formbook | 4305e40a0eb2ed4133ad2b881d34f7cb4e31da8d3ccbc705968b6c6f79329d0c

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220414-en
submitted
24-05-2022 18:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4305e40a0eb2ed4133ad2b881d34f7cb4e31da8d3ccbc705968b6c6f79329d0c.exe
Size

280KB
MD5

12fb37f122adb02ce6d17aeb436111f9
SHA1

2e0a8d604227d8c24b1bdebb53d321c40a9fc4a2
SHA256

4305e40a0eb2ed4133ad2b881d34f7cb4e31da8d3ccbc705968b6c6f79329d0c
SHA512

cb8d0ec715609f8fb207c15079c0ecbab7023c9956727bed40678547a1325988994c2c1b2b6535422d86f75829a831ff20c96b1a639006f2059c43edba4902f1

Score

10^/10

formbook q5e rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

q5e

Decoy

2177.ltd

thanxiety.com

max-width.com

fixti.net

mostmaj.com

mobilteknolojiuzmani.com

historyannals.com

wheelchairmotion.com

mossandmoonstonestudio.com

kastellifournis.com

axokey.net

peekl.com

metsteeshirt.com

abcfinancial-inc.com

btxrsp.com

amydh.com

ccoauthority.com

lumacorretora.com

kimfelixrealtor.com

iconext.biz

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/904-55-0x000000000052F000-0x000000000055D000-memory.dmp	formbook

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1976 904 WerFault.exe 4305e40a0eb2ed4133ad2b881d34f7cb4e31da8d3ccbc705968b6c6f79329d0c.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

4305e40a0eb2ed4133ad2b881d34f7cb4e31da8d3ccbc705968b6c6f79329d0c.exe

pid process

904 4305e40a0eb2ed4133ad2b881d34f7cb4e31da8d3ccbc705968b6c6f79329d0c.exe

pid	pid_target	process	target process
1976	904	WerFault.exe	4305e40a0eb2ed4133ad2b881d34f7cb4e31da8d3ccbc705968b6c6f79329d0c.exe

pid	process
904	4305e40a0eb2ed4133ad2b881d34f7cb4e31da8d3ccbc705968b6c6f79329d0c.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

4305e40a0eb2ed4133ad2b881d34f7cb4e31da8d3ccbc705968b6c6f79329d0c.exe

description	pid	process	target process
PID 904 wrote to memory of 1976	904	4305e40a0eb2ed4133ad2b881d34f7cb4e31da8d3ccbc705968b6c6f79329d0c.exe	WerFault.exe
PID 904 wrote to memory of 1976	904	4305e40a0eb2ed4133ad2b881d34f7cb4e31da8d3ccbc705968b6c6f79329d0c.exe	WerFault.exe
PID 904 wrote to memory of 1976	904	4305e40a0eb2ed4133ad2b881d34f7cb4e31da8d3ccbc705968b6c6f79329d0c.exe	WerFault.exe
PID 904 wrote to memory of 1976	904	4305e40a0eb2ed4133ad2b881d34f7cb4e31da8d3ccbc705968b6c6f79329d0c.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\4305e40a0eb2ed4133ad2b881d34f7cb4e31da8d3ccbc705968b6c6f79329d0c.exe
"C:\Users\Admin\AppData\Local\Temp\4305e40a0eb2ed4133ad2b881d34f7cb4e31da8d3ccbc705968b6c6f79329d0c.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 904 -s 104
2⤵
- Program crash
PID:1976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/904-54-0x000000000051E000-0x0000000000565000-memory.dmp

Filesize
284KB

Download
memory/904-55-0x000000000052F000-0x000000000055D000-memory.dmp

Filesize
184KB

Download
memory/904-56-0x0000000002350000-0x0000000002653000-memory.dmp

Filesize
3.0MB

Download
memory/1976-57-0x0000000000000000-mapping.dmp

Download