formbook | a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c

General

Target

h8N9qpyRAPaiitu.exe
Size

795KB
MD5

a6d026ed6d34720275d8d6fd98ad5113
SHA1

fb398d1e20b29f5dc346a7b84309a0e5c55ce7d7
SHA256

a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c
SHA512

9c46f3271e02a45b63beac8e74c84fc05a987ffb53fd41fa79c1d60a1c8379d72bc1df256dc7ba9e01363e0767e616e5ee4b32c22c9efbd1ea8496eb8364f324
SSDEEP

12288:9TCE8GILjWLWgAnOKU1AIcP4CVIadpBR8wZLm5cAw0sVj0b1SMp0dR:ccAOKU1AIlihPPlZLmZw2pp4

Score

10^/10

formbook mc10 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

mc10

Decoy

sttcorp.one

jack88.lat

owl-protect.com

hnszrrn.com

at89v2.com

h147.top

takle4creators.com

fondsa.xyz

mantenopolice.com

shophansler.com

dessertt.com

thecollisionmagazine.com

tatesfluffyfrenchies.com

h1f2v.rest

bluewandltd.com

cuplaho2003.shop

2thetcleaningservice.com

yc85w.top

natursache.shop

allmyabilities.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Formbook payload 2 IoCs
rat

Processes:

resource yara_rule

behavioral1/memory/2972-13-0x0000000000400000-0x000000000042F000-memory.dmp formbook
behavioral1/memory/2972-18-0x0000000000400000-0x000000000042F000-memory.dmp formbook
Suspicious use of SetThreadContext 2 IoCs

Processes:

h8N9qpyRAPaiitu.exeh8N9qpyRAPaiitu.exe

description pid process target process

PID 2872 set thread context of 2972 2872 h8N9qpyRAPaiitu.exe h8N9qpyRAPaiitu.exe
PID 2972 set thread context of 1204 2972 h8N9qpyRAPaiitu.exe Explorer.EXE
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2720 2572 WerFault.exe msiexec.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

h8N9qpyRAPaiitu.exe

pid process

2972 h8N9qpyRAPaiitu.exe
2972 h8N9qpyRAPaiitu.exe
Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

h8N9qpyRAPaiitu.exe

pid process

2972 h8N9qpyRAPaiitu.exe
2972 h8N9qpyRAPaiitu.exe
2972 h8N9qpyRAPaiitu.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

h8N9qpyRAPaiitu.exeExplorer.EXE

description pid process

Token: SeDebugPrivilege 2972 h8N9qpyRAPaiitu.exe
Token: SeShutdownPrivilege 1204 Explorer.EXE

resource	yara_rule
behavioral1/memory/2972-13-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/2972-18-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

description	pid	process	target process
PID 2872 set thread context of 2972	2872	h8N9qpyRAPaiitu.exe	h8N9qpyRAPaiitu.exe
PID 2972 set thread context of 1204	2972	h8N9qpyRAPaiitu.exe	Explorer.EXE

pid	pid_target	process	target process
2720	2572	WerFault.exe	msiexec.exe

pid	process
2972	h8N9qpyRAPaiitu.exe
2972	h8N9qpyRAPaiitu.exe

pid	process
2972	h8N9qpyRAPaiitu.exe
2972	h8N9qpyRAPaiitu.exe
2972	h8N9qpyRAPaiitu.exe

description	pid	process
Token: SeDebugPrivilege	2972	h8N9qpyRAPaiitu.exe
Token: SeShutdownPrivilege	1204	Explorer.EXE

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

h8N9qpyRAPaiitu.exeExplorer.EXEmsiexec.exe

description	pid	process	target process
PID 2872 wrote to memory of 2972	2872	h8N9qpyRAPaiitu.exe	h8N9qpyRAPaiitu.exe
PID 2872 wrote to memory of 2972	2872	h8N9qpyRAPaiitu.exe	h8N9qpyRAPaiitu.exe
PID 2872 wrote to memory of 2972	2872	h8N9qpyRAPaiitu.exe	h8N9qpyRAPaiitu.exe
PID 2872 wrote to memory of 2972	2872	h8N9qpyRAPaiitu.exe	h8N9qpyRAPaiitu.exe
PID 2872 wrote to memory of 2972	2872	h8N9qpyRAPaiitu.exe	h8N9qpyRAPaiitu.exe
PID 2872 wrote to memory of 2972	2872	h8N9qpyRAPaiitu.exe	h8N9qpyRAPaiitu.exe
PID 2872 wrote to memory of 2972	2872	h8N9qpyRAPaiitu.exe	h8N9qpyRAPaiitu.exe
PID 1204 wrote to memory of 2572	1204	Explorer.EXE	msiexec.exe
PID 1204 wrote to memory of 2572	1204	Explorer.EXE	msiexec.exe
PID 1204 wrote to memory of 2572	1204	Explorer.EXE	msiexec.exe
PID 1204 wrote to memory of 2572	1204	Explorer.EXE	msiexec.exe
PID 1204 wrote to memory of 2572	1204	Explorer.EXE	msiexec.exe
PID 1204 wrote to memory of 2572	1204	Explorer.EXE	msiexec.exe
PID 1204 wrote to memory of 2572	1204	Explorer.EXE	msiexec.exe
PID 2572 wrote to memory of 2720	2572	msiexec.exe	WerFault.exe
PID 2572 wrote to memory of 2720	2572	msiexec.exe	WerFault.exe
PID 2572 wrote to memory of 2720	2572	msiexec.exe	WerFault.exe
PID 2572 wrote to memory of 2720	2572	msiexec.exe	WerFault.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1204

C:\Users\Admin\AppData\Local\Temp\h8N9qpyRAPaiitu.exe
"C:\Users\Admin\AppData\Local\Temp\h8N9qpyRAPaiitu.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2872

C:\Users\Admin\AppData\Local\Temp\h8N9qpyRAPaiitu.exe
"C:\Users\Admin\AppData\Local\Temp\h8N9qpyRAPaiitu.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2972

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\SysWOW64\msiexec.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2572 -s 268
3⤵
- Program crash
PID:2720

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1204-20-0x0000000007570000-0x00000000076E1000-memory.dmp

Filesize
1.4MB

Download
memory/1204-27-0x0000000007570000-0x00000000076E1000-memory.dmp

Filesize
1.4MB

Download
memory/1204-17-0x0000000003110000-0x0000000003210000-memory.dmp

Filesize
1024KB

Download
memory/2572-24-0x0000000000C00000-0x0000000000C14000-memory.dmp

Filesize
80KB

Download
memory/2572-22-0x0000000000C00000-0x0000000000C14000-memory.dmp

Filesize
80KB

Download
memory/2572-21-0x0000000000C00000-0x0000000000C14000-memory.dmp

Filesize
80KB

Download
memory/2872-5-0x0000000002070000-0x00000000020E6000-memory.dmp

Filesize
472KB

Download
memory/2872-4-0x0000000001F20000-0x0000000001F2C000-memory.dmp

Filesize
48KB

Download
memory/2872-1-0x00000000009B0000-0x0000000000A7C000-memory.dmp

Filesize
816KB

Download
memory/2872-2-0x00000000745B0000-0x0000000074C9E000-memory.dmp

Filesize
6.9MB

Download
memory/2872-14-0x00000000745B0000-0x0000000074C9E000-memory.dmp

Filesize
6.9MB

Download
memory/2872-3-0x00000000009A0000-0x00000000009B0000-memory.dmp

Filesize
64KB

Download
memory/2872-0-0x00000000745BE000-0x00000000745BF000-memory.dmp

Filesize
4KB

Download
memory/2972-18-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2972-6-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2972-19-0x0000000000430000-0x0000000000444000-memory.dmp

Filesize
80KB

Download
memory/2972-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2972-15-0x0000000000A80000-0x0000000000D83000-memory.dmp

Filesize
3.0MB

Download
memory/2972-8-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2972-13-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing