formbook | 3deae48efc470b46d9f670adf73aef681dc1f241d17d8c948b48167967b0e951

General

Target

68773735efbd467e3286df5cbd2cc678926f0821ebbc9c2633b215b31d0b7d45.exe
Size

1.0MB
MD5

4bcaa831d3aed104046c10e47dc8850e
SHA1

4f9e1249c407dbd9c0669f3158519eed96ae5980
SHA256

68773735efbd467e3286df5cbd2cc678926f0821ebbc9c2633b215b31d0b7d45
SHA512

332f8ac217cbcd1ddf94c0d782ac33eefb4578faedc99bcd88afbeac304b5efed16920c4e9403806f3214c16c1ccb05143279a204e846b1d6562206d7bdeae14
SSDEEP

24576:0AHnh+eWsN3skA4RV1Hom2KXMmHa5ZchzV/S5:Dh+ZkldoPK8Ya5Zo5A

Score

10^/10

formbook se63 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

se63

Decoy

socratesandhisclouds.com

versioncolor.com

ytcp011.com

908511.vip

egysrvs.com

ky5682011.cc

kkuu14.icu

wavebsb.com

klikadelivery.com

jnbxbpq.com

5o8oh.us

hemule.net

techinf.xyz

bevage.club

we37h.com

tipsde.shop

48136.vip

bestcampertrailerbrands.com

fairmedics.in

quixonic.tech

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2556-11-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/2556-15-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/2556-20-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/2756-26-0x00000000000C0000-0x00000000000EF000-memory.dmp	formbook

Suspicious use of SetThreadContext 4 IoCs

Processes:

68773735efbd467e3286df5cbd2cc678926f0821ebbc9c2633b215b31d0b7d45.exesvchost.execmmon32.exe

description	pid	process	target process
PID 1876 set thread context of 2556	1876	68773735efbd467e3286df5cbd2cc678926f0821ebbc9c2633b215b31d0b7d45.exe	svchost.exe
PID 2556 set thread context of 1088	2556	svchost.exe	Explorer.EXE
PID 2556 set thread context of 1088	2556	svchost.exe	Explorer.EXE
PID 2756 set thread context of 1088	2756	cmmon32.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 30 IoCs

Processes:

svchost.execmmon32.exe

pid	process
2556	svchost.exe
2556	svchost.exe
2556	svchost.exe
2756	cmmon32.exe
2756	cmmon32.exe
2756	cmmon32.exe
2756	cmmon32.exe
2756	cmmon32.exe
2756	cmmon32.exe
2756	cmmon32.exe
2756	cmmon32.exe
2756	cmmon32.exe
2756	cmmon32.exe
2756	cmmon32.exe
2756	cmmon32.exe
2756	cmmon32.exe
2756	cmmon32.exe
2756	cmmon32.exe
2756	cmmon32.exe
2756	cmmon32.exe
2756	cmmon32.exe
2756	cmmon32.exe
2756	cmmon32.exe
2756	cmmon32.exe
2756	cmmon32.exe
2756	cmmon32.exe
2756	cmmon32.exe
2756	cmmon32.exe
2756	cmmon32.exe
2756	cmmon32.exe

Suspicious behavior: MapViewOfSection 7 IoCs

Processes:

68773735efbd467e3286df5cbd2cc678926f0821ebbc9c2633b215b31d0b7d45.exesvchost.execmmon32.exe

pid	process
1876	68773735efbd467e3286df5cbd2cc678926f0821ebbc9c2633b215b31d0b7d45.exe
2556	svchost.exe
2556	svchost.exe
2556	svchost.exe
2556	svchost.exe
2756	cmmon32.exe
2756	cmmon32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

svchost.execmmon32.exe

description pid process

Token: SeDebugPrivilege 2556 svchost.exe
Token: SeDebugPrivilege 2756 cmmon32.exe

description	pid	process
Token: SeDebugPrivilege	2556	svchost.exe
Token: SeDebugPrivilege	2756	cmmon32.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

68773735efbd467e3286df5cbd2cc678926f0821ebbc9c2633b215b31d0b7d45.exeExplorer.EXE

pid	process
1876	68773735efbd467e3286df5cbd2cc678926f0821ebbc9c2633b215b31d0b7d45.exe
1876	68773735efbd467e3286df5cbd2cc678926f0821ebbc9c2633b215b31d0b7d45.exe
1088	Explorer.EXE
1088	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

Processes:

68773735efbd467e3286df5cbd2cc678926f0821ebbc9c2633b215b31d0b7d45.exe

pid	process
1876	68773735efbd467e3286df5cbd2cc678926f0821ebbc9c2633b215b31d0b7d45.exe
1876	68773735efbd467e3286df5cbd2cc678926f0821ebbc9c2633b215b31d0b7d45.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

68773735efbd467e3286df5cbd2cc678926f0821ebbc9c2633b215b31d0b7d45.exesvchost.execmmon32.exe

description	pid	process	target process
PID 1876 wrote to memory of 2556	1876	68773735efbd467e3286df5cbd2cc678926f0821ebbc9c2633b215b31d0b7d45.exe	svchost.exe
PID 1876 wrote to memory of 2556	1876	68773735efbd467e3286df5cbd2cc678926f0821ebbc9c2633b215b31d0b7d45.exe	svchost.exe
PID 1876 wrote to memory of 2556	1876	68773735efbd467e3286df5cbd2cc678926f0821ebbc9c2633b215b31d0b7d45.exe	svchost.exe
PID 1876 wrote to memory of 2556	1876	68773735efbd467e3286df5cbd2cc678926f0821ebbc9c2633b215b31d0b7d45.exe	svchost.exe
PID 1876 wrote to memory of 2556	1876	68773735efbd467e3286df5cbd2cc678926f0821ebbc9c2633b215b31d0b7d45.exe	svchost.exe
PID 2556 wrote to memory of 2756	2556	svchost.exe	cmmon32.exe
PID 2556 wrote to memory of 2756	2556	svchost.exe	cmmon32.exe
PID 2556 wrote to memory of 2756	2556	svchost.exe	cmmon32.exe
PID 2556 wrote to memory of 2756	2556	svchost.exe	cmmon32.exe
PID 2756 wrote to memory of 2648	2756	cmmon32.exe	cmd.exe
PID 2756 wrote to memory of 2648	2756	cmmon32.exe	cmd.exe
PID 2756 wrote to memory of 2648	2756	cmmon32.exe	cmd.exe
PID 2756 wrote to memory of 2648	2756	cmmon32.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
PID:1088
- C:\Users\Admin\AppData\Local\Temp\68773735efbd467e3286df5cbd2cc678926f0821ebbc9c2633b215b31d0b7d45.exe
  "C:\Users\Admin\AppData\Local\Temp\68773735efbd467e3286df5cbd2cc678926f0821ebbc9c2633b215b31d0b7d45.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1876
- - C:\Windows\SysWOW64\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\68773735efbd467e3286df5cbd2cc678926f0821ebbc9c2633b215b31d0b7d45.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2556
  - - C:\Windows\SysWOW64\cmmon32.exe
      "C:\Windows\SysWOW64\cmmon32.exe"
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2756
    - - C:\Windows\SysWOW64\cmd.exe
        
        /c del "C:\Windows\SysWOW64\svchost.exe"
        5⤵
        
        PID:2648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1088-35-0x0000000003F10000-0x0000000003FA9000-memory.dmp

Filesize
612KB

Download
memory/1088-32-0x0000000003F10000-0x0000000003FA9000-memory.dmp

Filesize
612KB

Download
memory/1088-14-0x0000000003AF0000-0x0000000003BF0000-memory.dmp

Filesize
1024KB

Download
memory/1088-31-0x0000000003F10000-0x0000000003FA9000-memory.dmp

Filesize
612KB

Download
memory/1088-28-0x00000000046B0000-0x0000000004771000-memory.dmp

Filesize
772KB

Download
memory/1088-17-0x0000000006EA0000-0x0000000007017000-memory.dmp

Filesize
1.5MB

Download
memory/1088-22-0x00000000046B0000-0x0000000004771000-memory.dmp

Filesize
772KB

Download
memory/1876-10-0x00000000001E0000-0x00000000001E4000-memory.dmp

Filesize
16KB

Download
memory/2556-21-0x0000000000260000-0x0000000000275000-memory.dmp

Filesize
84KB

Download
memory/2556-20-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2556-15-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2556-16-0x00000000001D0000-0x00000000001E5000-memory.dmp

Filesize
84KB

Download
memory/2556-12-0x0000000000960000-0x0000000000C63000-memory.dmp

Filesize
3.0MB

Download
memory/2556-11-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2756-23-0x0000000000A00000-0x0000000000A0D000-memory.dmp

Filesize
52KB

Download
memory/2756-25-0x0000000000A00000-0x0000000000A0D000-memory.dmp

Filesize
52KB

Download
memory/2756-26-0x00000000000C0000-0x00000000000EF000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads