formbook | fb57fd7428a4d7447e1203d03ab5058880ef6ef18fc6f99465c0aac2071ed945

Analysis

max time kernel
122s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 18:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

db0d06fa07ee8e6e77913e27ddfcd29639bc382b68a75c86c4a6e2f5b4781530.exe
Size

1.1MB
MD5

5ef0396427ff796a37b983f3baf84d5f
SHA1

7dc04df23d8c3f75dfc143db7d92e0eac4bf5d1b
SHA256

db0d06fa07ee8e6e77913e27ddfcd29639bc382b68a75c86c4a6e2f5b4781530
SHA512

f619f9a7f092554fe2f7538df9eb8e9f9b479ba8e08ac9a0d95afa1c1f1353cddc557ba7bd7ee85cf8fdf43a126de63cc2920d402dd8730246fafdfdf61e36a1
SSDEEP

12288:vwDXz2hTd6AkbyKs1zMm42dEjeIeya86xYzSJuPbBMHlqjJ5npmhKgf81o3XjnVt:4YZoHs342a6rtZ6OM1MQjrg

Score

10^/10

formbook fuyb rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

fuyb

Decoy

ySqkimeTE13H2ewGja9LGg==

c6a/mIndrz59qJ+/EZkF1VoKrQ==

puyjGw1Sa0A3VV4KDnqRFhr2jQC3fkc=

AjQ3LKQUXkyY6xtK/7v2VD32hgC3fkc=

zDZkS4/T4a3VFha4ja9LGg==

JYyS87zY2KSlwbAZq3Qx

Ip0fCecSq7T3ahlotm5p155TI2M/

ipYI7ki2JoP3FTV3DtjWeBqU

OG8mkGOZ5vPkBbwTIYpvwW92C8E=

GqbksepyJ6UgcFGPUA==

1zpmT4/g7AdL

2/gE2eXTnxzbcFGPUA==

CpK1phq0TrU3RnkgGKxt6tY=

4CmsHJMoNyxlsVaFx6W+iDee

+XypJGn7A+XcAFHrZ9Y6

UIAQW44G/tnX6JtM0n7UvqqR

6DHlWlGVuDDXcFGPUA==

Vp7L/Td2KXf8HL/RDePWeBqU

SnchgsBScnGwB7yvQgEqQPV0f8k=

wgMo/D7YcYh7ezwb6js=

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1944 set thread context of 1764	1944	db0d06fa07ee8e6e77913e27ddfcd29639bc382b68a75c86c4a6e2f5b4781530.exe	92

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1944	db0d06fa07ee8e6e77913e27ddfcd29639bc382b68a75c86c4a6e2f5b4781530.exe
1944	db0d06fa07ee8e6e77913e27ddfcd29639bc382b68a75c86c4a6e2f5b4781530.exe
1764	db0d06fa07ee8e6e77913e27ddfcd29639bc382b68a75c86c4a6e2f5b4781530.exe
1764	db0d06fa07ee8e6e77913e27ddfcd29639bc382b68a75c86c4a6e2f5b4781530.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1944	db0d06fa07ee8e6e77913e27ddfcd29639bc382b68a75c86c4a6e2f5b4781530.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 2996	1944	db0d06fa07ee8e6e77913e27ddfcd29639bc382b68a75c86c4a6e2f5b4781530.exe	91
PID 1944 wrote to memory of 2996	1944	db0d06fa07ee8e6e77913e27ddfcd29639bc382b68a75c86c4a6e2f5b4781530.exe	91
PID 1944 wrote to memory of 2996	1944	db0d06fa07ee8e6e77913e27ddfcd29639bc382b68a75c86c4a6e2f5b4781530.exe	91
PID 1944 wrote to memory of 1764	1944	db0d06fa07ee8e6e77913e27ddfcd29639bc382b68a75c86c4a6e2f5b4781530.exe	92
PID 1944 wrote to memory of 1764	1944	db0d06fa07ee8e6e77913e27ddfcd29639bc382b68a75c86c4a6e2f5b4781530.exe	92
PID 1944 wrote to memory of 1764	1944	db0d06fa07ee8e6e77913e27ddfcd29639bc382b68a75c86c4a6e2f5b4781530.exe	92
PID 1944 wrote to memory of 1764	1944	db0d06fa07ee8e6e77913e27ddfcd29639bc382b68a75c86c4a6e2f5b4781530.exe	92
PID 1944 wrote to memory of 1764	1944	db0d06fa07ee8e6e77913e27ddfcd29639bc382b68a75c86c4a6e2f5b4781530.exe	92
PID 1944 wrote to memory of 1764	1944	db0d06fa07ee8e6e77913e27ddfcd29639bc382b68a75c86c4a6e2f5b4781530.exe	92

C:\Users\Admin\AppData\Local\Temp\db0d06fa07ee8e6e77913e27ddfcd29639bc382b68a75c86c4a6e2f5b4781530.exe
"C:\Users\Admin\AppData\Local\Temp\db0d06fa07ee8e6e77913e27ddfcd29639bc382b68a75c86c4a6e2f5b4781530.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Users\Admin\AppData\Local\Temp\db0d06fa07ee8e6e77913e27ddfcd29639bc382b68a75c86c4a6e2f5b4781530.exe
  "{path}"
  2⤵
  PID:2996
- C:\Users\Admin\AppData\Local\Temp\db0d06fa07ee8e6e77913e27ddfcd29639bc382b68a75c86c4a6e2f5b4781530.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1764-139-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1764-141-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1764-142-0x0000000000401000-0x000000000042F000-memory.dmp

Filesize
184KB

Download
memory/1764-143-0x00000000014B0000-0x00000000017FA000-memory.dmp

Filesize
3.3MB

Download
memory/1944-132-0x0000000000380000-0x0000000000496000-memory.dmp

Filesize
1.1MB

Download
memory/1944-133-0x0000000005460000-0x0000000005A04000-memory.dmp

Filesize
5.6MB

Download
memory/1944-134-0x0000000004EB0000-0x0000000004F42000-memory.dmp

Filesize
584KB

Download
memory/1944-135-0x0000000004F50000-0x0000000004FEC000-memory.dmp

Filesize
624KB

Download
memory/1944-136-0x0000000004E40000-0x0000000004E4A000-memory.dmp

Filesize
40KB

Download