formbook | 9b0e4c0a6259aa239b6c344b705dea5fbb487b680bd754453f07b9b016ec581e

Analysis

Target
250d5a609ef789d81a32fa3acee75e41.exe
Size 398KB
Sample220118-v4a4wsccb6
SHA256 9b0e4c0a6259aa239b6c344b705dea5fbb487b680bd754453f07b9b016ec581e
MD5 250d5a609ef789d81a32fa3acee75e41
SHA1 6d0b6ecce1eb9d26dd77552ca5b0ad737fe6e7b9
SHA512 3bd15250b81b7ce9e60da7f011f46e53c3d9f344f3d63d590905abf49a36eb50d0a92a00750c1023d328e5e21ced247267575900b1ae9f1feee928bc1d33a2be
MD5 SHA1 SHA512

Score

10^/10

Family

Version

Campaign

Decoy

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/2312-135-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3292 set thread context of 2312	3292	250d5a609ef789d81a32fa3acee75e41.exe	59

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2312	250d5a609ef789d81a32fa3acee75e41.exe
2312	250d5a609ef789d81a32fa3acee75e41.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3292 wrote to memory of 2312	3292	250d5a609ef789d81a32fa3acee75e41.exe	59
PID 3292 wrote to memory of 2312	3292	250d5a609ef789d81a32fa3acee75e41.exe	59
PID 3292 wrote to memory of 2312	3292	250d5a609ef789d81a32fa3acee75e41.exe	59
PID 3292 wrote to memory of 2312	3292	250d5a609ef789d81a32fa3acee75e41.exe	59
PID 3292 wrote to memory of 2312	3292	250d5a609ef789d81a32fa3acee75e41.exe	59
PID 3292 wrote to memory of 2312	3292	250d5a609ef789d81a32fa3acee75e41.exe	59

C:\Users\Admin\AppData\Local\Temp\250d5a609ef789d81a32fa3acee75e41.exe
"C:\Users\Admin\AppData\Local\Temp\250d5a609ef789d81a32fa3acee75e41.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3292
- C:\Users\Admin\AppData\Local\Temp\250d5a609ef789d81a32fa3acee75e41.exe
  "C:\Users\Admin\AppData\Local\Temp\250d5a609ef789d81a32fa3acee75e41.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2312

memory/2312-135-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3292-130-0x0000000000370000-0x00000000003DA000-memory.dmp

Download

memory/3292-131-0x0000000004F00000-0x0000000004F01000-memory.dmp

Download

memory/3292-132-0x0000000004F10000-0x0000000004FA2000-memory.dmp

Download

memory/3292-133-0x0000000005580000-0x000000000561C000-memory.dmp

Download

memory/3292-134-0x0000000005DE0000-0x0000000006384000-memory.dmp

Download