formbook | fefe6dfd1e895647098d6bce13f51d2708d1e85604a502fd1998d4b38a3c217d

Analysis

max time kernel
145s
max time network
146s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
23-09-2022 06:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fefe6dfd1e895647098d6bce13f51d2708d1e85604a502fd1998d4b38a3c217d.exe
Size

913KB
MD5

41568942a27e81c66ef8b9f0dd0721c9
SHA1

d85a1f9be1d2ed1434440c002b276b88e08131bf
SHA256

fefe6dfd1e895647098d6bce13f51d2708d1e85604a502fd1998d4b38a3c217d
SHA512

e317aeec483795698e42ddc90a466db2f2b5748601ad061c942fb5cb6eebd9c92e4f3c8e57d33d6797e2ce7b2b009a8d06aaf1a000c64ae642ffe9408a097f7a
SSDEEP

12288:9mm8NGa4EW1HX15g+2FhvPZkl6Es+LVhIG3ypM+Me4d9LdIrKFUEyLZTe9LugVL1:9GMa1kHXoFpPZkl+2MpMDtQW

Score

10^/10

formbook sde7 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

sde7

Decoy

lolfilmfestival.com

pousdaobosque.com

tangierfilm.com

valuedassist.com

qcrluxuryrentals.com

poc4cloudx.com

irizh.art

flowsever.com

serios-lifestyle.com

abc-diomain.com

bmwoemwarehouse.com

vivelamoda.com

thesycorax.online

goodjob129.com

hudyeanamaze.com

pabcp.com

millennialworkouts.com

gpcr-compound-library.com

rotyupin.xyz

hnkcsm.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1076-186-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1076-187-0x000000000041F160-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

fefe6dfd1e895647098d6bce13f51d2708d1e85604a502fd1998d4b38a3c217d.exe

description	pid	process	target process
PID 1892 set thread context of 1076	1892	fefe6dfd1e895647098d6bce13f51d2708d1e85604a502fd1998d4b38a3c217d.exe	fefe6dfd1e895647098d6bce13f51d2708d1e85604a502fd1998d4b38a3c217d.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

fefe6dfd1e895647098d6bce13f51d2708d1e85604a502fd1998d4b38a3c217d.exe

pid	process
1076	fefe6dfd1e895647098d6bce13f51d2708d1e85604a502fd1998d4b38a3c217d.exe
1076	fefe6dfd1e895647098d6bce13f51d2708d1e85604a502fd1998d4b38a3c217d.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

fefe6dfd1e895647098d6bce13f51d2708d1e85604a502fd1998d4b38a3c217d.exe

description	pid	process	target process
PID 1892 wrote to memory of 1076	1892	fefe6dfd1e895647098d6bce13f51d2708d1e85604a502fd1998d4b38a3c217d.exe	fefe6dfd1e895647098d6bce13f51d2708d1e85604a502fd1998d4b38a3c217d.exe
PID 1892 wrote to memory of 1076	1892	fefe6dfd1e895647098d6bce13f51d2708d1e85604a502fd1998d4b38a3c217d.exe	fefe6dfd1e895647098d6bce13f51d2708d1e85604a502fd1998d4b38a3c217d.exe
PID 1892 wrote to memory of 1076	1892	fefe6dfd1e895647098d6bce13f51d2708d1e85604a502fd1998d4b38a3c217d.exe	fefe6dfd1e895647098d6bce13f51d2708d1e85604a502fd1998d4b38a3c217d.exe
PID 1892 wrote to memory of 1076	1892	fefe6dfd1e895647098d6bce13f51d2708d1e85604a502fd1998d4b38a3c217d.exe	fefe6dfd1e895647098d6bce13f51d2708d1e85604a502fd1998d4b38a3c217d.exe
PID 1892 wrote to memory of 1076	1892	fefe6dfd1e895647098d6bce13f51d2708d1e85604a502fd1998d4b38a3c217d.exe	fefe6dfd1e895647098d6bce13f51d2708d1e85604a502fd1998d4b38a3c217d.exe
PID 1892 wrote to memory of 1076	1892	fefe6dfd1e895647098d6bce13f51d2708d1e85604a502fd1998d4b38a3c217d.exe	fefe6dfd1e895647098d6bce13f51d2708d1e85604a502fd1998d4b38a3c217d.exe

C:\Users\Admin\AppData\Local\Temp\fefe6dfd1e895647098d6bce13f51d2708d1e85604a502fd1998d4b38a3c217d.exe
"C:\Users\Admin\AppData\Local\Temp\fefe6dfd1e895647098d6bce13f51d2708d1e85604a502fd1998d4b38a3c217d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1892

C:\Users\Admin\AppData\Local\Temp\fefe6dfd1e895647098d6bce13f51d2708d1e85604a502fd1998d4b38a3c217d.exe
"C:\Users\Admin\AppData\Local\Temp\fefe6dfd1e895647098d6bce13f51d2708d1e85604a502fd1998d4b38a3c217d.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1076-186-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1076-187-0x000000000041F160-mapping.dmp

Download
memory/1076-190-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1076-188-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1076-194-0x00000000010C0000-0x00000000013E0000-memory.dmp

Filesize
3.1MB

Download
memory/1892-149-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1892-121-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1892-118-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1892-150-0x0000000000D60000-0x0000000000E4A000-memory.dmp

Filesize
936KB

Download
memory/1892-120-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1892-151-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1892-122-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1892-123-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1892-124-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1892-125-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1892-126-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1892-127-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1892-128-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1892-129-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1892-130-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1892-131-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1892-132-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1892-133-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1892-134-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1892-135-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1892-136-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1892-137-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1892-138-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1892-139-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1892-140-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1892-141-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1892-142-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1892-143-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1892-144-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1892-145-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1892-146-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1892-147-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1892-148-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1892-116-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1892-119-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1892-152-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1892-117-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1892-153-0x0000000005B50000-0x000000000604E000-memory.dmp

Filesize
5.0MB

Download
memory/1892-154-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1892-155-0x00000000056F0000-0x0000000005782000-memory.dmp

Filesize
584KB

Download
memory/1892-156-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1892-157-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1892-158-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1892-159-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1892-160-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1892-161-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1892-162-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1892-163-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1892-164-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1892-165-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1892-166-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1892-167-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1892-168-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1892-169-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1892-170-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1892-171-0x0000000005670000-0x000000000567A000-memory.dmp

Filesize
40KB

Download
memory/1892-172-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1892-173-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1892-174-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1892-175-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1892-176-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1892-177-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1892-178-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1892-179-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1892-180-0x0000000005820000-0x0000000005834000-memory.dmp

Filesize
80KB

Download
memory/1892-181-0x0000000005980000-0x000000000598C000-memory.dmp

Filesize
48KB

Download
memory/1892-182-0x0000000007EE0000-0x0000000007F6E000-memory.dmp

Filesize
568KB

Download
memory/1892-183-0x0000000008020000-0x00000000080BC000-memory.dmp

Filesize
624KB

Download
memory/1892-184-0x0000000008180000-0x00000000081E6000-memory.dmp

Filesize
408KB

Download
memory/1892-185-0x0000000007FC0000-0x0000000007FF4000-memory.dmp

Filesize
208KB

Download
memory/1892-189-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download