formbook | 93815b97bf6c09abc9e705096381dd25b658853e0751f7b95cc51123c251bcf2

General

Target

yPURXYpFVuXra2o.exe
Size

795KB
MD5

6c73961037087d34597fc8a582388bcc
SHA1

fc96081d921b7f82b9c559ffc335b02364199fd7
SHA256

93815b97bf6c09abc9e705096381dd25b658853e0751f7b95cc51123c251bcf2
SHA512

140b6064ecd453809a8a4a8d0fc1f2c82644fa53324c1d1995d4399f7d4f7db14d22dd6cdd9218c17d3d093e5be84667b0ed8f25690d1add9a3e43aa286536ce
SSDEEP

24576:zMYeWygN5iwSC6OJCa0jIOGFmGJlNmvcu:zMYeqN5idN6X0jvARNmUu

Score

10^/10

formbook cr12 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

cr12

Decoy

nff1291.com

satyainfra.com

hechiceradeamores.com

jfgminimalist.com

qut68q.com

pedandmore.com

sugardefender24-usa.us

somalse.com

lotusluxecandle.com

certificadobassetpro.com

veryaroma.com

thehistoryofindia.in

33155.cc

terastudy.net

84031.vip

heilsambegegnen.com

horizon-rg.info

junongpei.website

winstons.club

henslotalt.us

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2664-11-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/2664-15-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/2656-21-0x0000000000080000-0x00000000000AF000-memory.dmp	formbook

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2560 cmd.exe

pid	process
2560	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

yPURXYpFVuXra2o.exeyPURXYpFVuXra2o.exeexplorer.exe

description	pid	process	target process
PID 1744 set thread context of 2664	1744	yPURXYpFVuXra2o.exe	yPURXYpFVuXra2o.exe
PID 2664 set thread context of 1196	2664	yPURXYpFVuXra2o.exe	Explorer.EXE
PID 2656 set thread context of 1196	2656	explorer.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 28 IoCs

Processes:

yPURXYpFVuXra2o.exeexplorer.exe

pid	process
2664	yPURXYpFVuXra2o.exe
2664	yPURXYpFVuXra2o.exe
2656	explorer.exe
2656	explorer.exe
2656	explorer.exe
2656	explorer.exe
2656	explorer.exe
2656	explorer.exe
2656	explorer.exe
2656	explorer.exe
2656	explorer.exe
2656	explorer.exe
2656	explorer.exe
2656	explorer.exe
2656	explorer.exe
2656	explorer.exe
2656	explorer.exe
2656	explorer.exe
2656	explorer.exe
2656	explorer.exe
2656	explorer.exe
2656	explorer.exe
2656	explorer.exe
2656	explorer.exe
2656	explorer.exe
2656	explorer.exe
2656	explorer.exe
2656	explorer.exe

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

yPURXYpFVuXra2o.exeexplorer.exe

pid process

2664 yPURXYpFVuXra2o.exe
2664 yPURXYpFVuXra2o.exe
2664 yPURXYpFVuXra2o.exe
2656 explorer.exe
2656 explorer.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

yPURXYpFVuXra2o.exeexplorer.exe

description pid process

Token: SeDebugPrivilege 2664 yPURXYpFVuXra2o.exe
Token: SeDebugPrivilege 2656 explorer.exe

description	pid	process
Token: SeDebugPrivilege	2664	yPURXYpFVuXra2o.exe
Token: SeDebugPrivilege	2656	explorer.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

yPURXYpFVuXra2o.exeExplorer.EXEexplorer.exe

description	pid	process	target process
PID 1744 wrote to memory of 2664	1744	yPURXYpFVuXra2o.exe	yPURXYpFVuXra2o.exe
PID 1744 wrote to memory of 2664	1744	yPURXYpFVuXra2o.exe	yPURXYpFVuXra2o.exe
PID 1744 wrote to memory of 2664	1744	yPURXYpFVuXra2o.exe	yPURXYpFVuXra2o.exe
PID 1744 wrote to memory of 2664	1744	yPURXYpFVuXra2o.exe	yPURXYpFVuXra2o.exe
PID 1744 wrote to memory of 2664	1744	yPURXYpFVuXra2o.exe	yPURXYpFVuXra2o.exe
PID 1744 wrote to memory of 2664	1744	yPURXYpFVuXra2o.exe	yPURXYpFVuXra2o.exe
PID 1744 wrote to memory of 2664	1744	yPURXYpFVuXra2o.exe	yPURXYpFVuXra2o.exe
PID 1196 wrote to memory of 2656	1196	Explorer.EXE	explorer.exe
PID 1196 wrote to memory of 2656	1196	Explorer.EXE	explorer.exe
PID 1196 wrote to memory of 2656	1196	Explorer.EXE	explorer.exe
PID 1196 wrote to memory of 2656	1196	Explorer.EXE	explorer.exe
PID 2656 wrote to memory of 2560	2656	explorer.exe	cmd.exe
PID 2656 wrote to memory of 2560	2656	explorer.exe	cmd.exe
PID 2656 wrote to memory of 2560	2656	explorer.exe	cmd.exe
PID 2656 wrote to memory of 2560	2656	explorer.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Users\Admin\AppData\Local\Temp\yPURXYpFVuXra2o.exe
  "C:\Users\Admin\AppData\Local\Temp\yPURXYpFVuXra2o.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\Users\Admin\AppData\Local\Temp\yPURXYpFVuXra2o.exe
    "C:\Users\Admin\AppData\Local\Temp\yPURXYpFVuXra2o.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:2664
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\SysWOW64\explorer.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\yPURXYpFVuXra2o.exe"
    3⤵
    - Deletes itself
    PID:2560

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1196-17-0x0000000003C70000-0x0000000003D70000-memory.dmp

Filesize
1024KB

Download
memory/1196-24-0x00000000052A0000-0x0000000005418000-memory.dmp

Filesize
1.5MB

Download
memory/1196-18-0x00000000052A0000-0x0000000005418000-memory.dmp

Filesize
1.5MB

Download
memory/1744-5-0x00000000004F0000-0x0000000000500000-memory.dmp

Filesize
64KB

Download
memory/1744-2-0x0000000074340000-0x0000000074A2E000-memory.dmp

Filesize
6.9MB

Download
memory/1744-0-0x000000007434E000-0x000000007434F000-memory.dmp

Filesize
4KB

Download
memory/1744-6-0x0000000005410000-0x0000000005486000-memory.dmp

Filesize
472KB

Download
memory/1744-1-0x0000000000E30000-0x0000000000EFC000-memory.dmp

Filesize
816KB

Download
memory/1744-12-0x0000000074340000-0x0000000074A2E000-memory.dmp

Filesize
6.9MB

Download
memory/1744-4-0x00000000004E0000-0x00000000004EE000-memory.dmp

Filesize
56KB

Download
memory/1744-3-0x00000000004A0000-0x00000000004B6000-memory.dmp

Filesize
88KB

Download
memory/2656-21-0x0000000000080000-0x00000000000AF000-memory.dmp

Filesize
188KB

Download
memory/2656-20-0x0000000000980000-0x0000000000C01000-memory.dmp

Filesize
2.5MB

Download
memory/2656-19-0x0000000000980000-0x0000000000C01000-memory.dmp

Filesize
2.5MB

Download
memory/2664-13-0x0000000000700000-0x0000000000A03000-memory.dmp

Filesize
3.0MB

Download
memory/2664-16-0x0000000000430000-0x0000000000444000-memory.dmp

Filesize
80KB

Download
memory/2664-15-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2664-8-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2664-11-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2664-7-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2664-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads