	cscript.exe
4652	cscript.exe
4652	cscript.exe
4652	cscript.exe
4652	cscript.exe
4652	cscript.exe
4652	cscript.exe
4652	cscript.exe
4652	cscript.exe
4652	cscript.exe
4652	cscript.exe
4652	cscript.exe
4652	cscript.exe
4652	cscript.exe
4652	cscript.exe
4652	cscript.exe
4652	cscript.exe
4652	cscript.exe
4652	cscript.exe
4652	cscript.exe
4652	cscript.exe
4652	cscript.exe
4652	cscript.exe
4652	cscript.exe
4652	cscript.exe
4652	cscript.exe
4652	cscript.exe
4652	cscript.exe
4652	cscript.exe
4652	cscript.exe
4652	cscript.exe
4652	cscript.exe
4652	cscript.exe
4652	cscript.exe

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

4UWmsYiIC0tdIFk.execscript.exe

pid process

2084 4UWmsYiIC0tdIFk.exe
2084 4UWmsYiIC0tdIFk.exe
2084 4UWmsYiIC0tdIFk.exe
4652 cscript.exe
4652 cscript.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

4UWmsYiIC0tdIFk.execscript.exe

description pid process

Token: SeDebugPrivilege 2084 4UWmsYiIC0tdIFk.exe
Token: SeDebugPrivilege 4652 cscript.exe

description	pid	process
Token: SeDebugPrivilege	2084	4UWmsYiIC0tdIFk.exe
Token: SeDebugPrivilege	4652	cscript.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

4UWmsYiIC0tdIFk.exeExplorer.EXEcscript.exe

description	pid	process	target process
PID 3508 wrote to memory of 2084	3508	4UWmsYiIC0tdIFk.exe	4UWmsYiIC0tdIFk.exe
PID 3508 wrote to memory of 2084	3508	4UWmsYiIC0tdIFk.exe	4UWmsYiIC0tdIFk.exe
PID 3508 wrote to memory of 2084	3508	4UWmsYiIC0tdIFk.exe	4UWmsYiIC0tdIFk.exe
PID 3508 wrote to memory of 2084	3508	4UWmsYiIC0tdIFk.exe	4UWmsYiIC0tdIFk.exe
PID 3508 wrote to memory of 2084	3508	4UWmsYiIC0tdIFk.exe	4UWmsYiIC0tdIFk.exe
PID 3508 wrote to memory of 2084	3508	4UWmsYiIC0tdIFk.exe	4UWmsYiIC0tdIFk.exe
PID 3520 wrote to memory of 4652	3520	Explorer.EXE	cscript.exe
PID 3520 wrote to memory of 4652	3520	Explorer.EXE	cscript.exe
PID 3520 wrote to memory of 4652	3520	Explorer.EXE	cscript.exe
PID 4652 wrote to memory of 2436	4652	cscript.exe	cmd.exe
PID 4652 wrote to memory of 2436	4652	cscript.exe	cmd.exe
PID 4652 wrote to memory of 2436	4652	cscript.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:3520

C:\Users\Admin\AppData\Local\Temp\4UWmsYiIC0tdIFk.exe
"C:\Users\Admin\AppData\Local\Temp\4UWmsYiIC0tdIFk.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3508

C:\Users\Admin\AppData\Local\Temp\4UWmsYiIC0tdIFk.exe
"C:\Users\Admin\AppData\Local\Temp\4UWmsYiIC0tdIFk.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2084

C:\Windows\SysWOW64\cscript.exe
"C:\Windows\SysWOW64\cscript.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4652

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\4UWmsYiIC0tdIFk.exe"
3⤵
PID:2436

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2084-11-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2084-17-0x0000000001100000-0x0000000001114000-memory.dmp

Filesize
80KB

Download
memory/2084-16-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2084-14-0x00000000015B0000-0x00000000018FA000-memory.dmp

Filesize
3.3MB

Download
memory/3508-13-0x0000000075250000-0x0000000075A00000-memory.dmp

Filesize
7.7MB

Download
memory/3508-1-0x0000000075250000-0x0000000075A00000-memory.dmp

Filesize
7.7MB

Download
memory/3508-6-0x0000000005CC0000-0x0000000005CD6000-memory.dmp

Filesize
88KB

Download
memory/3508-7-0x0000000005D00000-0x0000000005D08000-memory.dmp

Filesize
32KB

Download
memory/3508-8-0x0000000006EC0000-0x0000000006ECC000-memory.dmp

Filesize
48KB

Download
memory/3508-9-0x00000000071A0000-0x0000000007216000-memory.dmp

Filesize
472KB

Download
memory/3508-10-0x0000000009830000-0x00000000098CC000-memory.dmp

Filesize
624KB

Download
memory/3508-4-0x0000000005830000-0x0000000005840000-memory.dmp

Filesize
64KB

Download
memory/3508-0-0x0000000000BF0000-0x0000000000C92000-memory.dmp

Filesize
648KB

Download
memory/3508-3-0x0000000005690000-0x0000000005722000-memory.dmp

Filesize
584KB

Download
memory/3508-2-0x0000000005D10000-0x00000000062B4000-memory.dmp

Filesize
5.6MB

Download
memory/3508-5-0x0000000005730000-0x000000000573A000-memory.dmp

Filesize
40KB

Download
memory/3520-18-0x00000000033C0000-0x00000000034C8000-memory.dmp

Filesize
1.0MB

Download
memory/3520-28-0x0000000007C20000-0x0000000007CD2000-memory.dmp

Filesize
712KB

Download
memory/3520-29-0x0000000007C20000-0x0000000007CD2000-memory.dmp

Filesize
712KB

Download
memory/3520-32-0x0000000007C20000-0x0000000007CD2000-memory.dmp

Filesize
712KB

Download
memory/4652-19-0x0000000000060000-0x0000000000087000-memory.dmp

Filesize
156KB

Download
memory/4652-20-0x0000000000060000-0x0000000000087000-memory.dmp

Filesize
156KB

Download
memory/4652-21-0x0000000000390000-0x00000000003BF000-memory.dmp

Filesize
188KB

Download
memory/4652-22-0x00000000026B0000-0x00000000029FA000-memory.dmp

Filesize
3.3MB

Download
memory/4652-23-0x0000000000390000-0x00000000003BF000-memory.dmp

Filesize
188KB

Download
memory/4652-25-0x0000000002600000-0x0000000002693000-memory.dmp

Filesize
588KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads