formbook | a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c

General

Target

h8N9qpyRAPaiitu.exe
Size

795KB
MD5

a6d026ed6d34720275d8d6fd98ad5113
SHA1

fb398d1e20b29f5dc346a7b84309a0e5c55ce7d7
SHA256

a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c
SHA512

9c46f3271e02a45b63beac8e74c84fc05a987ffb53fd41fa79c1d60a1c8379d72bc1df256dc7ba9e01363e0767e616e5ee4b32c22c9efbd1ea8496eb8364f324
SSDEEP

12288:9TCE8GILjWLWgAnOKU1AIcP4CVIadpBR8wZLm5cAw0sVj0b1SMp0dR:ccAOKU1AIlihPPlZLmZw2pp4

Score

10^/10

formbook mc10 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

mc10

Decoy

sttcorp.one

jack88.lat

owl-protect.com

hnszrrn.com

at89v2.com

h147.top

takle4creators.com

fondsa.xyz

mantenopolice.com

shophansler.com

dessertt.com

thecollisionmagazine.com

tatesfluffyfrenchies.com

h1f2v.rest

bluewandltd.com

cuplaho2003.shop

2thetcleaningservice.com

yc85w.top

natursache.shop

allmyabilities.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2600-10-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/2600-15-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/2600-20-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/2760-25-0x0000000000080000-0x00000000000AF000-memory.dmp	formbook

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2860 cmd.exe

pid	process
2860	cmd.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

h8N9qpyRAPaiitu.exeh8N9qpyRAPaiitu.execolorcpl.exe

description	pid	process	target process
PID 1096 set thread context of 2600	1096	h8N9qpyRAPaiitu.exe	h8N9qpyRAPaiitu.exe
PID 2600 set thread context of 1340	2600	h8N9qpyRAPaiitu.exe	Explorer.EXE
PID 2600 set thread context of 1340	2600	h8N9qpyRAPaiitu.exe	Explorer.EXE
PID 2760 set thread context of 1340	2760	colorcpl.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 29 IoCs

Processes:

h8N9qpyRAPaiitu.execolorcpl.exe

pid	process
2600	h8N9qpyRAPaiitu.exe
2600	h8N9qpyRAPaiitu.exe
2600	h8N9qpyRAPaiitu.exe
2760	colorcpl.exe
2760	colorcpl.exe
2760	colorcpl.exe
2760	colorcpl.exe
2760	colorcpl.exe
2760	colorcpl.exe
2760	colorcpl.exe
2760	colorcpl.exe
2760	colorcpl.exe
2760	colorcpl.exe
2760	colorcpl.exe
2760	colorcpl.exe
2760	colorcpl.exe
2760	colorcpl.exe
2760	colorcpl.exe
2760	colorcpl.exe
2760	colorcpl.exe
2760	colorcpl.exe
2760	colorcpl.exe
2760	colorcpl.exe
2760	colorcpl.exe
2760	colorcpl.exe
2760	colorcpl.exe
2760	colorcpl.exe
2760	colorcpl.exe
2760	colorcpl.exe

Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

h8N9qpyRAPaiitu.execolorcpl.exe

pid process

2600 h8N9qpyRAPaiitu.exe
2600 h8N9qpyRAPaiitu.exe
2600 h8N9qpyRAPaiitu.exe
2600 h8N9qpyRAPaiitu.exe
2760 colorcpl.exe
2760 colorcpl.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

h8N9qpyRAPaiitu.execolorcpl.exe

description pid process

Token: SeDebugPrivilege 2600 h8N9qpyRAPaiitu.exe
Token: SeDebugPrivilege 2760 colorcpl.exe

description	pid	process
Token: SeDebugPrivilege	2600	h8N9qpyRAPaiitu.exe
Token: SeDebugPrivilege	2760	colorcpl.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

h8N9qpyRAPaiitu.exeExplorer.EXEcolorcpl.exe

description	pid	process	target process
PID 1096 wrote to memory of 2600	1096	h8N9qpyRAPaiitu.exe	h8N9qpyRAPaiitu.exe
PID 1096 wrote to memory of 2600	1096	h8N9qpyRAPaiitu.exe	h8N9qpyRAPaiitu.exe
PID 1096 wrote to memory of 2600	1096	h8N9qpyRAPaiitu.exe	h8N9qpyRAPaiitu.exe
PID 1096 wrote to memory of 2600	1096	h8N9qpyRAPaiitu.exe	h8N9qpyRAPaiitu.exe
PID 1096 wrote to memory of 2600	1096	h8N9qpyRAPaiitu.exe	h8N9qpyRAPaiitu.exe
PID 1096 wrote to memory of 2600	1096	h8N9qpyRAPaiitu.exe	h8N9qpyRAPaiitu.exe
PID 1096 wrote to memory of 2600	1096	h8N9qpyRAPaiitu.exe	h8N9qpyRAPaiitu.exe
PID 1340 wrote to memory of 2760	1340	Explorer.EXE	colorcpl.exe
PID 1340 wrote to memory of 2760	1340	Explorer.EXE	colorcpl.exe
PID 1340 wrote to memory of 2760	1340	Explorer.EXE	colorcpl.exe
PID 1340 wrote to memory of 2760	1340	Explorer.EXE	colorcpl.exe
PID 2760 wrote to memory of 2860	2760	colorcpl.exe	cmd.exe
PID 2760 wrote to memory of 2860	2760	colorcpl.exe	cmd.exe
PID 2760 wrote to memory of 2860	2760	colorcpl.exe	cmd.exe
PID 2760 wrote to memory of 2860	2760	colorcpl.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:1340

C:\Users\Admin\AppData\Local\Temp\h8N9qpyRAPaiitu.exe
"C:\Users\Admin\AppData\Local\Temp\h8N9qpyRAPaiitu.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1096

C:\Users\Admin\AppData\Local\Temp\h8N9qpyRAPaiitu.exe
"C:\Users\Admin\AppData\Local\Temp\h8N9qpyRAPaiitu.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2600

C:\Windows\SysWOW64\colorcpl.exe
"C:\Windows\SysWOW64\colorcpl.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2760

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\h8N9qpyRAPaiitu.exe"
3⤵
- Deletes itself
PID:2860

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1096-1-0x00000000002A0000-0x000000000036C000-memory.dmp

Filesize
816KB

Download
memory/1096-2-0x0000000074180000-0x000000007486E000-memory.dmp

Filesize
6.9MB

Download
memory/1096-3-0x0000000000460000-0x0000000000470000-memory.dmp

Filesize
64KB

Download
memory/1096-4-0x0000000000770000-0x000000000077C000-memory.dmp

Filesize
48KB

Download
memory/1096-5-0x0000000004C20000-0x0000000004C96000-memory.dmp

Filesize
472KB

Download
memory/1096-0-0x000000007418E000-0x000000007418F000-memory.dmp

Filesize
4KB

Download
memory/1096-11-0x0000000074180000-0x000000007486E000-memory.dmp

Filesize
6.9MB

Download
memory/1340-17-0x0000000006D70000-0x0000000006E6B000-memory.dmp

Filesize
1004KB

Download
memory/1340-28-0x0000000004DA0000-0x0000000004E88000-memory.dmp

Filesize
928KB

Download
memory/1340-22-0x0000000004DA0000-0x0000000004E88000-memory.dmp

Filesize
928KB

Download
memory/1340-19-0x0000000006D70000-0x0000000006E6B000-memory.dmp

Filesize
1004KB

Download
memory/1340-14-0x0000000000270000-0x0000000000370000-memory.dmp

Filesize
1024KB

Download
memory/2600-7-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2600-16-0x0000000000270000-0x0000000000284000-memory.dmp

Filesize
80KB

Download
memory/2600-15-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2600-12-0x00000000008D0000-0x0000000000BD3000-memory.dmp

Filesize
3.0MB

Download
memory/2600-6-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2600-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2600-21-0x00000000003A0000-0x00000000003B4000-memory.dmp

Filesize
80KB

Download
memory/2600-20-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2600-10-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2760-23-0x0000000000980000-0x0000000000998000-memory.dmp

Filesize
96KB

Download
memory/2760-24-0x0000000000980000-0x0000000000998000-memory.dmp

Filesize
96KB

Download
memory/2760-25-0x0000000000080000-0x00000000000AF000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads