formbook | 765ed4f4607cc86d76be8e42930e43ba0c833866fb6bdd9b97c23241a46c6725

Analysis

max time kernel
76s
max time network
90s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
24-07-2022 15:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

765ed4f4607cc86d76be8e42930e43ba0c833866fb6bdd9b97c23241a46c6725.exe
Size

576KB
MD5

104a0fd298792b9a5d0c6a9113822a34
SHA1

4dee1d7dc239bcf8810f3ffc201ba5d203101f4d
SHA256

765ed4f4607cc86d76be8e42930e43ba0c833866fb6bdd9b97c23241a46c6725
SHA512

d935416d2d20872cfe4a958c6557386f5945fc5739f30a293119412423b9657d097dbcdbaa29cbf01cd496a4466af206a8e77cda46a7d1c5f92057766c56d128

Score

10^/10

formbook un rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

3.9

Campaign

Decoy

mtbeautyshop.com

tactilon.online

bghuqo.com

ethansung.com

learntoskimboard.com

pzaintl.com

oaiteamv.com

advantahc.com

kudzuandcottoncompany.net

racinesdespres.com

go-kart-kits.com

travelbytravant.com

magamag.com

zhishengda.net

kamikacomics.com

colegiosantodomingord.com

apppose.com

esperandoporvoce.com

smartmallshopping.com

wwwvns9722.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/612-137-0x0000000000400000-0x0000000000492000-memory.dmp	formbook
behavioral2/memory/612-138-0x0000000000400000-0x000000000042A000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4084 set thread context of 612	4084	765ed4f4607cc86d76be8e42930e43ba0c833866fb6bdd9b97c23241a46c6725.exe	81

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
612	765ed4f4607cc86d76be8e42930e43ba0c833866fb6bdd9b97c23241a46c6725.exe
612	765ed4f4607cc86d76be8e42930e43ba0c833866fb6bdd9b97c23241a46c6725.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4084	765ed4f4607cc86d76be8e42930e43ba0c833866fb6bdd9b97c23241a46c6725.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4084 wrote to memory of 612	4084	765ed4f4607cc86d76be8e42930e43ba0c833866fb6bdd9b97c23241a46c6725.exe	81
PID 4084 wrote to memory of 612	4084	765ed4f4607cc86d76be8e42930e43ba0c833866fb6bdd9b97c23241a46c6725.exe	81
PID 4084 wrote to memory of 612	4084	765ed4f4607cc86d76be8e42930e43ba0c833866fb6bdd9b97c23241a46c6725.exe	81

C:\Users\Admin\AppData\Local\Temp\765ed4f4607cc86d76be8e42930e43ba0c833866fb6bdd9b97c23241a46c6725.exe
"C:\Users\Admin\AppData\Local\Temp\765ed4f4607cc86d76be8e42930e43ba0c833866fb6bdd9b97c23241a46c6725.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4084
- C:\Users\Admin\AppData\Local\Temp\765ed4f4607cc86d76be8e42930e43ba0c833866fb6bdd9b97c23241a46c6725.exe
  C:\Users\Admin\AppData\Local\Temp\765ed4f4607cc86d76be8e42930e43ba0c833866fb6bdd9b97c23241a46c6725.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/612-137-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download
memory/612-138-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/612-139-0x00007FFD724F0000-0x00007FFD726E5000-memory.dmp

Filesize
2.0MB

Download
memory/612-140-0x0000000077880000-0x0000000077A23000-memory.dmp

Filesize
1.6MB

Download
memory/612-141-0x0000000006DC0000-0x000000000710A000-memory.dmp

Filesize
3.3MB

Download
memory/612-142-0x00000000004E0000-0x00000000004E7000-memory.dmp

Filesize
28KB

Download
memory/612-143-0x0000000077880000-0x0000000077A23000-memory.dmp

Filesize
1.6MB

Download
memory/4084-132-0x0000000002BB0000-0x0000000002BB7000-memory.dmp

Filesize
28KB

Download
memory/4084-134-0x0000000002BB0000-0x0000000002BB7000-memory.dmp

Filesize
28KB

Download
memory/4084-135-0x00007FFD724F0000-0x00007FFD726E5000-memory.dmp

Filesize
2.0MB

Download
memory/4084-136-0x0000000077880000-0x0000000077A23000-memory.dmp

Filesize
1.6MB

Download