formbook | c062a826e467a5e607d373ab12fcae11d0eec7ff4fdfe04d4e5de4250d7f8f88

Analysis

Target
d642f78e75dad522b4e70a3227d61ec7.exe
Size 577KB
Sample210320-b2pd3rg6xx
SHA256 c062a826e467a5e607d373ab12fcae11d0eec7ff4fdfe04d4e5de4250d7f8f88
MD5 d642f78e75dad522b4e70a3227d61ec7
SHA1 df14f07db5803219a6948c82cd1fe94448ed4edd
SHA512 1ebf094ce2cffdcaf517600df97997d43dde2c193c04909c54c8e46fac3b9f4a60a5f7528105939c1b395a7d1a54c721b2a0f465440d564874fe89694e92f069
MD5 SHA1 SHA512

Score

10^/10

Family

Decoy

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/3188-3-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral2/memory/3188-4-0x000000000041EB80-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4688 set thread context of 3188	4688	d642f78e75dad522b4e70a3227d61ec7.exe	78

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3188	d642f78e75dad522b4e70a3227d61ec7.exe
3188	d642f78e75dad522b4e70a3227d61ec7.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4688 wrote to memory of 3188	4688	d642f78e75dad522b4e70a3227d61ec7.exe	78
PID 4688 wrote to memory of 3188	4688	d642f78e75dad522b4e70a3227d61ec7.exe	78
PID 4688 wrote to memory of 3188	4688	d642f78e75dad522b4e70a3227d61ec7.exe	78
PID 4688 wrote to memory of 3188	4688	d642f78e75dad522b4e70a3227d61ec7.exe	78
PID 4688 wrote to memory of 3188	4688	d642f78e75dad522b4e70a3227d61ec7.exe	78
PID 4688 wrote to memory of 3188	4688	d642f78e75dad522b4e70a3227d61ec7.exe	78

C:\Users\Admin\AppData\Local\Temp\d642f78e75dad522b4e70a3227d61ec7.exe
"C:\Users\Admin\AppData\Local\Temp\d642f78e75dad522b4e70a3227d61ec7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Users\Admin\AppData\Local\Temp\d642f78e75dad522b4e70a3227d61ec7.exe
  "C:\Users\Admin\AppData\Local\Temp\d642f78e75dad522b4e70a3227d61ec7.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3188

memory/3188-3-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/3188-6-0x00000000017A0000-0x0000000001AC0000-memory.dmp

Download

memory/4688-2-0x0000000002E70000-0x0000000002E71000-memory.dmp

Download