formbook | 603b9ff5f2450d74e36a1102c2376268b08224658f5b1dfa26d3e53636a76660

Analysis

max time kernel
56s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-09-2022 22:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DOC20220919-5678909876556089.exe
Size

787KB
MD5

6b40f897cb3162a30b4f4f63af64963a
SHA1

a004c760f745b1cc6d14aee87b6164cb3c4fc36c
SHA256

603b9ff5f2450d74e36a1102c2376268b08224658f5b1dfa26d3e53636a76660
SHA512

743b3dc822d26427b82d5a37c9b10a039abb04f5704f4cfd6a1ee654a384a0748e31c1853edd15a487c53f5ee9e2716078120054f05a8aac1921f9f07d4432dc
SSDEEP

12288:/bsNQBpuOR/+Mfm8pX8eNv1dsgGCWjwP/zXWpuKHaefN4tKe:aisMfNFx3sQnLWpie4

Score

10^/10

formbook c1no rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

c1no

Decoy

NOAZ1GtFnUx1bqjUWmD6

sUBk3CYAoWuQfq3UWmD6

5vwrVl0msDtpEkYt

VtL6sSoIchhMStcj5DxYbm3FBw==

BKjy1ZxyhhuJ2guPWUI=

eAgklPLAE7zgqOmwRqPNOQLXz1Y=

aApC9n9Zp0ZhObwjLLLUAg1cjsx6Lg==

OrLZYLeFBavC1cD5+A==

jJm87eu4hy/QMbYE/wzDRQLXz1Y=

s63OS5RsBKrY3FurpDZXbm3FBw==

hyxwKsePxJNCwwejbEg=

l5667e2vQOkM4hFPE5yA0Q==

wTtVQBT04YkyoNKoN53GFV9m2hpS

+pzWhBnS26FJqiRyZXQrqR1Ow/1B

d/VHx031x5W2

GjhhiKSDZ/1txQejbEg=

nDhRjp5e9JeQiKzm+gqI41hdV5nFhsI=

ws4wtUMZYA1pEkYt

GazXV6Fr6akfcvxEOcbpTTCmMEq7Jg==

2vAOHufF5MT6VdU=

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Suspicious use of SetThreadContext 1 IoCs

Processes:

DOC20220919-5678909876556089.exe

description pid process target process

PID 864 set thread context of 1364 864 DOC20220919-5678909876556089.exe DOC20220919-5678909876556089.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

DOC20220919-5678909876556089.exe

pid process

1364 DOC20220919-5678909876556089.exe

description	pid	process	target process
PID 864 set thread context of 1364	864	DOC20220919-5678909876556089.exe	DOC20220919-5678909876556089.exe

pid	process
1364	DOC20220919-5678909876556089.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

DOC20220919-5678909876556089.exe

description	pid	process	target process
PID 864 wrote to memory of 1364	864	DOC20220919-5678909876556089.exe	DOC20220919-5678909876556089.exe
PID 864 wrote to memory of 1364	864	DOC20220919-5678909876556089.exe	DOC20220919-5678909876556089.exe
PID 864 wrote to memory of 1364	864	DOC20220919-5678909876556089.exe	DOC20220919-5678909876556089.exe
PID 864 wrote to memory of 1364	864	DOC20220919-5678909876556089.exe	DOC20220919-5678909876556089.exe
PID 864 wrote to memory of 1364	864	DOC20220919-5678909876556089.exe	DOC20220919-5678909876556089.exe
PID 864 wrote to memory of 1364	864	DOC20220919-5678909876556089.exe	DOC20220919-5678909876556089.exe
PID 864 wrote to memory of 1364	864	DOC20220919-5678909876556089.exe	DOC20220919-5678909876556089.exe

C:\Users\Admin\AppData\Local\Temp\DOC20220919-5678909876556089.exe
"C:\Users\Admin\AppData\Local\Temp\DOC20220919-5678909876556089.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:864

C:\Users\Admin\AppData\Local\Temp\DOC20220919-5678909876556089.exe
"C:\Users\Admin\AppData\Local\Temp\DOC20220919-5678909876556089.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1364

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/864-54-0x00000000009A0000-0x0000000000A6C000-memory.dmp

Filesize
816KB

Download
memory/864-55-0x0000000075141000-0x0000000075143000-memory.dmp

Filesize
8KB

Download
memory/864-56-0x0000000000530000-0x0000000000546000-memory.dmp

Filesize
88KB

Download
memory/864-57-0x0000000000540000-0x000000000054C000-memory.dmp

Filesize
48KB

Download
memory/864-58-0x0000000005D90000-0x0000000005E20000-memory.dmp

Filesize
576KB

Download
memory/864-59-0x0000000004180000-0x00000000041B4000-memory.dmp

Filesize
208KB

Download
memory/1364-60-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1364-64-0x00000000004012B0-mapping.dmp

Download
memory/1364-63-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1364-61-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1364-67-0x0000000000401000-0x000000000042F000-memory.dmp

Filesize
184KB

Download
memory/1364-68-0x0000000000A70000-0x0000000000D73000-memory.dmp

Filesize
3.0MB

Download
memory/1364-66-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download