formbook | 3deae48efc470b46d9f670adf73aef681dc1f241d17d8c948b48167967b0e951

General

Target

68773735efbd467e3286df5cbd2cc678926f0821ebbc9c2633b215b31d0b7d45.exe
Size

1.0MB
MD5

4bcaa831d3aed104046c10e47dc8850e
SHA1

4f9e1249c407dbd9c0669f3158519eed96ae5980
SHA256

68773735efbd467e3286df5cbd2cc678926f0821ebbc9c2633b215b31d0b7d45
SHA512

332f8ac217cbcd1ddf94c0d782ac33eefb4578faedc99bcd88afbeac304b5efed16920c4e9403806f3214c16c1ccb05143279a204e846b1d6562206d7bdeae14
SSDEEP

24576:0AHnh+eWsN3skA4RV1Hom2KXMmHa5ZchzV/S5:Dh+ZkldoPK8Ya5Zo5A

Score

10^/10

formbook se63 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

se63

Decoy

socratesandhisclouds.com

versioncolor.com

ytcp011.com

908511.vip

egysrvs.com

ky5682011.cc

kkuu14.icu

wavebsb.com

klikadelivery.com

jnbxbpq.com

5o8oh.us

hemule.net

techinf.xyz

bevage.club

we37h.com

tipsde.shop

48136.vip

bestcampertrailerbrands.com

fairmedics.in

quixonic.tech

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2424-11-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/2424-14-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/2704-20-0x00000000000C0000-0x00000000000EF000-memory.dmp	formbook

Suspicious use of SetThreadContext 3 IoCs

Processes:

68773735efbd467e3286df5cbd2cc678926f0821ebbc9c2633b215b31d0b7d45.exesvchost.exewlanext.exe

description	pid	process	target process
PID 2368 set thread context of 2424	2368	68773735efbd467e3286df5cbd2cc678926f0821ebbc9c2633b215b31d0b7d45.exe	svchost.exe
PID 2424 set thread context of 1180	2424	svchost.exe	Explorer.EXE
PID 2704 set thread context of 1180	2704	wlanext.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 31 IoCs

Processes:

svchost.exewlanext.exe

pid	process
2424	svchost.exe
2424	svchost.exe
2704	wlanext.exe
2704	wlanext.exe
2704	wlanext.exe
2704	wlanext.exe
2704	wlanext.exe
2704	wlanext.exe
2704	wlanext.exe
2704	wlanext.exe
2704	wlanext.exe
2704	wlanext.exe
2704	wlanext.exe
2704	wlanext.exe
2704	wlanext.exe
2704	wlanext.exe
2704	wlanext.exe
2704	wlanext.exe
2704	wlanext.exe
2704	wlanext.exe
2704	wlanext.exe
2704	wlanext.exe
2704	wlanext.exe
2704	wlanext.exe
2704	wlanext.exe
2704	wlanext.exe
2704	wlanext.exe
2704	wlanext.exe
2704	wlanext.exe
2704	wlanext.exe
2704	wlanext.exe

Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

68773735efbd467e3286df5cbd2cc678926f0821ebbc9c2633b215b31d0b7d45.exesvchost.exewlanext.exe

pid	process
2368	68773735efbd467e3286df5cbd2cc678926f0821ebbc9c2633b215b31d0b7d45.exe
2424	svchost.exe
2424	svchost.exe
2424	svchost.exe
2704	wlanext.exe
2704	wlanext.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

svchost.exewlanext.exe

description pid process

Token: SeDebugPrivilege 2424 svchost.exe
Token: SeDebugPrivilege 2704 wlanext.exe

description	pid	process
Token: SeDebugPrivilege	2424	svchost.exe
Token: SeDebugPrivilege	2704	wlanext.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

68773735efbd467e3286df5cbd2cc678926f0821ebbc9c2633b215b31d0b7d45.exeExplorer.EXE

pid	process
2368	68773735efbd467e3286df5cbd2cc678926f0821ebbc9c2633b215b31d0b7d45.exe
2368	68773735efbd467e3286df5cbd2cc678926f0821ebbc9c2633b215b31d0b7d45.exe
1180	Explorer.EXE
1180	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

Processes:

68773735efbd467e3286df5cbd2cc678926f0821ebbc9c2633b215b31d0b7d45.exe

pid	process
2368	68773735efbd467e3286df5cbd2cc678926f0821ebbc9c2633b215b31d0b7d45.exe
2368	68773735efbd467e3286df5cbd2cc678926f0821ebbc9c2633b215b31d0b7d45.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

68773735efbd467e3286df5cbd2cc678926f0821ebbc9c2633b215b31d0b7d45.exeExplorer.EXEwlanext.exe

description	pid	process	target process
PID 2368 wrote to memory of 2424	2368	68773735efbd467e3286df5cbd2cc678926f0821ebbc9c2633b215b31d0b7d45.exe	svchost.exe
PID 2368 wrote to memory of 2424	2368	68773735efbd467e3286df5cbd2cc678926f0821ebbc9c2633b215b31d0b7d45.exe	svchost.exe
PID 2368 wrote to memory of 2424	2368	68773735efbd467e3286df5cbd2cc678926f0821ebbc9c2633b215b31d0b7d45.exe	svchost.exe
PID 2368 wrote to memory of 2424	2368	68773735efbd467e3286df5cbd2cc678926f0821ebbc9c2633b215b31d0b7d45.exe	svchost.exe
PID 2368 wrote to memory of 2424	2368	68773735efbd467e3286df5cbd2cc678926f0821ebbc9c2633b215b31d0b7d45.exe	svchost.exe
PID 1180 wrote to memory of 2704	1180	Explorer.EXE	wlanext.exe
PID 1180 wrote to memory of 2704	1180	Explorer.EXE	wlanext.exe
PID 1180 wrote to memory of 2704	1180	Explorer.EXE	wlanext.exe
PID 1180 wrote to memory of 2704	1180	Explorer.EXE	wlanext.exe
PID 2704 wrote to memory of 2700	2704	wlanext.exe	cmd.exe
PID 2704 wrote to memory of 2700	2704	wlanext.exe	cmd.exe
PID 2704 wrote to memory of 2700	2704	wlanext.exe	cmd.exe
PID 2704 wrote to memory of 2700	2704	wlanext.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1180

C:\Users\Admin\AppData\Local\Temp\68773735efbd467e3286df5cbd2cc678926f0821ebbc9c2633b215b31d0b7d45.exe
"C:\Users\Admin\AppData\Local\Temp\68773735efbd467e3286df5cbd2cc678926f0821ebbc9c2633b215b31d0b7d45.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2368

C:\Windows\SysWOW64\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\68773735efbd467e3286df5cbd2cc678926f0821ebbc9c2633b215b31d0b7d45.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2424

C:\Windows\SysWOW64\wlanext.exe
"C:\Windows\SysWOW64\wlanext.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2704

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Windows\SysWOW64\svchost.exe"
3⤵
PID:2700

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1180-23-0x00000000065D0000-0x0000000006729000-memory.dmp

Filesize
1.3MB

Download
memory/1180-31-0x0000000006730000-0x000000000681E000-memory.dmp

Filesize
952KB

Download
memory/1180-28-0x0000000006730000-0x000000000681E000-memory.dmp

Filesize
952KB

Download
memory/1180-27-0x0000000006730000-0x000000000681E000-memory.dmp

Filesize
952KB

Download
memory/1180-16-0x00000000065D0000-0x0000000006729000-memory.dmp

Filesize
1.3MB

Download
memory/2368-10-0x0000000000120000-0x0000000000124000-memory.dmp

Filesize
16KB

Download
memory/2424-15-0x00000000001A0000-0x00000000001B5000-memory.dmp

Filesize
84KB

Download
memory/2424-14-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2424-12-0x0000000000C10000-0x0000000000F13000-memory.dmp

Filesize
3.0MB

Download
memory/2424-11-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2704-19-0x0000000000B70000-0x0000000000B86000-memory.dmp

Filesize
88KB

Download
memory/2704-20-0x00000000000C0000-0x00000000000EF000-memory.dmp

Filesize
188KB

Download
memory/2704-17-0x0000000000B70000-0x0000000000B86000-memory.dmp

Filesize
88KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads