formbook | bfb4b96460ce25a3a585f3780f8ab6c0db4d31dccfe614491876332c028d4328

General

Target

bfb4b96460ce25a3a585f3780f8ab6c0db4d31dccfe614491876332c028d4328.exe
Size

586KB
MD5

0d02d3493e4b372c0a1e3e9db2ea8577
SHA1

5e4f4684b03d984611ddfbd2a28e6cdfadb731cd
SHA256

bfb4b96460ce25a3a585f3780f8ab6c0db4d31dccfe614491876332c028d4328
SHA512

036e517d4d0fc8aca476de0f96e33520a8ad6801a7294341aeb3b4fece87fe6e39707ba306205743f4ca8ad895c4ab8c42a7326fee0c36af5800d4e67b77d8fe
SSDEEP

12288:h+MlmjxCKoK9oLK9YIzq3Z2EaWmPwe13zAVIEsX3BWqp4P:hKFCD+9YIzq3Zja5F138eU04P

Score

10^/10

formbook cu29 discovery rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

cu29

Decoy

qidr.shop

usinessaviationconsulting.net

68716329.xyz

nd-los.net

ealthironcladguarantee.shop

oftware-download-69354.bond

48372305.top

omeownershub.top

mall-chilli.top

ajakgoid.online

ire-changer-53482.bond

rugsrx.shop

oyang123.info

azino-forum-pro.online

817715.rest

layman.vip

eb777.club

ovatonica.net

urgaslotvip.website

inn-paaaa.buzz

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Formbook family
formbook

Formbook payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2948-11-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

bfb4b96460ce25a3a585f3780f8ab6c0db4d31dccfe614491876332c028d4328.exe

description	pid	Process	procid_target
PID 2324 set thread context of 2948	2324	bfb4b96460ce25a3a585f3780f8ab6c0db4d31dccfe614491876332c028d4328.exe	31

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

bfb4b96460ce25a3a585f3780f8ab6c0db4d31dccfe614491876332c028d4328.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bfb4b96460ce25a3a585f3780f8ab6c0db4d31dccfe614491876332c028d4328.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

bfb4b96460ce25a3a585f3780f8ab6c0db4d31dccfe614491876332c028d4328.exe

pid	Process
2948	bfb4b96460ce25a3a585f3780f8ab6c0db4d31dccfe614491876332c028d4328.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

bfb4b96460ce25a3a585f3780f8ab6c0db4d31dccfe614491876332c028d4328.exe

description	pid	Process	procid_target
PID 2324 wrote to memory of 2948	2324	bfb4b96460ce25a3a585f3780f8ab6c0db4d31dccfe614491876332c028d4328.exe	31
PID 2324 wrote to memory of 2948	2324	bfb4b96460ce25a3a585f3780f8ab6c0db4d31dccfe614491876332c028d4328.exe	31
PID 2324 wrote to memory of 2948	2324	bfb4b96460ce25a3a585f3780f8ab6c0db4d31dccfe614491876332c028d4328.exe	31
PID 2324 wrote to memory of 2948	2324	bfb4b96460ce25a3a585f3780f8ab6c0db4d31dccfe614491876332c028d4328.exe	31
PID 2324 wrote to memory of 2948	2324	bfb4b96460ce25a3a585f3780f8ab6c0db4d31dccfe614491876332c028d4328.exe	31
PID 2324 wrote to memory of 2948	2324	bfb4b96460ce25a3a585f3780f8ab6c0db4d31dccfe614491876332c028d4328.exe	31
PID 2324 wrote to memory of 2948	2324	bfb4b96460ce25a3a585f3780f8ab6c0db4d31dccfe614491876332c028d4328.exe	31

C:\Users\Admin\AppData\Local\Temp\bfb4b96460ce25a3a585f3780f8ab6c0db4d31dccfe614491876332c028d4328.exe
"C:\Users\Admin\AppData\Local\Temp\bfb4b96460ce25a3a585f3780f8ab6c0db4d31dccfe614491876332c028d4328.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Users\Admin\AppData\Local\Temp\bfb4b96460ce25a3a585f3780f8ab6c0db4d31dccfe614491876332c028d4328.exe
  "C:\Users\Admin\AppData\Local\Temp\bfb4b96460ce25a3a585f3780f8ab6c0db4d31dccfe614491876332c028d4328.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2324-6-0x0000000005E70000-0x0000000005EE6000-memory.dmp

Filesize
472KB

Download
memory/2324-1-0x0000000001170000-0x0000000001208000-memory.dmp

Filesize
608KB

Download
memory/2324-2-0x0000000074AC0000-0x00000000751AE000-memory.dmp

Filesize
6.9MB

Download
memory/2324-3-0x0000000074ACE000-0x0000000074ACF000-memory.dmp

Filesize
4KB

Download
memory/2324-4-0x0000000074AC0000-0x00000000751AE000-memory.dmp

Filesize
6.9MB

Download
memory/2324-5-0x00000000004F0000-0x0000000000502000-memory.dmp

Filesize
72KB

Download
memory/2324-0-0x0000000074ACE000-0x0000000074ACF000-memory.dmp

Filesize
4KB

Download
memory/2324-12-0x0000000074AC0000-0x00000000751AE000-memory.dmp

Filesize
6.9MB

Download
memory/2948-7-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2948-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2948-11-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2948-8-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2948-13-0x00000000008B0000-0x0000000000BB3000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads