formbook | 9022ec12d1c63779111d34993afd7aa58f7a7ed7087271c52f2300dee80c7f89

General

Target

MalwareBazaar.exe
Size

760KB
MD5

c9101fc66be35a3746ffea8e448c5119
SHA1

453297f427c9c7a9b0e3a79fe4885d5d7c12af98
SHA256

9022ec12d1c63779111d34993afd7aa58f7a7ed7087271c52f2300dee80c7f89
SHA512

76efa88ad4a8d82b0b10abdc4dbb91db659e7ed4e9a9e4df6be8942f4235ad11ca27492907892da4cc82321be54056401b7caa1725a953784cab5bd1744bbdad
SSDEEP

12288:ICc0CBN2iN/ougr+OAnK3Uv4ybDHpT4fN6AhDALgVWTsY/sQj14GB:ICc0CBN1F7tOcK3Uv4yB4dhcMgAAJ

Score

10^/10

formbook dy13 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dy13

Decoy

manga-house.com

kjsdhklssk51.xyz

b0ba138.xyz

bt365033.com

ccbsinc.net

mrwine.xyz

nrxkrd527o.xyz

hoshi.social

1912ai.com

serco2020.com

byfchfyr.xyz

imuschestvostorgov.online

austinheafey.com

mrdfa.club

883106.photos

profitablefxmarkets.com

taini00.net

brye.top

ginsm.com

sportglid.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/2512-11-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/2512-16-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/2744-21-0x00000000000C0000-0x00000000000EF000-memory.dmp	formbook

Deletes itself 1 IoCs

pid	Process
2500	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2368 set thread context of 2512	2368	MalwareBazaar.exe	30
PID 2512 set thread context of 1220	2512	MalwareBazaar.exe	21
PID 2744 set thread context of 1220	2744	help.exe	21

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
2512	MalwareBazaar.exe
2512	MalwareBazaar.exe
2744	help.exe
2744	help.exe
2744	help.exe
2744	help.exe
2744	help.exe
2744	help.exe
2744	help.exe
2744	help.exe
2744	help.exe
2744	help.exe
2744	help.exe
2744	help.exe
2744	help.exe
2744	help.exe
2744	help.exe
2744	help.exe
2744	help.exe
2744	help.exe
2744	help.exe
2744	help.exe
2744	help.exe
2744	help.exe
2744	help.exe
2744	help.exe
2744	help.exe
2744	help.exe
2744	help.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
2512	MalwareBazaar.exe
2512	MalwareBazaar.exe
2512	MalwareBazaar.exe
2744	help.exe
2744	help.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2512	MalwareBazaar.exe
Token: SeDebugPrivilege	2744	help.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2512	2368	MalwareBazaar.exe	30
PID 2368 wrote to memory of 2512	2368	MalwareBazaar.exe	30
PID 2368 wrote to memory of 2512	2368	MalwareBazaar.exe	30
PID 2368 wrote to memory of 2512	2368	MalwareBazaar.exe	30
PID 2368 wrote to memory of 2512	2368	MalwareBazaar.exe	30
PID 2368 wrote to memory of 2512	2368	MalwareBazaar.exe	30
PID 2368 wrote to memory of 2512	2368	MalwareBazaar.exe	30
PID 1220 wrote to memory of 2744	1220	Explorer.EXE	31
PID 1220 wrote to memory of 2744	1220	Explorer.EXE	31
PID 1220 wrote to memory of 2744	1220	Explorer.EXE	31
PID 1220 wrote to memory of 2744	1220	Explorer.EXE	31
PID 2744 wrote to memory of 2500	2744	help.exe	33
PID 2744 wrote to memory of 2500	2744	help.exe	33
PID 2744 wrote to memory of 2500	2744	help.exe	33
PID 2744 wrote to memory of 2500	2744	help.exe	33

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe
  "C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2368
- - C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe
    "C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:2512
- C:\Windows\SysWOW64\help.exe
  "C:\Windows\SysWOW64\help.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2744
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"
    3⤵
    - Deletes itself
    PID:2500

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1220-15-0x0000000000010000-0x0000000000020000-memory.dmp

Filesize
64KB

Download
memory/1220-24-0x0000000003C70000-0x0000000003D64000-memory.dmp

Filesize
976KB

Download
memory/1220-18-0x0000000003C70000-0x0000000003D64000-memory.dmp

Filesize
976KB

Download
memory/2368-4-0x0000000000510000-0x0000000000518000-memory.dmp

Filesize
32KB

Download
memory/2368-12-0x0000000074D20000-0x000000007540E000-memory.dmp

Filesize
6.9MB

Download
memory/2368-0-0x0000000074D2E000-0x0000000074D2F000-memory.dmp

Filesize
4KB

Download
memory/2368-6-0x0000000001040000-0x00000000010B6000-memory.dmp

Filesize
472KB

Download
memory/2368-1-0x0000000001190000-0x0000000001254000-memory.dmp

Filesize
784KB

Download
memory/2368-5-0x0000000000520000-0x000000000052E000-memory.dmp

Filesize
56KB

Download
memory/2368-2-0x0000000074D20000-0x000000007540E000-memory.dmp

Filesize
6.9MB

Download
memory/2368-3-0x0000000000490000-0x00000000004A2000-memory.dmp

Filesize
72KB

Download
memory/2512-8-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2512-13-0x0000000000850000-0x0000000000B53000-memory.dmp

Filesize
3.0MB

Download
memory/2512-17-0x0000000000290000-0x00000000002A5000-memory.dmp

Filesize
84KB

Download
memory/2512-16-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2512-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2512-11-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2512-7-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2744-20-0x0000000000580000-0x0000000000586000-memory.dmp

Filesize
24KB

Download
memory/2744-19-0x0000000000580000-0x0000000000586000-memory.dmp

Filesize
24KB

Download
memory/2744-21-0x00000000000C0000-0x00000000000EF000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing