formbook | 649e67dfa9829d849ab0e2e5dd9c40702dbb89cf5a8a02ad111c5f2df79c411f

Resubmissions

23-09-2022 06:50

220923-hme1ashdbk 10

23-09-2022 06:34

220923-hb14dshcgp 10

Analysis

max time kernel
121s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-09-2022 06:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DOC20220919-56789098765560890.exe
Size

844KB
MD5

ab4f11300b28fca30e7b1febe92fe21e
SHA1

d436f88bb93be78b99c06db844611ffc217c214f
SHA256

649e67dfa9829d849ab0e2e5dd9c40702dbb89cf5a8a02ad111c5f2df79c411f
SHA512

28e0a4754d23fa1b5be34170aaa78812d3ef0794aa1e1082ff848075198856455df7ddf4e0742bc4d23093012cd352ba1eb0fd43bbd7f8ee79bf9b39ac7b7b13
SSDEEP

12288:TjatMC00J4BPcOmK80/6wM2zlgKM/h40knDwq/9xDxTVORzmXIcQI:CtmmMk7K80LMagKOO5V8zQ4I

Score

10^/10

formbook c1no rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

c1no

Decoy

NOAZ1GtFnUx1bqjUWmD6

sUBk3CYAoWuQfq3UWmD6

5vwrVl0msDtpEkYt

VtL6sSoIchhMStcj5DxYbm3FBw==

BKjy1ZxyhhuJ2guPWUI=

eAgklPLAE7zgqOmwRqPNOQLXz1Y=

aApC9n9Zp0ZhObwjLLLUAg1cjsx6Lg==

OrLZYLeFBavC1cD5+A==

jJm87eu4hy/QMbYE/wzDRQLXz1Y=

s63OS5RsBKrY3FurpDZXbm3FBw==

hyxwKsePxJNCwwejbEg=

l5667e2vQOkM4hFPE5yA0Q==

wTtVQBT04YkyoNKoN53GFV9m2hpS

+pzWhBnS26FJqiRyZXQrqR1Ow/1B

d/VHx031x5W2

GjhhiKSDZ/1txQejbEg=

nDhRjp5e9JeQiKzm+gqI41hdV5nFhsI=

ws4wtUMZYA1pEkYt

GazXV6Fr6akfcvxEOcbpTTCmMEq7Jg==

2vAOHufF5MT6VdU=

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1944 set thread context of 1996	1944	DOC20220919-56789098765560890.exe	90

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1996	DOC20220919-56789098765560890.exe
1996	DOC20220919-56789098765560890.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 1996	1944	DOC20220919-56789098765560890.exe	90
PID 1944 wrote to memory of 1996	1944	DOC20220919-56789098765560890.exe	90
PID 1944 wrote to memory of 1996	1944	DOC20220919-56789098765560890.exe	90
PID 1944 wrote to memory of 1996	1944	DOC20220919-56789098765560890.exe	90
PID 1944 wrote to memory of 1996	1944	DOC20220919-56789098765560890.exe	90
PID 1944 wrote to memory of 1996	1944	DOC20220919-56789098765560890.exe	90

C:\Users\Admin\AppData\Local\Temp\DOC20220919-56789098765560890.exe
"C:\Users\Admin\AppData\Local\Temp\DOC20220919-56789098765560890.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Users\Admin\AppData\Local\Temp\DOC20220919-56789098765560890.exe
  "C:\Users\Admin\AppData\Local\Temp\DOC20220919-56789098765560890.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1944-132-0x0000000000500000-0x00000000005D8000-memory.dmp

Filesize
864KB

Download
memory/1944-133-0x00000000054B0000-0x0000000005A54000-memory.dmp

Filesize
5.6MB

Download
memory/1944-134-0x0000000004FA0000-0x0000000005032000-memory.dmp

Filesize
584KB

Download
memory/1944-135-0x0000000004F70000-0x0000000004F7A000-memory.dmp

Filesize
40KB

Download
memory/1944-136-0x0000000008A30000-0x0000000008ACC000-memory.dmp

Filesize
624KB

Download
memory/1944-137-0x0000000008AD0000-0x0000000008B36000-memory.dmp

Filesize
408KB

Download
memory/1996-138-0x0000000000000000-mapping.dmp

Download
memory/1996-139-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1996-141-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1996-142-0x0000000000401000-0x000000000042F000-memory.dmp

Filesize
184KB

Download
memory/1996-143-0x0000000001770000-0x0000000001ABA000-memory.dmp

Filesize
3.3MB

Download