formbook | 93815b97bf6c09abc9e705096381dd25b658853e0751f7b95cc51123c251bcf2

General

Target

yPURXYpFVuXra2o.exe
Size

795KB
MD5

6c73961037087d34597fc8a582388bcc
SHA1

fc96081d921b7f82b9c559ffc335b02364199fd7
SHA256

93815b97bf6c09abc9e705096381dd25b658853e0751f7b95cc51123c251bcf2
SHA512

140b6064ecd453809a8a4a8d0fc1f2c82644fa53324c1d1995d4399f7d4f7db14d22dd6cdd9218c17d3d093e5be84667b0ed8f25690d1add9a3e43aa286536ce
SSDEEP

24576:zMYeWygN5iwSC6OJCa0jIOGFmGJlNmvcu:zMYeqN5idN6X0jvARNmUu

Score

10^/10

formbook cr12 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

cr12

Decoy

nff1291.com

satyainfra.com

hechiceradeamores.com

jfgminimalist.com

qut68q.com

pedandmore.com

sugardefender24-usa.us

somalse.com

lotusluxecandle.com

certificadobassetpro.com

veryaroma.com

thehistoryofindia.in

33155.cc

terastudy.net

84031.vip

heilsambegegnen.com

horizon-rg.info

junongpei.website

winstons.club

henslotalt.us

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2588-12-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/2588-17-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/3292-24-0x0000000000C40000-0x0000000000C6F000-memory.dmp	formbook

Suspicious use of SetThreadContext 3 IoCs

Processes:

yPURXYpFVuXra2o.exeyPURXYpFVuXra2o.exenetsh.exe

description	pid	process	target process
PID 4476 set thread context of 2588	4476	yPURXYpFVuXra2o.exe	yPURXYpFVuXra2o.exe
PID 2588 set thread context of 3604	2588	yPURXYpFVuXra2o.exe	Explorer.EXE
PID 3292 set thread context of 3604	3292	netsh.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 62 IoCs

Processes:

yPURXYpFVuXra2o.exeyPURXYpFVuXra2o.exenetsh.exe

pid	process
4476	yPURXYpFVuXra2o.exe
4476	yPURXYpFVuXra2o.exe
4476	yPURXYpFVuXra2o.exe
4476	yPURXYpFVuXra2o.exe
2588	yPURXYpFVuXra2o.exe
2588	yPURXYpFVuXra2o.exe
2588	yPURXYpFVuXra2o.exe
2588	yPURXYpFVuXra2o.exe
3292	netsh.exe
3292	netsh.exe
3292	netsh.exe
3292	netsh.exe
3292	netsh.exe
3292	netsh.exe
3292	netsh.exe
3292	netsh.exe
3292	netsh.exe
3292	netsh.exe
3292	netsh.exe
3292	netsh.exe
3292	netsh.exe
3292	netsh.exe
3292	netsh.exe
3292	netsh.exe
3292	netsh.exe
3292	netsh.exe
3292	netsh.exe
3292	netsh.exe
3292	netsh.exe
3292	netsh.exe
3292	netsh.exe
3292	netsh.exe
3292	netsh.exe
3292	netsh.exe
3292	netsh.exe
3292	netsh.exe
3292	netsh.exe
3292	netsh.exe
3292	netsh.exe
3292	netsh.exe
3292	netsh.exe
3292	netsh.exe
3292	netsh.exe
3292	netsh.exe
3292	netsh.exe
3292	netsh.exe
3292	netsh.exe
3292	netsh.exe
3292	netsh.exe
3292	netsh.exe
3292	netsh.exe
3292	netsh.exe
3292	netsh.exe
3292	netsh.exe
3292	netsh.exe
3292	netsh.exe
3292	netsh.exe
3292	netsh.exe
3292	netsh.exe
3292	netsh.exe
3292	netsh.exe
3292	netsh.exe

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

yPURXYpFVuXra2o.exenetsh.exe

pid process

2588 yPURXYpFVuXra2o.exe
2588 yPURXYpFVuXra2o.exe
2588 yPURXYpFVuXra2o.exe
3292 netsh.exe
3292 netsh.exe

pid	process
2588	yPURXYpFVuXra2o.exe
2588	yPURXYpFVuXra2o.exe
2588	yPURXYpFVuXra2o.exe
3292	netsh.exe
3292	netsh.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

yPURXYpFVuXra2o.exeyPURXYpFVuXra2o.exenetsh.exe

description	pid	process
Token: SeDebugPrivilege	4476	yPURXYpFVuXra2o.exe
Token: SeDebugPrivilege	2588	yPURXYpFVuXra2o.exe
Token: SeDebugPrivilege	3292	netsh.exe

Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

3604 Explorer.EXE

pid	process
3604	Explorer.EXE

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

yPURXYpFVuXra2o.exeExplorer.EXEnetsh.exe

description	pid	process	target process
PID 4476 wrote to memory of 4848	4476	yPURXYpFVuXra2o.exe	yPURXYpFVuXra2o.exe
PID 4476 wrote to memory of 4848	4476	yPURXYpFVuXra2o.exe	yPURXYpFVuXra2o.exe
PID 4476 wrote to memory of 4848	4476	yPURXYpFVuXra2o.exe	yPURXYpFVuXra2o.exe
PID 4476 wrote to memory of 2568	4476	yPURXYpFVuXra2o.exe	yPURXYpFVuXra2o.exe
PID 4476 wrote to memory of 2568	4476	yPURXYpFVuXra2o.exe	yPURXYpFVuXra2o.exe
PID 4476 wrote to memory of 2568	4476	yPURXYpFVuXra2o.exe	yPURXYpFVuXra2o.exe
PID 4476 wrote to memory of 2588	4476	yPURXYpFVuXra2o.exe	yPURXYpFVuXra2o.exe
PID 4476 wrote to memory of 2588	4476	yPURXYpFVuXra2o.exe	yPURXYpFVuXra2o.exe
PID 4476 wrote to memory of 2588	4476	yPURXYpFVuXra2o.exe	yPURXYpFVuXra2o.exe
PID 4476 wrote to memory of 2588	4476	yPURXYpFVuXra2o.exe	yPURXYpFVuXra2o.exe
PID 4476 wrote to memory of 2588	4476	yPURXYpFVuXra2o.exe	yPURXYpFVuXra2o.exe
PID 4476 wrote to memory of 2588	4476	yPURXYpFVuXra2o.exe	yPURXYpFVuXra2o.exe
PID 3604 wrote to memory of 3292	3604	Explorer.EXE	netsh.exe
PID 3604 wrote to memory of 3292	3604	Explorer.EXE	netsh.exe
PID 3604 wrote to memory of 3292	3604	Explorer.EXE	netsh.exe
PID 3292 wrote to memory of 1356	3292	netsh.exe	cmd.exe
PID 3292 wrote to memory of 1356	3292	netsh.exe	cmd.exe
PID 3292 wrote to memory of 1356	3292	netsh.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3604
- C:\Users\Admin\AppData\Local\Temp\yPURXYpFVuXra2o.exe
  "C:\Users\Admin\AppData\Local\Temp\yPURXYpFVuXra2o.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4476
- - C:\Users\Admin\AppData\Local\Temp\yPURXYpFVuXra2o.exe
    "C:\Users\Admin\AppData\Local\Temp\yPURXYpFVuXra2o.exe"
    3⤵
    PID:4848
- - C:\Users\Admin\AppData\Local\Temp\yPURXYpFVuXra2o.exe
    "C:\Users\Admin\AppData\Local\Temp\yPURXYpFVuXra2o.exe"
    3⤵
    PID:2568
- - C:\Users\Admin\AppData\Local\Temp\yPURXYpFVuXra2o.exe
    "C:\Users\Admin\AppData\Local\Temp\yPURXYpFVuXra2o.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:2588
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\SysWOW64\netsh.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3292
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\yPURXYpFVuXra2o.exe"
    3⤵
    PID:1356

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2588-12-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2588-17-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2588-18-0x0000000001360000-0x0000000001374000-memory.dmp

Filesize
80KB

Download
memory/2588-15-0x0000000000EF0000-0x000000000123A000-memory.dmp

Filesize
3.3MB

Download
memory/3292-20-0x0000000000CF0000-0x0000000000D0E000-memory.dmp

Filesize
120KB

Download
memory/3292-24-0x0000000000C40000-0x0000000000C6F000-memory.dmp

Filesize
188KB

Download
memory/3292-23-0x0000000000CF0000-0x0000000000D0E000-memory.dmp

Filesize
120KB

Download
memory/3604-19-0x0000000008120000-0x000000000821B000-memory.dmp

Filesize
1004KB

Download
memory/3604-33-0x0000000008310000-0x0000000008460000-memory.dmp

Filesize
1.3MB

Download
memory/3604-30-0x0000000008310000-0x0000000008460000-memory.dmp

Filesize
1.3MB

Download
memory/3604-29-0x0000000008310000-0x0000000008460000-memory.dmp

Filesize
1.3MB

Download
memory/3604-26-0x0000000008120000-0x000000000821B000-memory.dmp

Filesize
1004KB

Download
memory/4476-10-0x0000000006650000-0x00000000066C6000-memory.dmp

Filesize
472KB

Download
memory/4476-14-0x0000000074EA0000-0x0000000075650000-memory.dmp

Filesize
7.7MB

Download
memory/4476-3-0x0000000005070000-0x0000000005102000-memory.dmp

Filesize
584KB

Download
memory/4476-2-0x0000000005620000-0x0000000005BC4000-memory.dmp

Filesize
5.6MB

Download
memory/4476-1-0x0000000000560000-0x000000000062C000-memory.dmp

Filesize
816KB

Download
memory/4476-4-0x0000000005BD0000-0x0000000005F24000-memory.dmp

Filesize
3.3MB

Download
memory/4476-0-0x0000000074EAE000-0x0000000074EAF000-memory.dmp

Filesize
4KB

Download
memory/4476-11-0x0000000006920000-0x00000000069BC000-memory.dmp

Filesize
624KB

Download
memory/4476-5-0x0000000074EA0000-0x0000000075650000-memory.dmp

Filesize
7.7MB

Download
memory/4476-9-0x0000000005610000-0x0000000005620000-memory.dmp

Filesize
64KB

Download
memory/4476-8-0x0000000005600000-0x000000000560E000-memory.dmp

Filesize
56KB

Download
memory/4476-7-0x00000000055E0000-0x00000000055F6000-memory.dmp

Filesize
88KB

Download
memory/4476-6-0x00000000052D0000-0x00000000052DA000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads