formbook | a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c

General

Target

a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe
Size

795KB
MD5

a6d026ed6d34720275d8d6fd98ad5113
SHA1

fb398d1e20b29f5dc346a7b84309a0e5c55ce7d7
SHA256

a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c
SHA512

9c46f3271e02a45b63beac8e74c84fc05a987ffb53fd41fa79c1d60a1c8379d72bc1df256dc7ba9e01363e0767e616e5ee4b32c22c9efbd1ea8496eb8364f324
SSDEEP

12288:9TCE8GILjWLWgAnOKU1AIcP4CVIadpBR8wZLm5cAw0sVj0b1SMp0dR:ccAOKU1AIlihPPlZLmZw2pp4

Score

10^/10

formbook mc10 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

mc10

Decoy

sttcorp.one

jack88.lat

owl-protect.com

hnszrrn.com

at89v2.com

h147.top

takle4creators.com

fondsa.xyz

mantenopolice.com

shophansler.com

dessertt.com

thecollisionmagazine.com

tatesfluffyfrenchies.com

h1f2v.rest

bluewandltd.com

cuplaho2003.shop

2thetcleaningservice.com

yc85w.top

natursache.shop

allmyabilities.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Formbook payload 1 IoCs
rat

Processes:

resource yara_rule

behavioral1/memory/2140-10-0x0000000000400000-0x000000000042F000-memory.dmp formbook

resource	yara_rule
behavioral1/memory/2140-10-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe

description	pid	process	target process
PID 2008 set thread context of 2140	2008	a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe	a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exea4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe

pid process

2008 a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe
2140 a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe

description pid process

Token: SeDebugPrivilege 2008 a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe

pid	process
2008	a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe
2140	a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe

description	pid	process
Token: SeDebugPrivilege	2008	a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe

description	pid	process	target process
PID 2008 wrote to memory of 2660	2008	a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe	a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe
PID 2008 wrote to memory of 2660	2008	a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe	a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe
PID 2008 wrote to memory of 2660	2008	a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe	a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe
PID 2008 wrote to memory of 2660	2008	a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe	a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe
PID 2008 wrote to memory of 2140	2008	a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe	a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe
PID 2008 wrote to memory of 2140	2008	a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe	a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe
PID 2008 wrote to memory of 2140	2008	a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe	a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe
PID 2008 wrote to memory of 2140	2008	a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe	a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe
PID 2008 wrote to memory of 2140	2008	a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe	a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe
PID 2008 wrote to memory of 2140	2008	a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe	a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe
PID 2008 wrote to memory of 2140	2008	a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe	a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe

C:\Users\Admin\AppData\Local\Temp\a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe
"C:\Users\Admin\AppData\Local\Temp\a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2008

C:\Users\Admin\AppData\Local\Temp\a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe
"C:\Users\Admin\AppData\Local\Temp\a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe"
2⤵
PID:2660

C:\Users\Admin\AppData\Local\Temp\a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe
"C:\Users\Admin\AppData\Local\Temp\a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2140

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2008-0-0x0000000073FBE000-0x0000000073FBF000-memory.dmp

Filesize
4KB

Download
memory/2008-1-0x0000000000140000-0x000000000020C000-memory.dmp

Filesize
816KB

Download
memory/2008-2-0x0000000073FB0000-0x000000007469E000-memory.dmp

Filesize
6.9MB

Download
memory/2008-3-0x0000000000600000-0x0000000000610000-memory.dmp

Filesize
64KB

Download
memory/2008-4-0x0000000000D00000-0x0000000000D0C000-memory.dmp

Filesize
48KB

Download
memory/2008-5-0x00000000048D0000-0x0000000004946000-memory.dmp

Filesize
472KB

Download
memory/2008-11-0x0000000073FB0000-0x000000007469E000-memory.dmp

Filesize
6.9MB

Download
memory/2140-6-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2140-7-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2140-10-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2140-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2140-12-0x0000000000A00000-0x0000000000D03000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing