formbook | 9c5ada1bea0116faaa4cb16f966f2fa5af05d79293b2cb3b953d22d0d17ae680

General

Target

rAXDBwN46Wuxlc8.exe
Size

593KB
MD5

1c35913e1129c47ca535b3aea8d90078
SHA1

35f1cbcd7a52a3e1441d0f8cd67076e75b260b7a
SHA256

9c5ada1bea0116faaa4cb16f966f2fa5af05d79293b2cb3b953d22d0d17ae680
SHA512

a06df95313ed8708aaa34674041b3fe75122574ae334b69295ea049c110e5893143cd0ccfb0140eecebe7c15ed518e6c90a5f978569ba417fed41333d85dfe8d
SSDEEP

12288:V0JJwqLx/cHWzonE/DpX3Rx3UOMkPwCJTNmSWEtUP8XcoESZRYT57:VZtHEdX3H3eCJTNGrYXY

Score

10^/10

formbook dy13 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dy13

Decoy

manga-house.com

kjsdhklssk51.xyz

b0ba138.xyz

bt365033.com

ccbsinc.net

mrwine.xyz

nrxkrd527o.xyz

hoshi.social

1912ai.com

serco2020.com

byfchfyr.xyz

imuschestvostorgov.online

austinheafey.com

mrdfa.club

883106.photos

profitablefxmarkets.com

taini00.net

brye.top

ginsm.com

sportglid.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2728-13-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/2728-17-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/2728-22-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 3 IoCs

Processes:

rAXDBwN46Wuxlc8.exerAXDBwN46Wuxlc8.exe

description	pid	process	target process
PID 2356 set thread context of 2728	2356	rAXDBwN46Wuxlc8.exe	rAXDBwN46Wuxlc8.exe
PID 2728 set thread context of 1224	2728	rAXDBwN46Wuxlc8.exe	Explorer.EXE
PID 2728 set thread context of 1224	2728	rAXDBwN46Wuxlc8.exe	Explorer.EXE

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1188 2572 WerFault.exe msiexec.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rAXDBwN46Wuxlc8.exerAXDBwN46Wuxlc8.exe

pid process

2356 rAXDBwN46Wuxlc8.exe
2728 rAXDBwN46Wuxlc8.exe
2728 rAXDBwN46Wuxlc8.exe
2728 rAXDBwN46Wuxlc8.exe
Suspicious behavior: MapViewOfSection 4 IoCs

Processes:

rAXDBwN46Wuxlc8.exe

pid process

2728 rAXDBwN46Wuxlc8.exe
2728 rAXDBwN46Wuxlc8.exe
2728 rAXDBwN46Wuxlc8.exe
2728 rAXDBwN46Wuxlc8.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

rAXDBwN46Wuxlc8.exerAXDBwN46Wuxlc8.exeExplorer.EXE

description pid process

Token: SeDebugPrivilege 2356 rAXDBwN46Wuxlc8.exe
Token: SeDebugPrivilege 2728 rAXDBwN46Wuxlc8.exe
Token: SeShutdownPrivilege 1224 Explorer.EXE

pid	pid_target	process	target process
1188	2572	WerFault.exe	msiexec.exe

pid	process
2356	rAXDBwN46Wuxlc8.exe
2728	rAXDBwN46Wuxlc8.exe
2728	rAXDBwN46Wuxlc8.exe
2728	rAXDBwN46Wuxlc8.exe

pid	process
2728	rAXDBwN46Wuxlc8.exe
2728	rAXDBwN46Wuxlc8.exe
2728	rAXDBwN46Wuxlc8.exe
2728	rAXDBwN46Wuxlc8.exe

description	pid	process
Token: SeDebugPrivilege	2356	rAXDBwN46Wuxlc8.exe
Token: SeDebugPrivilege	2728	rAXDBwN46Wuxlc8.exe
Token: SeShutdownPrivilege	1224	Explorer.EXE

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

rAXDBwN46Wuxlc8.exeExplorer.EXEmsiexec.exe

description	pid	process	target process
PID 2356 wrote to memory of 2732	2356	rAXDBwN46Wuxlc8.exe	rAXDBwN46Wuxlc8.exe
PID 2356 wrote to memory of 2732	2356	rAXDBwN46Wuxlc8.exe	rAXDBwN46Wuxlc8.exe
PID 2356 wrote to memory of 2732	2356	rAXDBwN46Wuxlc8.exe	rAXDBwN46Wuxlc8.exe
PID 2356 wrote to memory of 2732	2356	rAXDBwN46Wuxlc8.exe	rAXDBwN46Wuxlc8.exe
PID 2356 wrote to memory of 2728	2356	rAXDBwN46Wuxlc8.exe	rAXDBwN46Wuxlc8.exe
PID 2356 wrote to memory of 2728	2356	rAXDBwN46Wuxlc8.exe	rAXDBwN46Wuxlc8.exe
PID 2356 wrote to memory of 2728	2356	rAXDBwN46Wuxlc8.exe	rAXDBwN46Wuxlc8.exe
PID 2356 wrote to memory of 2728	2356	rAXDBwN46Wuxlc8.exe	rAXDBwN46Wuxlc8.exe
PID 2356 wrote to memory of 2728	2356	rAXDBwN46Wuxlc8.exe	rAXDBwN46Wuxlc8.exe
PID 2356 wrote to memory of 2728	2356	rAXDBwN46Wuxlc8.exe	rAXDBwN46Wuxlc8.exe
PID 2356 wrote to memory of 2728	2356	rAXDBwN46Wuxlc8.exe	rAXDBwN46Wuxlc8.exe
PID 1224 wrote to memory of 2572	1224	Explorer.EXE	msiexec.exe
PID 1224 wrote to memory of 2572	1224	Explorer.EXE	msiexec.exe
PID 1224 wrote to memory of 2572	1224	Explorer.EXE	msiexec.exe
PID 1224 wrote to memory of 2572	1224	Explorer.EXE	msiexec.exe
PID 1224 wrote to memory of 2572	1224	Explorer.EXE	msiexec.exe
PID 1224 wrote to memory of 2572	1224	Explorer.EXE	msiexec.exe
PID 1224 wrote to memory of 2572	1224	Explorer.EXE	msiexec.exe
PID 2572 wrote to memory of 1188	2572	msiexec.exe	WerFault.exe
PID 2572 wrote to memory of 1188	2572	msiexec.exe	WerFault.exe
PID 2572 wrote to memory of 1188	2572	msiexec.exe	WerFault.exe
PID 2572 wrote to memory of 1188	2572	msiexec.exe	WerFault.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1224

C:\Users\Admin\AppData\Local\Temp\rAXDBwN46Wuxlc8.exe
"C:\Users\Admin\AppData\Local\Temp\rAXDBwN46Wuxlc8.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2356

C:\Users\Admin\AppData\Local\Temp\rAXDBwN46Wuxlc8.exe
"C:\Users\Admin\AppData\Local\Temp\rAXDBwN46Wuxlc8.exe"
3⤵
PID:2732

C:\Users\Admin\AppData\Local\Temp\rAXDBwN46Wuxlc8.exe
"C:\Users\Admin\AppData\Local\Temp\rAXDBwN46Wuxlc8.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2728

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:2840

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:2568

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\SysWOW64\msiexec.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2572 -s 268
3⤵
- Program crash
PID:1188

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1224-20-0x00000000050C0000-0x00000000051A2000-memory.dmp

Filesize
904KB

Download
memory/1224-32-0x0000000007520000-0x0000000007676000-memory.dmp

Filesize
1.3MB

Download
memory/1224-30-0x00000000050C0000-0x00000000051A2000-memory.dmp

Filesize
904KB

Download
memory/1224-24-0x0000000007520000-0x0000000007676000-memory.dmp

Filesize
1.3MB

Download
memory/1224-19-0x0000000003BB0000-0x0000000003CB0000-memory.dmp

Filesize
1024KB

Download
memory/2356-6-0x00000000057E0000-0x0000000005856000-memory.dmp

Filesize
472KB

Download
memory/2356-4-0x0000000000530000-0x0000000000540000-memory.dmp

Filesize
64KB

Download
memory/2356-1-0x0000000000E10000-0x0000000000EAA000-memory.dmp

Filesize
616KB

Download
memory/2356-2-0x0000000073FD0000-0x00000000746BE000-memory.dmp

Filesize
6.9MB

Download
memory/2356-0-0x0000000073FDE000-0x0000000073FDF000-memory.dmp

Filesize
4KB

Download
memory/2356-14-0x0000000073FD0000-0x00000000746BE000-memory.dmp

Filesize
6.9MB

Download
memory/2356-3-0x0000000004A00000-0x0000000004A8A000-memory.dmp

Filesize
552KB

Download
memory/2356-5-0x0000000000670000-0x000000000067C000-memory.dmp

Filesize
48KB

Download
memory/2572-28-0x0000000000E00000-0x0000000000E14000-memory.dmp

Filesize
80KB

Download
memory/2572-26-0x0000000000E00000-0x0000000000E14000-memory.dmp

Filesize
80KB

Download
memory/2572-25-0x0000000000E00000-0x0000000000E14000-memory.dmp

Filesize
80KB

Download
memory/2728-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2728-22-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2728-17-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2728-23-0x00000000002D0000-0x00000000002E5000-memory.dmp

Filesize
84KB

Download
memory/2728-18-0x0000000000280000-0x0000000000295000-memory.dmp

Filesize
84KB

Download
memory/2728-15-0x00000000008B0000-0x0000000000BB3000-memory.dmp

Filesize
3.0MB

Download
memory/2728-13-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2728-9-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2728-7-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads