formbook | dcb148690e2f017e5f28ab200dc2772c50be55de48ac9ec96469931b42bf6e1a

Analysis

max time kernel
137s
max time network
130s
platform
windows7_x64
resource
win7-en-20210920
submitted
24-09-2021 05:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

docs image screenshot.scr
Size

263KB
MD5

7de03d8fae8732ac9dc5cdc70f8c98a3
SHA1

42524a6c409752fad843fa87a86e858e311af607
SHA256

7058bb27087ef6cfdd8e41e3e8aab66ed8a97d2be116cb0ed8acec7799446e59
SHA512

69b5294261c34c36035406de5a1463d12383c468a7f39ceb8405c11ec248ef5293ac65393d7c1a37917b6c3c8cd150363982ec4e958c10146596c00d5207c4ff

Score

10^/10

formbook dn7r rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dn7r

http://www.yourherogarden.net/dn7r/

Decoy

eventphotographerdfw.com

thehalalcoinstaking.com

philipfaziofineart.com

intercoh.com

gaiaseyephotography.com

chatbotforrealestate.com

lovelancemg.com

marlieskasberger.com

elcongoenespanol.info

lepirecredit.com

distribution-concept.com

e99game.com

exit11festival.com

twodollartoothbrushclub.com

cocktailsandlawn.com

performimprove.network

24horas-telefono-11840.com

cosmossify.com

kellenleote.com

perovskite.energy

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1324-55-0x0000000000400000-0x00000000004C8000-memory.dmp	formbook
behavioral1/memory/1324-54-0x00000000001B0000-0x00000000001DF000-memory.dmp	formbook

C:\Users\Admin\AppData\Local\Temp\docs image screenshot.scr
"C:\Users\Admin\AppData\Local\Temp\docs image screenshot.scr" /S
1⤵
PID:1324

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1324-55-0x0000000000400000-0x00000000004C8000-memory.dmp

Filesize
800KB

Download
memory/1324-54-0x00000000001B0000-0x00000000001DF000-memory.dmp

Filesize
188KB

Download