formbook | 41ad6f7b326ac4b5372ed790426911500da78c2bb3ff9ed98cd41d2515155cba

Analysis

max time kernel
145s
max time network
181s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
29-08-2022 03:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41ad6f7b326ac4b5372ed790426911500da78c2bb3ff9ed98cd41d2515155cba.exe
Size

593KB
MD5

f69bfb20f3c859cec0110a1750d91831
SHA1

6d4178609cc7f0ed126a4ae9eb5eabd37e19e797
SHA256

41ad6f7b326ac4b5372ed790426911500da78c2bb3ff9ed98cd41d2515155cba
SHA512

3fdf3ad477e8258a7ff00c7247c21f9f32b80166988467f3554f7ef6b5d1db05c773e7ed49e32ceae27604fe739ad778b705a2529cf865e1e4ac981799a91fbe
SSDEEP

12288:0nsis+D11R/5P/+/SJ+tZkS9PpbFBXBYbE/M1keD11ioQqLoEhCl85:mPlJukiFZ6bR1TLLUS

Score

10^/10

formbook ng04 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ng04

Decoy

tevimaq.com

easterspecialtystore.com

smartlever.tech

10312.uk

tanjawiharbi.co.uk

471338.com

horusventure.com

empress-care.com

sinrian.com

465951.com

aemsti.com

nxcourier.com

stargatefarms.com

lalyquainvestment.com

dailysportsadvice.com

justlistmoore.com

stoneonroll.online

tatianakolomiets.com

barcodebbm.com

protectorship.world

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1280-188-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/1280-189-0x000000000041F020-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

41ad6f7b326ac4b5372ed790426911500da78c2bb3ff9ed98cd41d2515155cba.exe

description	pid	process	target process
PID 4324 set thread context of 1280	4324	41ad6f7b326ac4b5372ed790426911500da78c2bb3ff9ed98cd41d2515155cba.exe	41ad6f7b326ac4b5372ed790426911500da78c2bb3ff9ed98cd41d2515155cba.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

41ad6f7b326ac4b5372ed790426911500da78c2bb3ff9ed98cd41d2515155cba.exe41ad6f7b326ac4b5372ed790426911500da78c2bb3ff9ed98cd41d2515155cba.exe

pid	process
4324	41ad6f7b326ac4b5372ed790426911500da78c2bb3ff9ed98cd41d2515155cba.exe
4324	41ad6f7b326ac4b5372ed790426911500da78c2bb3ff9ed98cd41d2515155cba.exe
1280	41ad6f7b326ac4b5372ed790426911500da78c2bb3ff9ed98cd41d2515155cba.exe
1280	41ad6f7b326ac4b5372ed790426911500da78c2bb3ff9ed98cd41d2515155cba.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

41ad6f7b326ac4b5372ed790426911500da78c2bb3ff9ed98cd41d2515155cba.exe

description pid process

Token: SeDebugPrivilege 4324 41ad6f7b326ac4b5372ed790426911500da78c2bb3ff9ed98cd41d2515155cba.exe

description	pid	process
Token: SeDebugPrivilege	4324	41ad6f7b326ac4b5372ed790426911500da78c2bb3ff9ed98cd41d2515155cba.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

41ad6f7b326ac4b5372ed790426911500da78c2bb3ff9ed98cd41d2515155cba.exe

description	pid	process	target process
PID 4324 wrote to memory of 3388	4324	41ad6f7b326ac4b5372ed790426911500da78c2bb3ff9ed98cd41d2515155cba.exe	41ad6f7b326ac4b5372ed790426911500da78c2bb3ff9ed98cd41d2515155cba.exe
PID 4324 wrote to memory of 3388	4324	41ad6f7b326ac4b5372ed790426911500da78c2bb3ff9ed98cd41d2515155cba.exe	41ad6f7b326ac4b5372ed790426911500da78c2bb3ff9ed98cd41d2515155cba.exe
PID 4324 wrote to memory of 3388	4324	41ad6f7b326ac4b5372ed790426911500da78c2bb3ff9ed98cd41d2515155cba.exe	41ad6f7b326ac4b5372ed790426911500da78c2bb3ff9ed98cd41d2515155cba.exe
PID 4324 wrote to memory of 1280	4324	41ad6f7b326ac4b5372ed790426911500da78c2bb3ff9ed98cd41d2515155cba.exe	41ad6f7b326ac4b5372ed790426911500da78c2bb3ff9ed98cd41d2515155cba.exe
PID 4324 wrote to memory of 1280	4324	41ad6f7b326ac4b5372ed790426911500da78c2bb3ff9ed98cd41d2515155cba.exe	41ad6f7b326ac4b5372ed790426911500da78c2bb3ff9ed98cd41d2515155cba.exe
PID 4324 wrote to memory of 1280	4324	41ad6f7b326ac4b5372ed790426911500da78c2bb3ff9ed98cd41d2515155cba.exe	41ad6f7b326ac4b5372ed790426911500da78c2bb3ff9ed98cd41d2515155cba.exe
PID 4324 wrote to memory of 1280	4324	41ad6f7b326ac4b5372ed790426911500da78c2bb3ff9ed98cd41d2515155cba.exe	41ad6f7b326ac4b5372ed790426911500da78c2bb3ff9ed98cd41d2515155cba.exe
PID 4324 wrote to memory of 1280	4324	41ad6f7b326ac4b5372ed790426911500da78c2bb3ff9ed98cd41d2515155cba.exe	41ad6f7b326ac4b5372ed790426911500da78c2bb3ff9ed98cd41d2515155cba.exe
PID 4324 wrote to memory of 1280	4324	41ad6f7b326ac4b5372ed790426911500da78c2bb3ff9ed98cd41d2515155cba.exe	41ad6f7b326ac4b5372ed790426911500da78c2bb3ff9ed98cd41d2515155cba.exe

C:\Users\Admin\AppData\Local\Temp\41ad6f7b326ac4b5372ed790426911500da78c2bb3ff9ed98cd41d2515155cba.exe
"C:\Users\Admin\AppData\Local\Temp\41ad6f7b326ac4b5372ed790426911500da78c2bb3ff9ed98cd41d2515155cba.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4324

C:\Users\Admin\AppData\Local\Temp\41ad6f7b326ac4b5372ed790426911500da78c2bb3ff9ed98cd41d2515155cba.exe
"C:\Users\Admin\AppData\Local\Temp\41ad6f7b326ac4b5372ed790426911500da78c2bb3ff9ed98cd41d2515155cba.exe"
2⤵
PID:3388

C:\Users\Admin\AppData\Local\Temp\41ad6f7b326ac4b5372ed790426911500da78c2bb3ff9ed98cd41d2515155cba.exe
"C:\Users\Admin\AppData\Local\Temp\41ad6f7b326ac4b5372ed790426911500da78c2bb3ff9ed98cd41d2515155cba.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1280

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1280-188-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1280-189-0x000000000041F020-mapping.dmp

Download
memory/1280-190-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/1280-196-0x0000000001710000-0x0000000001A30000-memory.dmp

Filesize
3.1MB

Download
memory/4324-118-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-119-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-120-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-121-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-122-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-123-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-124-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-125-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-126-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-127-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-128-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-129-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-130-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-131-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-132-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-133-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-134-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-135-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-136-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-137-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-138-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-139-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-140-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-141-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-142-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-143-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-144-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-145-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-146-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-147-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-148-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-149-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-150-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-151-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-152-0x00000000003B0000-0x000000000044A000-memory.dmp

Filesize
616KB

Download
memory/4324-153-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-154-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-155-0x00000000053B0000-0x00000000058AE000-memory.dmp

Filesize
5.0MB

Download
memory/4324-156-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-157-0x0000000004CD0000-0x0000000004D62000-memory.dmp

Filesize
584KB

Download
memory/4324-158-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-159-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-160-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-161-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-162-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-163-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-164-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-165-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-166-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-167-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-168-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-169-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-170-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-171-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-172-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-173-0x0000000004DC0000-0x0000000004DCA000-memory.dmp

Filesize
40KB

Download
memory/4324-174-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-175-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-176-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-177-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-178-0x00000000052C0000-0x00000000052DA000-memory.dmp

Filesize
104KB

Download
memory/4324-179-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-180-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-181-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-182-0x0000000007450000-0x000000000745C000-memory.dmp

Filesize
48KB

Download
memory/4324-183-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-184-0x0000000009B10000-0x0000000009B8A000-memory.dmp

Filesize
488KB

Download
memory/4324-185-0x0000000009C50000-0x0000000009CEC000-memory.dmp

Filesize
624KB

Download
memory/4324-186-0x0000000009BC0000-0x0000000009BF4000-memory.dmp

Filesize
208KB

Download
memory/4324-187-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-191-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download