formbook | 75b7d30e6f26fbb3fbac284ed75356cc874e73365764130209d4937d80a6c80d

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220331-en
submitted
12/04/2022, 12:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fcaf1de8fea0ac779b0abc17a1029969.exe
Size 688KB
Sample220412-pnwsrseee2
SHA256 75b7d30e6f26fbb3fbac284ed75356cc874e73365764130209d4937d80a6c80d
MD5 fcaf1de8fea0ac779b0abc17a1029969
SHA1 f99793f1d32f992372abfbabb8c79e25a2753c3f
SHA512 72701fbd87a0ed25c7faaa6c61a3b394dc867c70f6f9013918859d4b13e183282306c5d80d68810a8e6af0b582a3cea05a1cfdd69d5b625f61c3760db5417db7
MD5 SHA1 SHA512

Score

10^/10

formbook b2a4 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

b2a4

Decoy

firstrootsfarmmi.com
haywardsh.xyz
duocnamson.com
theginhanh.net
camilisboutique.com
wilsonmarble.com
lakelandhs1980.com
wilmington.expert
askartoon.com
sedox-web.com
avantgardespiritof.com
menofspeed.com
veniceclothing.com
banaqi.com
churchmediaroom.com
hawaiivog.com
healthyplantet.com
weidenhaft.com
atmcml.com
shaokangjiu.com
musiccityindustrialstaffing.com
millerandsonsproductions.com
packaged.network
quieroleads.com
xn--subespao-j3a.com
geogoup.com
dorchesterdreampark.com
visionarytitan.com
wingsofeagleslifeservices.com
clinault.com
wortex-shop.com
bintangmaraga.com
barrnwellandlong.com
solarlightdongthap.com
montelibero.club
bankbnwc.com
belgiebouwt.com
wnoclen.site
marissa-test-mberg.com
medscie.online
agrigentoperduta.store
motorpuppet.com
docevidaconfeitaria.com
ybdgdv.biz
xk9bm875h488kc.xyz
nkwan.biz
iqzrlo.info
nortvew.online
alisblue.net
vlgfd.icu
nguyenwebcompany.net
dobbenetes.com
qvgye.icu
lovecamilleph.com
maslakmaster.com
confisshop.com
candycurvi.com
tarduhukuk.com
freightmonkey.net
mevlanatours.online
pavanneimportados.com
ablegarotel.site
primal-jerky.com
palanishopping.online
chenjiexu.club

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/592-69-0x0000000000000000-mapping.dmp	formbook

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1912	592	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 592	1400	fcaf1de8fea0ac779b0abc17a1029969.exe	30
PID 1400 wrote to memory of 592	1400	fcaf1de8fea0ac779b0abc17a1029969.exe	30
PID 1400 wrote to memory of 592	1400	fcaf1de8fea0ac779b0abc17a1029969.exe	30
PID 1400 wrote to memory of 592	1400	fcaf1de8fea0ac779b0abc17a1029969.exe	30
PID 1400 wrote to memory of 592	1400	fcaf1de8fea0ac779b0abc17a1029969.exe	30
PID 1400 wrote to memory of 592	1400	fcaf1de8fea0ac779b0abc17a1029969.exe	30
PID 1400 wrote to memory of 592	1400	fcaf1de8fea0ac779b0abc17a1029969.exe	30
PID 592 wrote to memory of 1912	592	logagent.exe	31
PID 592 wrote to memory of 1912	592	logagent.exe	31
PID 592 wrote to memory of 1912	592	logagent.exe	31
PID 592 wrote to memory of 1912	592	logagent.exe	31

C:\Users\Admin\AppData\Local\Temp\fcaf1de8fea0ac779b0abc17a1029969.exe
"C:\Users\Admin\AppData\Local\Temp\fcaf1de8fea0ac779b0abc17a1029969.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Windows\SysWOW64\logagent.exe
  C:\Windows\System32\logagent.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:592
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 592 -s 140
    3⤵
    - Program crash
    PID:1912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/592-63-0x0000000010410000-0x000000001043F000-memory.dmp

Download

memory/592-65-0x0000000000080000-0x0000000000081000-memory.dmp

Download

memory/1400-54-0x0000000075331000-0x0000000075333000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads