formbook | 5c9ae21073af32232996e56ea997bd90f612831cc82809260bc47d83cfe291f6

General

Target

8b10a744ecc77aa0c6ed8596d46513a3de252356f9a1b52cc7c6e8ed459c36b9.exe
Size

922KB
MD5

abf416a9f8f2da1f9bd6e44a9369ae21
SHA1

73bdbf62470ebc25850cb22d9c7e3bc2006c9f01
SHA256

8b10a744ecc77aa0c6ed8596d46513a3de252356f9a1b52cc7c6e8ed459c36b9
SHA512

75d5eb0f8ffb05299aa2225b61cad1ff24749140d469b130e5d57a5f6ee99a6a727bcbb73595ef8d8d35ecf50a54caab1caaaec604bc6a9dfa12abb351be4638
SSDEEP

12288:2TDDXJN68jyeZfaGkH7GtKdOv+CbjReMUCPvti/o7qZn57aypHtNpI:2Fr7WH7ndOWCbjZ5Niw7A3a

Score

10^/10

formbook cnp0 discovery rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

cnp0

Decoy

jiarenyuanhunlian.com

xquizitelashesnwaxx.com

rentinerie.com

herbalpedia-id.com

openseagames.com

re-swap.com

william-cook.com

segensv.com

versebay.com

brendanlairdsound.com

bypestor.com

hospitaldelpc.net

wwwroadrunnerfinancial.com

waterhammerstudios.com

hustleandbank.photography

secure01bchslogin.com

rarepeperanking.com

greatland.company

happybirthdayjewel.com

raheok.store

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/3036-12-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2408 set thread context of 3036	2408	8b10a744ecc77aa0c6ed8596d46513a3de252356f9a1b52cc7c6e8ed459c36b9.exe	31

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2948	3036	WerFault.exe	31

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8b10a744ecc77aa0c6ed8596d46513a3de252356f9a1b52cc7c6e8ed459c36b9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8b10a744ecc77aa0c6ed8596d46513a3de252356f9a1b52cc7c6e8ed459c36b9.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 3036	2408	8b10a744ecc77aa0c6ed8596d46513a3de252356f9a1b52cc7c6e8ed459c36b9.exe	31
PID 2408 wrote to memory of 3036	2408	8b10a744ecc77aa0c6ed8596d46513a3de252356f9a1b52cc7c6e8ed459c36b9.exe	31
PID 2408 wrote to memory of 3036	2408	8b10a744ecc77aa0c6ed8596d46513a3de252356f9a1b52cc7c6e8ed459c36b9.exe	31
PID 2408 wrote to memory of 3036	2408	8b10a744ecc77aa0c6ed8596d46513a3de252356f9a1b52cc7c6e8ed459c36b9.exe	31
PID 2408 wrote to memory of 3036	2408	8b10a744ecc77aa0c6ed8596d46513a3de252356f9a1b52cc7c6e8ed459c36b9.exe	31
PID 2408 wrote to memory of 3036	2408	8b10a744ecc77aa0c6ed8596d46513a3de252356f9a1b52cc7c6e8ed459c36b9.exe	31
PID 2408 wrote to memory of 3036	2408	8b10a744ecc77aa0c6ed8596d46513a3de252356f9a1b52cc7c6e8ed459c36b9.exe	31
PID 3036 wrote to memory of 2948	3036	8b10a744ecc77aa0c6ed8596d46513a3de252356f9a1b52cc7c6e8ed459c36b9.exe	32
PID 3036 wrote to memory of 2948	3036	8b10a744ecc77aa0c6ed8596d46513a3de252356f9a1b52cc7c6e8ed459c36b9.exe	32
PID 3036 wrote to memory of 2948	3036	8b10a744ecc77aa0c6ed8596d46513a3de252356f9a1b52cc7c6e8ed459c36b9.exe	32
PID 3036 wrote to memory of 2948	3036	8b10a744ecc77aa0c6ed8596d46513a3de252356f9a1b52cc7c6e8ed459c36b9.exe	32

C:\Users\Admin\AppData\Local\Temp\8b10a744ecc77aa0c6ed8596d46513a3de252356f9a1b52cc7c6e8ed459c36b9.exe
"C:\Users\Admin\AppData\Local\Temp\8b10a744ecc77aa0c6ed8596d46513a3de252356f9a1b52cc7c6e8ed459c36b9.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Users\Admin\AppData\Local\Temp\8b10a744ecc77aa0c6ed8596d46513a3de252356f9a1b52cc7c6e8ed459c36b9.exe
  "C:\Users\Admin\AppData\Local\Temp\8b10a744ecc77aa0c6ed8596d46513a3de252356f9a1b52cc7c6e8ed459c36b9.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3036
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 36
    3⤵
    - Program crash
    PID:2948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2408-0-0x00000000745AE000-0x00000000745AF000-memory.dmp

Filesize
4KB

Download
memory/2408-1-0x0000000000A40000-0x0000000000B2E000-memory.dmp

Filesize
952KB

Download
memory/2408-2-0x00000000745A0000-0x0000000074C8E000-memory.dmp

Filesize
6.9MB

Download
memory/2408-3-0x0000000000370000-0x000000000037E000-memory.dmp

Filesize
56KB

Download
memory/2408-4-0x00000000745AE000-0x00000000745AF000-memory.dmp

Filesize
4KB

Download
memory/2408-5-0x00000000745A0000-0x0000000074C8E000-memory.dmp

Filesize
6.9MB

Download
memory/2408-6-0x0000000004900000-0x0000000004958000-memory.dmp

Filesize
352KB

Download
memory/2408-13-0x00000000745A0000-0x0000000074C8E000-memory.dmp

Filesize
6.9MB

Download
memory/3036-7-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3036-12-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3036-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3036-9-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing