formbook | 62629c366ee55b4376c03a63e8f94e121a3ff7cbecfcf22d0158515446a9457e | Triage™

Analysis

max time kernel
144s
max time network
144s
platform
windows7_x64
resource
win7v20201028
submitted
09/11/2020, 19:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5c8a054cefa2c826ca3fc7bbd54e58ab.exe
Size 328KB
Sample201109-8dmlc5d89x
SHA256 62629c366ee55b4376c03a63e8f94e121a3ff7cbecfcf22d0158515446a9457e
MD5 5c8a054cefa2c826ca3fc7bbd54e58ab
SHA1 5278c8c1fb4a2752689c81169a895eb061d38bda
SHA512 53a5478d65d8336ca0fc582b21b252fddd9f676865d7372bc69f9970f72df0a40d507bdbba82bb64bfec6bf909a34d23f9aa3819c14d243cde58ec875dd3783a
MD5 SHA1 SHA512

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.regulars5.com/ms20/

Decoy

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 1 IoCs

resource	yara_rule
behavioral1/memory/1744-0-0x0000000000292000-0x00000000002F4000-memory.dmp	formbook

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1744	5c8a054cefa2c826ca3fc7bbd54e58ab.exe

C:\Users\Admin\AppData\Local\Temp\5c8a054cefa2c826ca3fc7bbd54e58ab.exe
"C:\Users\Admin\AppData\Local\Temp\5c8a054cefa2c826ca3fc7bbd54e58ab.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1744-0-0x0000000000292000-0x00000000002F4000-memory.dmp

Download