formbook | e004e6798d1e44ac7f24a273eeb129c8dfe9e4522baeda0e6756ec5319b90af1

General

Target

e004e6798d1e44ac7f24a273eeb129c8dfe9e4522baeda0e6756ec5319b90af1.exe
Size

594KB
MD5

a5a66a419e31b8a69cf1bd612ec6ffde
SHA1

a8e3a66fff21e337ada34998a717aaad0d323fc0
SHA256

e004e6798d1e44ac7f24a273eeb129c8dfe9e4522baeda0e6756ec5319b90af1
SHA512

9b797f22e6e1a030255adf506514ae3567fafc7853b5aa116a44bed0e63a62589cfe500cc84b98a62f10132fa14d2137da5c1622320433df71344bdad24faf93
SSDEEP

12288:+FIsPALdYGwUQkNVgnkLclbIDCTBr4TXzwgOAju:YIKtGEkNynD5IOTexTj

Score

10^/10

formbook dy13 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dy13

Decoy

manga-house.com

kjsdhklssk51.xyz

b0ba138.xyz

bt365033.com

ccbsinc.net

mrwine.xyz

nrxkrd527o.xyz

hoshi.social

1912ai.com

serco2020.com

byfchfyr.xyz

imuschestvostorgov.online

austinheafey.com

mrdfa.club

883106.photos

profitablefxmarkets.com

taini00.net

brye.top

ginsm.com

sportglid.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Detects executables packed with SmartAssembly 1 IoCs

Processes:

resource yara_rule

behavioral2/memory/4392-9-0x0000000005A50000-0x0000000005A5C000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly
Formbook payload 1 IoCs
rat

Processes:

resource yara_rule

behavioral2/memory/2000-11-0x0000000000400000-0x000000000042F000-memory.dmp formbook

resource	yara_rule
behavioral2/memory/4392-9-0x0000000005A50000-0x0000000005A5C000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly

resource	yara_rule
behavioral2/memory/2000-11-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

e004e6798d1e44ac7f24a273eeb129c8dfe9e4522baeda0e6756ec5319b90af1.exe

description	pid	process	target process
PID 4392 set thread context of 2000	4392	e004e6798d1e44ac7f24a273eeb129c8dfe9e4522baeda0e6756ec5319b90af1.exe	e004e6798d1e44ac7f24a273eeb129c8dfe9e4522baeda0e6756ec5319b90af1.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

e004e6798d1e44ac7f24a273eeb129c8dfe9e4522baeda0e6756ec5319b90af1.exee004e6798d1e44ac7f24a273eeb129c8dfe9e4522baeda0e6756ec5319b90af1.exe

pid	process
4392	e004e6798d1e44ac7f24a273eeb129c8dfe9e4522baeda0e6756ec5319b90af1.exe
4392	e004e6798d1e44ac7f24a273eeb129c8dfe9e4522baeda0e6756ec5319b90af1.exe
2000	e004e6798d1e44ac7f24a273eeb129c8dfe9e4522baeda0e6756ec5319b90af1.exe
2000	e004e6798d1e44ac7f24a273eeb129c8dfe9e4522baeda0e6756ec5319b90af1.exe
2000	e004e6798d1e44ac7f24a273eeb129c8dfe9e4522baeda0e6756ec5319b90af1.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

e004e6798d1e44ac7f24a273eeb129c8dfe9e4522baeda0e6756ec5319b90af1.exe

description pid process

Token: SeDebugPrivilege 4392 e004e6798d1e44ac7f24a273eeb129c8dfe9e4522baeda0e6756ec5319b90af1.exe

description	pid	process
Token: SeDebugPrivilege	4392	e004e6798d1e44ac7f24a273eeb129c8dfe9e4522baeda0e6756ec5319b90af1.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

e004e6798d1e44ac7f24a273eeb129c8dfe9e4522baeda0e6756ec5319b90af1.exe

description	pid	process	target process
PID 4392 wrote to memory of 972	4392	e004e6798d1e44ac7f24a273eeb129c8dfe9e4522baeda0e6756ec5319b90af1.exe	e004e6798d1e44ac7f24a273eeb129c8dfe9e4522baeda0e6756ec5319b90af1.exe
PID 4392 wrote to memory of 972	4392	e004e6798d1e44ac7f24a273eeb129c8dfe9e4522baeda0e6756ec5319b90af1.exe	e004e6798d1e44ac7f24a273eeb129c8dfe9e4522baeda0e6756ec5319b90af1.exe
PID 4392 wrote to memory of 972	4392	e004e6798d1e44ac7f24a273eeb129c8dfe9e4522baeda0e6756ec5319b90af1.exe	e004e6798d1e44ac7f24a273eeb129c8dfe9e4522baeda0e6756ec5319b90af1.exe
PID 4392 wrote to memory of 2000	4392	e004e6798d1e44ac7f24a273eeb129c8dfe9e4522baeda0e6756ec5319b90af1.exe	e004e6798d1e44ac7f24a273eeb129c8dfe9e4522baeda0e6756ec5319b90af1.exe
PID 4392 wrote to memory of 2000	4392	e004e6798d1e44ac7f24a273eeb129c8dfe9e4522baeda0e6756ec5319b90af1.exe	e004e6798d1e44ac7f24a273eeb129c8dfe9e4522baeda0e6756ec5319b90af1.exe
PID 4392 wrote to memory of 2000	4392	e004e6798d1e44ac7f24a273eeb129c8dfe9e4522baeda0e6756ec5319b90af1.exe	e004e6798d1e44ac7f24a273eeb129c8dfe9e4522baeda0e6756ec5319b90af1.exe
PID 4392 wrote to memory of 2000	4392	e004e6798d1e44ac7f24a273eeb129c8dfe9e4522baeda0e6756ec5319b90af1.exe	e004e6798d1e44ac7f24a273eeb129c8dfe9e4522baeda0e6756ec5319b90af1.exe
PID 4392 wrote to memory of 2000	4392	e004e6798d1e44ac7f24a273eeb129c8dfe9e4522baeda0e6756ec5319b90af1.exe	e004e6798d1e44ac7f24a273eeb129c8dfe9e4522baeda0e6756ec5319b90af1.exe
PID 4392 wrote to memory of 2000	4392	e004e6798d1e44ac7f24a273eeb129c8dfe9e4522baeda0e6756ec5319b90af1.exe	e004e6798d1e44ac7f24a273eeb129c8dfe9e4522baeda0e6756ec5319b90af1.exe

C:\Users\Admin\AppData\Local\Temp\e004e6798d1e44ac7f24a273eeb129c8dfe9e4522baeda0e6756ec5319b90af1.exe
"C:\Users\Admin\AppData\Local\Temp\e004e6798d1e44ac7f24a273eeb129c8dfe9e4522baeda0e6756ec5319b90af1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4392

C:\Users\Admin\AppData\Local\Temp\e004e6798d1e44ac7f24a273eeb129c8dfe9e4522baeda0e6756ec5319b90af1.exe
"C:\Users\Admin\AppData\Local\Temp\e004e6798d1e44ac7f24a273eeb129c8dfe9e4522baeda0e6756ec5319b90af1.exe"
2⤵
PID:972

C:\Users\Admin\AppData\Local\Temp\e004e6798d1e44ac7f24a273eeb129c8dfe9e4522baeda0e6756ec5319b90af1.exe
"C:\Users\Admin\AppData\Local\Temp\e004e6798d1e44ac7f24a273eeb129c8dfe9e4522baeda0e6756ec5319b90af1.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2000

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1424,i,2029050989380753659,15333598055019363793,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:8
1⤵
PID:4056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2000-11-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2000-14-0x00000000013C0000-0x000000000170A000-memory.dmp

Filesize
3.3MB

Download
memory/4392-6-0x0000000005760000-0x00000000057FC000-memory.dmp

Filesize
624KB

Download
memory/4392-3-0x0000000005430000-0x00000000054C2000-memory.dmp

Filesize
584KB

Download
memory/4392-4-0x0000000074EF0000-0x00000000756A0000-memory.dmp

Filesize
7.7MB

Download
memory/4392-5-0x0000000005410000-0x000000000541A000-memory.dmp

Filesize
40KB

Download
memory/4392-0-0x0000000074EFE000-0x0000000074EFF000-memory.dmp

Filesize
4KB

Download
memory/4392-7-0x0000000005A10000-0x0000000005A22000-memory.dmp

Filesize
72KB

Download
memory/4392-8-0x0000000005A40000-0x0000000005A48000-memory.dmp

Filesize
32KB

Download
memory/4392-9-0x0000000005A50000-0x0000000005A5C000-memory.dmp

Filesize
48KB

Download
memory/4392-10-0x0000000006790000-0x0000000006806000-memory.dmp

Filesize
472KB

Download
memory/4392-2-0x0000000005AE0000-0x0000000006084000-memory.dmp

Filesize
5.6MB

Download
memory/4392-13-0x0000000074EF0000-0x00000000756A0000-memory.dmp

Filesize
7.7MB

Download
memory/4392-1-0x0000000000980000-0x0000000000A1A000-memory.dmp

Filesize
616KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads