formbook | 649e67dfa9829d849ab0e2e5dd9c40702dbb89cf5a8a02ad111c5f2df79c411f

Resubmissions

23-09-2022 06:50

220923-hme1ashdbk 10

23-09-2022 06:34

220923-hb14dshcgp 10

Analysis

max time kernel
91s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-09-2022 06:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DOC20220919-56789098765560890.exe
Size

844KB
MD5

ab4f11300b28fca30e7b1febe92fe21e
SHA1

d436f88bb93be78b99c06db844611ffc217c214f
SHA256

649e67dfa9829d849ab0e2e5dd9c40702dbb89cf5a8a02ad111c5f2df79c411f
SHA512

28e0a4754d23fa1b5be34170aaa78812d3ef0794aa1e1082ff848075198856455df7ddf4e0742bc4d23093012cd352ba1eb0fd43bbd7f8ee79bf9b39ac7b7b13
SSDEEP

12288:TjatMC00J4BPcOmK80/6wM2zlgKM/h40knDwq/9xDxTVORzmXIcQI:CtmmMk7K80LMagKOO5V8zQ4I

Score

10^/10

formbook c1no rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

c1no

Decoy

NOAZ1GtFnUx1bqjUWmD6

sUBk3CYAoWuQfq3UWmD6

5vwrVl0msDtpEkYt

VtL6sSoIchhMStcj5DxYbm3FBw==

BKjy1ZxyhhuJ2guPWUI=

eAgklPLAE7zgqOmwRqPNOQLXz1Y=

aApC9n9Zp0ZhObwjLLLUAg1cjsx6Lg==

OrLZYLeFBavC1cD5+A==

jJm87eu4hy/QMbYE/wzDRQLXz1Y=

s63OS5RsBKrY3FurpDZXbm3FBw==

hyxwKsePxJNCwwejbEg=

l5667e2vQOkM4hFPE5yA0Q==

wTtVQBT04YkyoNKoN53GFV9m2hpS

+pzWhBnS26FJqiRyZXQrqR1Ow/1B

d/VHx031x5W2

GjhhiKSDZ/1txQejbEg=

nDhRjp5e9JeQiKzm+gqI41hdV5nFhsI=

ws4wtUMZYA1pEkYt

GazXV6Fr6akfcvxEOcbpTTCmMEq7Jg==

2vAOHufF5MT6VdU=

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Suspicious use of SetThreadContext 1 IoCs

Processes:

DOC20220919-56789098765560890.exe

description pid process target process

PID 3036 set thread context of 4848 3036 DOC20220919-56789098765560890.exe DOC20220919-56789098765560890.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

DOC20220919-56789098765560890.exe

pid process

4848 DOC20220919-56789098765560890.exe
4848 DOC20220919-56789098765560890.exe

description	pid	process	target process
PID 3036 set thread context of 4848	3036	DOC20220919-56789098765560890.exe	DOC20220919-56789098765560890.exe

pid	process
4848	DOC20220919-56789098765560890.exe
4848	DOC20220919-56789098765560890.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

DOC20220919-56789098765560890.exe

description	pid	process	target process
PID 3036 wrote to memory of 4848	3036	DOC20220919-56789098765560890.exe	DOC20220919-56789098765560890.exe
PID 3036 wrote to memory of 4848	3036	DOC20220919-56789098765560890.exe	DOC20220919-56789098765560890.exe
PID 3036 wrote to memory of 4848	3036	DOC20220919-56789098765560890.exe	DOC20220919-56789098765560890.exe
PID 3036 wrote to memory of 4848	3036	DOC20220919-56789098765560890.exe	DOC20220919-56789098765560890.exe
PID 3036 wrote to memory of 4848	3036	DOC20220919-56789098765560890.exe	DOC20220919-56789098765560890.exe
PID 3036 wrote to memory of 4848	3036	DOC20220919-56789098765560890.exe	DOC20220919-56789098765560890.exe

C:\Users\Admin\AppData\Local\Temp\DOC20220919-56789098765560890.exe
"C:\Users\Admin\AppData\Local\Temp\DOC20220919-56789098765560890.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3036

C:\Users\Admin\AppData\Local\Temp\DOC20220919-56789098765560890.exe
"C:\Users\Admin\AppData\Local\Temp\DOC20220919-56789098765560890.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3036-132-0x0000000000270000-0x0000000000348000-memory.dmp

Filesize
864KB

Download
memory/3036-133-0x0000000005330000-0x00000000058D4000-memory.dmp

Filesize
5.6MB

Download
memory/3036-134-0x0000000004D80000-0x0000000004E12000-memory.dmp

Filesize
584KB

Download
memory/3036-135-0x0000000004E70000-0x0000000004E7A000-memory.dmp

Filesize
40KB

Download
memory/3036-136-0x0000000008A30000-0x0000000008ACC000-memory.dmp

Filesize
624KB

Download
memory/3036-137-0x0000000008AD0000-0x0000000008B36000-memory.dmp

Filesize
408KB

Download
memory/4848-138-0x0000000000000000-mapping.dmp

Download
memory/4848-139-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4848-141-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4848-142-0x0000000000401000-0x000000000042F000-memory.dmp

Filesize
184KB

Download
memory/4848-143-0x0000000000EA0000-0x00000000011EA000-memory.dmp

Filesize
3.3MB

Download