formbook | 864934ddf1df098beb15f1f6a3e45d7d2e4537b265fe0fc2fd6f4cfce556fd5e

General

Target

proforma Invoice .exe
Size

599KB
MD5

c675e7853c9cc47e31e436fe90448445
SHA1

47bf1af77eb9a18a70fc8e81d9caf4c466665576
SHA256

cdedbe45cbd9452a80416dc72dfe935c606d15cf4ebce3861ce428ab75aec7f3
SHA512

ba997897a7525b0e41c81c5056a120fb7566c8a0a632d04bafb190032f9843dfaa3f9b38c2f1831b102afaa7e10c29550a806aba47517ff233f6006ad8e24398
SSDEEP

12288:aX2qoF8gj58OR+3yKtIg51MRWDkuYRYPIBwhlIwUFg7dA:adgWOeyKqI1DKaPKwhl+FgBA

Score

10^/10

formbook pep rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

pep

Decoy

whitelabelgraphics.pro

futureguidefilms.com

mission-duplex.com

rutherealty.com

acehardwaremall.com

potenb.com

tbhawt.com

momentum-ip.group

m8sr8s.com

cfwagner.com

umiyama-eri.com

klantenvinden.com

simplycasd.com

visionhomerecruiting.com

inkjet-material.com

banking-aib.com

fast1performance.com

eventsbyja.com

breuer.network

smartecelectronics.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Formbook payload 2 IoCs
rat

Processes:

resource yara_rule

behavioral1/memory/2824-11-0x0000000000400000-0x000000000042E000-memory.dmp formbook
behavioral1/memory/2824-15-0x0000000000400000-0x000000000042E000-memory.dmp formbook
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1572 cmd.exe

resource	yara_rule
behavioral1/memory/2824-11-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/2824-15-0x0000000000400000-0x000000000042E000-memory.dmp	formbook

pid	process
1572	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

proforma Invoice .exeproforma Invoice .execmd.exe

description	pid	process	target process
PID 1252 set thread context of 2824	1252	proforma Invoice .exe	proforma Invoice .exe
PID 2824 set thread context of 1184	2824	proforma Invoice .exe	Explorer.EXE
PID 2964 set thread context of 1184	2964	cmd.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 17 IoCs

Processes:

proforma Invoice .execmd.exe

pid	process
2824	proforma Invoice .exe
2824	proforma Invoice .exe
2964	cmd.exe
2964	cmd.exe
2964	cmd.exe
2964	cmd.exe
2964	cmd.exe
2964	cmd.exe
2964	cmd.exe
2964	cmd.exe
2964	cmd.exe
2964	cmd.exe
2964	cmd.exe
2964	cmd.exe
2964	cmd.exe
2964	cmd.exe
2964	cmd.exe

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

proforma Invoice .execmd.exe

pid process

2824 proforma Invoice .exe
2824 proforma Invoice .exe
2824 proforma Invoice .exe
2964 cmd.exe
2964 cmd.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

proforma Invoice .execmd.exe

description pid process

Token: SeDebugPrivilege 2824 proforma Invoice .exe
Token: SeDebugPrivilege 2964 cmd.exe

description	pid	process
Token: SeDebugPrivilege	2824	proforma Invoice .exe
Token: SeDebugPrivilege	2964	cmd.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

proforma Invoice .exeExplorer.EXEcmd.exe

description	pid	process	target process
PID 1252 wrote to memory of 2824	1252	proforma Invoice .exe	proforma Invoice .exe
PID 1252 wrote to memory of 2824	1252	proforma Invoice .exe	proforma Invoice .exe
PID 1252 wrote to memory of 2824	1252	proforma Invoice .exe	proforma Invoice .exe
PID 1252 wrote to memory of 2824	1252	proforma Invoice .exe	proforma Invoice .exe
PID 1252 wrote to memory of 2824	1252	proforma Invoice .exe	proforma Invoice .exe
PID 1252 wrote to memory of 2824	1252	proforma Invoice .exe	proforma Invoice .exe
PID 1252 wrote to memory of 2824	1252	proforma Invoice .exe	proforma Invoice .exe
PID 1184 wrote to memory of 2964	1184	Explorer.EXE	cmd.exe
PID 1184 wrote to memory of 2964	1184	Explorer.EXE	cmd.exe
PID 1184 wrote to memory of 2964	1184	Explorer.EXE	cmd.exe
PID 1184 wrote to memory of 2964	1184	Explorer.EXE	cmd.exe
PID 2964 wrote to memory of 1572	2964	cmd.exe	cmd.exe
PID 2964 wrote to memory of 1572	2964	cmd.exe	cmd.exe
PID 2964 wrote to memory of 1572	2964	cmd.exe	cmd.exe
PID 2964 wrote to memory of 1572	2964	cmd.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:1184

C:\Users\Admin\AppData\Local\Temp\proforma Invoice .exe
"C:\Users\Admin\AppData\Local\Temp\proforma Invoice .exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1252

C:\Users\Admin\AppData\Local\Temp\proforma Invoice .exe
"C:\Users\Admin\AppData\Local\Temp\proforma Invoice .exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2824

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\SysWOW64\cmd.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2964

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\proforma Invoice .exe"
3⤵
- Deletes itself
PID:1572

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1184-17-0x0000000003A70000-0x0000000003B70000-memory.dmp

Filesize
1024KB

Download
memory/1184-23-0x0000000004E90000-0x0000000004FC2000-memory.dmp

Filesize
1.2MB

Download
memory/1184-18-0x0000000004E90000-0x0000000004FC2000-memory.dmp

Filesize
1.2MB

Download
memory/1252-5-0x0000000074340000-0x0000000074A2E000-memory.dmp

Filesize
6.9MB

Download
memory/1252-12-0x0000000074340000-0x0000000074A2E000-memory.dmp

Filesize
6.9MB

Download
memory/1252-0-0x000000007434E000-0x000000007434F000-memory.dmp

Filesize
4KB

Download
memory/1252-6-0x0000000004C20000-0x0000000004C82000-memory.dmp

Filesize
392KB

Download
memory/1252-1-0x0000000000B90000-0x0000000000C2C000-memory.dmp

Filesize
624KB

Download
memory/1252-4-0x000000007434E000-0x000000007434F000-memory.dmp

Filesize
4KB

Download
memory/1252-2-0x0000000074340000-0x0000000074A2E000-memory.dmp

Filesize
6.9MB

Download
memory/1252-3-0x0000000000690000-0x000000000069A000-memory.dmp

Filesize
40KB

Download
memory/2824-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2824-13-0x0000000000C30000-0x0000000000F33000-memory.dmp

Filesize
3.0MB

Download
memory/2824-16-0x0000000000280000-0x0000000000294000-memory.dmp

Filesize
80KB

Download
memory/2824-15-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2824-11-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2824-8-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2824-7-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2964-19-0x0000000049EB0000-0x0000000049EFC000-memory.dmp

Filesize
304KB

Download
memory/2964-21-0x0000000049EB0000-0x0000000049EFC000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads