formbook | bf694c0a4856be7c6e88f8d018a2d3223b740f060e9c0f8da51df710c895860a

Analysis

max time kernel
91s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
06-07-2022 16:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4504b6bca11f1bb8cd7ee7f9695ae149.exe
Size

75KB
MD5

4504b6bca11f1bb8cd7ee7f9695ae149
SHA1

b4db331aff8b3f0af7bb85c62eee8cbf94a01242
SHA256

bf694c0a4856be7c6e88f8d018a2d3223b740f060e9c0f8da51df710c895860a
SHA512

f8edc6b9a704d7c2921c151e0057c0054cfdfbeee5f2a70553016dea89c2918825131d54d930d6594832484f7b8b5fc80416745de2a357b69f3abc2f4fcf5504

Score

10^/10

formbook s3s3 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

s3s3

Decoy

tvielotus.com

teesta.xyz

talentrecruitor.com

pamaungipb.com

xn--90ahkh6a6b8b.site

910carolina.com

toyotaecoyouth-dev.com

invetnables.com

gdexc.com

ssw168.com

householdmould.com

mqttradar.xyz

t333c.com

thepausestudio.com

evershedsutherlands.com

asbdataplus.com

preddylilthingz.com

jepwu.com

tvlido.com

artovus.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3392-133-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

4504b6bca11f1bb8cd7ee7f9695ae149.exe

description pid process target process

PID 4216 set thread context of 3392 4216 4504b6bca11f1bb8cd7ee7f9695ae149.exe 4504b6bca11f1bb8cd7ee7f9695ae149.exe

description	pid	process	target process
PID 4216 set thread context of 3392	4216	4504b6bca11f1bb8cd7ee7f9695ae149.exe	4504b6bca11f1bb8cd7ee7f9695ae149.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

4504b6bca11f1bb8cd7ee7f9695ae149.exe4504b6bca11f1bb8cd7ee7f9695ae149.exe

pid	process
4216	4504b6bca11f1bb8cd7ee7f9695ae149.exe
4216	4504b6bca11f1bb8cd7ee7f9695ae149.exe
3392	4504b6bca11f1bb8cd7ee7f9695ae149.exe
3392	4504b6bca11f1bb8cd7ee7f9695ae149.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

4504b6bca11f1bb8cd7ee7f9695ae149.exe

description pid process

Token: SeDebugPrivilege 4216 4504b6bca11f1bb8cd7ee7f9695ae149.exe

description	pid	process
Token: SeDebugPrivilege	4216	4504b6bca11f1bb8cd7ee7f9695ae149.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

4504b6bca11f1bb8cd7ee7f9695ae149.exe

description	pid	process	target process
PID 4216 wrote to memory of 3392	4216	4504b6bca11f1bb8cd7ee7f9695ae149.exe	4504b6bca11f1bb8cd7ee7f9695ae149.exe
PID 4216 wrote to memory of 3392	4216	4504b6bca11f1bb8cd7ee7f9695ae149.exe	4504b6bca11f1bb8cd7ee7f9695ae149.exe
PID 4216 wrote to memory of 3392	4216	4504b6bca11f1bb8cd7ee7f9695ae149.exe	4504b6bca11f1bb8cd7ee7f9695ae149.exe
PID 4216 wrote to memory of 3392	4216	4504b6bca11f1bb8cd7ee7f9695ae149.exe	4504b6bca11f1bb8cd7ee7f9695ae149.exe
PID 4216 wrote to memory of 3392	4216	4504b6bca11f1bb8cd7ee7f9695ae149.exe	4504b6bca11f1bb8cd7ee7f9695ae149.exe
PID 4216 wrote to memory of 3392	4216	4504b6bca11f1bb8cd7ee7f9695ae149.exe	4504b6bca11f1bb8cd7ee7f9695ae149.exe

C:\Users\Admin\AppData\Local\Temp\4504b6bca11f1bb8cd7ee7f9695ae149.exe
"C:\Users\Admin\AppData\Local\Temp\4504b6bca11f1bb8cd7ee7f9695ae149.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4216

C:\Users\Admin\AppData\Local\Temp\4504b6bca11f1bb8cd7ee7f9695ae149.exe
C:\Users\Admin\AppData\Local\Temp\4504b6bca11f1bb8cd7ee7f9695ae149.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3392

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3392-132-0x0000000000000000-mapping.dmp

Download
memory/3392-133-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3392-134-0x00000000015A0000-0x00000000018EA000-memory.dmp

Filesize
3.3MB

Download
memory/4216-130-0x0000000000C10000-0x0000000000C28000-memory.dmp

Filesize
96KB

Download
memory/4216-131-0x0000000006300000-0x0000000006392000-memory.dmp

Filesize
584KB

Download