formbook | 864934ddf1df098beb15f1f6a3e45d7d2e4537b265fe0fc2fd6f4cfce556fd5e

General

Target

proforma Invoice .exe
Size

599KB
MD5

c675e7853c9cc47e31e436fe90448445
SHA1

47bf1af77eb9a18a70fc8e81d9caf4c466665576
SHA256

cdedbe45cbd9452a80416dc72dfe935c606d15cf4ebce3861ce428ab75aec7f3
SHA512

ba997897a7525b0e41c81c5056a120fb7566c8a0a632d04bafb190032f9843dfaa3f9b38c2f1831b102afaa7e10c29550a806aba47517ff233f6006ad8e24398
SSDEEP

12288:aX2qoF8gj58OR+3yKtIg51MRWDkuYRYPIBwhlIwUFg7dA:adgWOeyKqI1DKaPKwhl+FgBA

Score

10^/10

formbook pep rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

pep

Decoy

whitelabelgraphics.pro

futureguidefilms.com

mission-duplex.com

rutherealty.com

acehardwaremall.com

potenb.com

tbhawt.com

momentum-ip.group

m8sr8s.com

cfwagner.com

umiyama-eri.com

klantenvinden.com

simplycasd.com

visionhomerecruiting.com

inkjet-material.com

banking-aib.com

fast1performance.com

eventsbyja.com

breuer.network

smartecelectronics.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3228-12-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral2/memory/3228-17-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral2/memory/3228-21-0x0000000000400000-0x000000000042E000-memory.dmp	formbook

Suspicious use of SetThreadContext 4 IoCs

Processes:

proforma Invoice .exeproforma Invoice .exewscript.exe

description	pid	process	target process
PID 540 set thread context of 3228	540	proforma Invoice .exe	proforma Invoice .exe
PID 3228 set thread context of 3408	3228	proforma Invoice .exe	Explorer.EXE
PID 3228 set thread context of 3408	3228	proforma Invoice .exe	Explorer.EXE
PID 1336 set thread context of 3408	1336	wscript.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 36 IoCs

Processes:

proforma Invoice .exeproforma Invoice .exewscript.exe

pid	process
540	proforma Invoice .exe
540	proforma Invoice .exe
540	proforma Invoice .exe
540	proforma Invoice .exe
3228	proforma Invoice .exe
3228	proforma Invoice .exe
3228	proforma Invoice .exe
3228	proforma Invoice .exe
3228	proforma Invoice .exe
3228	proforma Invoice .exe
1336	wscript.exe
1336	wscript.exe
1336	wscript.exe
1336	wscript.exe
1336	wscript.exe
1336	wscript.exe
1336	wscript.exe
1336	wscript.exe
1336	wscript.exe
1336	wscript.exe
1336	wscript.exe
1336	wscript.exe
1336	wscript.exe
1336	wscript.exe
1336	wscript.exe
1336	wscript.exe
1336	wscript.exe
1336	wscript.exe
1336	wscript.exe
1336	wscript.exe
1336	wscript.exe
1336	wscript.exe
1336	wscript.exe
1336	wscript.exe
1336	wscript.exe
1336	wscript.exe

Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

proforma Invoice .exewscript.exe

pid process

3228 proforma Invoice .exe
3228 proforma Invoice .exe
3228 proforma Invoice .exe
3228 proforma Invoice .exe
1336 wscript.exe
1336 wscript.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

proforma Invoice .exeproforma Invoice .exewscript.exe

description pid process

Token: SeDebugPrivilege 540 proforma Invoice .exe
Token: SeDebugPrivilege 3228 proforma Invoice .exe
Token: SeDebugPrivilege 1336 wscript.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

3408 Explorer.EXE

pid	process
3228	proforma Invoice .exe
3228	proforma Invoice .exe
3228	proforma Invoice .exe
3228	proforma Invoice .exe
1336	wscript.exe
1336	wscript.exe

description	pid	process
Token: SeDebugPrivilege	540	proforma Invoice .exe
Token: SeDebugPrivilege	3228	proforma Invoice .exe
Token: SeDebugPrivilege	1336	wscript.exe

pid	process
3408	Explorer.EXE

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

proforma Invoice .exeExplorer.EXEwscript.exe

description	pid	process	target process
PID 540 wrote to memory of 4780	540	proforma Invoice .exe	proforma Invoice .exe
PID 540 wrote to memory of 4780	540	proforma Invoice .exe	proforma Invoice .exe
PID 540 wrote to memory of 4780	540	proforma Invoice .exe	proforma Invoice .exe
PID 540 wrote to memory of 244	540	proforma Invoice .exe	proforma Invoice .exe
PID 540 wrote to memory of 244	540	proforma Invoice .exe	proforma Invoice .exe
PID 540 wrote to memory of 244	540	proforma Invoice .exe	proforma Invoice .exe
PID 540 wrote to memory of 3228	540	proforma Invoice .exe	proforma Invoice .exe
PID 540 wrote to memory of 3228	540	proforma Invoice .exe	proforma Invoice .exe
PID 540 wrote to memory of 3228	540	proforma Invoice .exe	proforma Invoice .exe
PID 540 wrote to memory of 3228	540	proforma Invoice .exe	proforma Invoice .exe
PID 540 wrote to memory of 3228	540	proforma Invoice .exe	proforma Invoice .exe
PID 540 wrote to memory of 3228	540	proforma Invoice .exe	proforma Invoice .exe
PID 3408 wrote to memory of 1336	3408	Explorer.EXE	wscript.exe
PID 3408 wrote to memory of 1336	3408	Explorer.EXE	wscript.exe
PID 3408 wrote to memory of 1336	3408	Explorer.EXE	wscript.exe
PID 1336 wrote to memory of 1436	1336	wscript.exe	cmd.exe
PID 1336 wrote to memory of 1436	1336	wscript.exe	cmd.exe
PID 1336 wrote to memory of 1436	1336	wscript.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3408

C:\Users\Admin\AppData\Local\Temp\proforma Invoice .exe
"C:\Users\Admin\AppData\Local\Temp\proforma Invoice .exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:540

C:\Users\Admin\AppData\Local\Temp\proforma Invoice .exe
"C:\Users\Admin\AppData\Local\Temp\proforma Invoice .exe"
3⤵
PID:4780

C:\Users\Admin\AppData\Local\Temp\proforma Invoice .exe
"C:\Users\Admin\AppData\Local\Temp\proforma Invoice .exe"
3⤵
PID:244

C:\Users\Admin\AppData\Local\Temp\proforma Invoice .exe
"C:\Users\Admin\AppData\Local\Temp\proforma Invoice .exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3228

C:\Windows\SysWOW64\wscript.exe
"C:\Windows\SysWOW64\wscript.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1336

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\proforma Invoice .exe"
3⤵
PID:1436

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/540-6-0x0000000005A40000-0x0000000005A96000-memory.dmp

Filesize
344KB

Download
memory/540-8-0x00000000058D0000-0x00000000058DA000-memory.dmp

Filesize
40KB

Download
memory/540-2-0x0000000005660000-0x00000000056FC000-memory.dmp

Filesize
624KB

Download
memory/540-3-0x0000000005CB0000-0x0000000006254000-memory.dmp

Filesize
5.6MB

Download
memory/540-4-0x00000000057A0000-0x0000000005832000-memory.dmp

Filesize
584KB

Download
memory/540-5-0x0000000005740000-0x000000000574A000-memory.dmp

Filesize
40KB

Download
memory/540-1-0x0000000000D90000-0x0000000000E2C000-memory.dmp

Filesize
624KB

Download
memory/540-7-0x0000000075140000-0x00000000758F0000-memory.dmp

Filesize
7.7MB

Download
memory/540-14-0x0000000075140000-0x00000000758F0000-memory.dmp

Filesize
7.7MB

Download
memory/540-9-0x000000007514E000-0x000000007514F000-memory.dmp

Filesize
4KB

Download
memory/540-10-0x0000000075140000-0x00000000758F0000-memory.dmp

Filesize
7.7MB

Download
memory/540-11-0x0000000006460000-0x00000000064C2000-memory.dmp

Filesize
392KB

Download
memory/540-0-0x000000007514E000-0x000000007514F000-memory.dmp

Filesize
4KB

Download
memory/1336-24-0x0000000000A50000-0x0000000000A77000-memory.dmp

Filesize
156KB

Download
memory/1336-25-0x0000000000A50000-0x0000000000A77000-memory.dmp

Filesize
156KB

Download
memory/3228-12-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3228-18-0x00000000015E0000-0x00000000015F4000-memory.dmp

Filesize
80KB

Download
memory/3228-17-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3228-21-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3228-22-0x0000000001630000-0x0000000001644000-memory.dmp

Filesize
80KB

Download
memory/3228-15-0x0000000001190000-0x00000000014DA000-memory.dmp

Filesize
3.3MB

Download
memory/3408-23-0x0000000008BC0000-0x0000000008D5B000-memory.dmp

Filesize
1.6MB

Download
memory/3408-19-0x00000000030E0000-0x00000000031BD000-memory.dmp

Filesize
884KB

Download
memory/3408-27-0x00000000030E0000-0x00000000031BD000-memory.dmp

Filesize
884KB

Download
memory/3408-28-0x0000000008680000-0x0000000008810000-memory.dmp

Filesize
1.6MB

Download
memory/3408-29-0x0000000008BC0000-0x0000000008D5B000-memory.dmp

Filesize
1.6MB

Download
memory/3408-32-0x0000000008680000-0x0000000008810000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads