formbook | 92420ebd5feeb4171db8a4877ac6eb2dd594fd4d07192408b26aa9b98c5d048d

Analysis

max time kernel
11s
max time network
112s
platform
windows10_x64
resource
win10v20201028
submitted
14-01-2021 06:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06aafd2382d63afc9874125e5c1062b0.exe
Size

326KB
MD5

06aafd2382d63afc9874125e5c1062b0
SHA1

e3b553368eec14ea84ba32f291a17dc614c64670
SHA256

92420ebd5feeb4171db8a4877ac6eb2dd594fd4d07192408b26aa9b98c5d048d
SHA512

cd317df3b6f9b86e3b3c2eef38d5b4fb8900562aae920c08607075fe6fd3e01480035f6ffb4188cae49c37faebd6ed626a2da457c75d99ba1535a42d2a690b27

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

http://www.evana-rohanihijab.com/iic6/

Decoy

capableandresilient.com

listaprzygod.com

cashhomeprogram.com

aboutwheelchair.com

clk4milli.club

asakitreks.com

liquiddreamworld.com

uqur88.com

bestifystore.com

arancionehq.xyz

mmoimperium.com

houxinjian.com

satmonitoring.com

tidalhaven.com

blcdevelopers.com

piratesofthefun.com

kadopulsa.com

xn--o39au6k0nm4rghsaq0c.net

wxxxtw.com

kyrtjf.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3520-2-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral2/memory/3520-3-0x000000000041ED60-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

06aafd2382d63afc9874125e5c1062b0.exe

description pid process target process

PID 640 set thread context of 3520 640 06aafd2382d63afc9874125e5c1062b0.exe 06aafd2382d63afc9874125e5c1062b0.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

06aafd2382d63afc9874125e5c1062b0.exe

pid process

3520 06aafd2382d63afc9874125e5c1062b0.exe
3520 06aafd2382d63afc9874125e5c1062b0.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

06aafd2382d63afc9874125e5c1062b0.exe

pid process

640 06aafd2382d63afc9874125e5c1062b0.exe

description	pid	process	target process
PID 640 set thread context of 3520	640	06aafd2382d63afc9874125e5c1062b0.exe	06aafd2382d63afc9874125e5c1062b0.exe

pid	process
3520	06aafd2382d63afc9874125e5c1062b0.exe
3520	06aafd2382d63afc9874125e5c1062b0.exe

pid	process
640	06aafd2382d63afc9874125e5c1062b0.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

06aafd2382d63afc9874125e5c1062b0.exe

description	pid	process	target process
PID 640 wrote to memory of 3520	640	06aafd2382d63afc9874125e5c1062b0.exe	06aafd2382d63afc9874125e5c1062b0.exe
PID 640 wrote to memory of 3520	640	06aafd2382d63afc9874125e5c1062b0.exe	06aafd2382d63afc9874125e5c1062b0.exe
PID 640 wrote to memory of 3520	640	06aafd2382d63afc9874125e5c1062b0.exe	06aafd2382d63afc9874125e5c1062b0.exe
PID 640 wrote to memory of 3520	640	06aafd2382d63afc9874125e5c1062b0.exe	06aafd2382d63afc9874125e5c1062b0.exe

C:\Users\Admin\AppData\Local\Temp\06aafd2382d63afc9874125e5c1062b0.exe
"C:\Users\Admin\AppData\Local\Temp\06aafd2382d63afc9874125e5c1062b0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:640

C:\Users\Admin\AppData\Local\Temp\06aafd2382d63afc9874125e5c1062b0.exe
"C:\Users\Admin\AppData\Local\Temp\06aafd2382d63afc9874125e5c1062b0.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3520

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3520-2-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3520-3-0x000000000041ED60-mapping.dmp

Download