formbook | af4e4f24d35ee2d2d5efdfcaff5d9b5c0b6173165d66e5e22ff44c53e8a316f4

Analysis

max time kernel
90s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2022 08:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Trojan.Inject4.44941.14960.17808.exe
Size

990KB
MD5

3b0c5b4eed9f2222f09e61efaee554f4
SHA1

c32cc7642bc141b6ae804d620d663a41cd5b76b0
SHA256

af4e4f24d35ee2d2d5efdfcaff5d9b5c0b6173165d66e5e22ff44c53e8a316f4
SHA512

9fc73970f445b21c46193eab4149b6dc465c4c32c90b51123ac50679236f1886325a1a9a053964d3b58ec503533c06837ae1eeba9011d31ff9cef6be865ef91e
SSDEEP

12288:xIwDxoBuee4EFJcwoeyKeXZca1AJlQo74xjtDS3lAQSQy4AB:HK44EuRFX+qqlgtaAtQy4A

Score

10^/10

formbook ng04 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ng04

Decoy

tevimaq.com

easterspecialtystore.com

smartlever.tech

10312.uk

tanjawiharbi.co.uk

471338.com

horusventure.com

empress-care.com

sinrian.com

465951.com

aemsti.com

nxcourier.com

stargatefarms.com

lalyquainvestment.com

dailysportsadvice.com

justlistmoore.com

stoneonroll.online

tatianakolomiets.com

barcodebbm.com

protectorship.world

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3520-139-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

SecuriteInfo.com.Trojan.Inject4.44941.14960.17808.exe

description	pid	process	target process
PID 4376 set thread context of 3520	4376	SecuriteInfo.com.Trojan.Inject4.44941.14960.17808.exe	SecuriteInfo.com.Trojan.Inject4.44941.14960.17808.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

SecuriteInfo.com.Trojan.Inject4.44941.14960.17808.exe

pid process

3520 SecuriteInfo.com.Trojan.Inject4.44941.14960.17808.exe
3520 SecuriteInfo.com.Trojan.Inject4.44941.14960.17808.exe

pid	process
3520	SecuriteInfo.com.Trojan.Inject4.44941.14960.17808.exe
3520	SecuriteInfo.com.Trojan.Inject4.44941.14960.17808.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

SecuriteInfo.com.Trojan.Inject4.44941.14960.17808.exe

description	pid	process	target process
PID 4376 wrote to memory of 3520	4376	SecuriteInfo.com.Trojan.Inject4.44941.14960.17808.exe	SecuriteInfo.com.Trojan.Inject4.44941.14960.17808.exe
PID 4376 wrote to memory of 3520	4376	SecuriteInfo.com.Trojan.Inject4.44941.14960.17808.exe	SecuriteInfo.com.Trojan.Inject4.44941.14960.17808.exe
PID 4376 wrote to memory of 3520	4376	SecuriteInfo.com.Trojan.Inject4.44941.14960.17808.exe	SecuriteInfo.com.Trojan.Inject4.44941.14960.17808.exe
PID 4376 wrote to memory of 3520	4376	SecuriteInfo.com.Trojan.Inject4.44941.14960.17808.exe	SecuriteInfo.com.Trojan.Inject4.44941.14960.17808.exe
PID 4376 wrote to memory of 3520	4376	SecuriteInfo.com.Trojan.Inject4.44941.14960.17808.exe	SecuriteInfo.com.Trojan.Inject4.44941.14960.17808.exe
PID 4376 wrote to memory of 3520	4376	SecuriteInfo.com.Trojan.Inject4.44941.14960.17808.exe	SecuriteInfo.com.Trojan.Inject4.44941.14960.17808.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.44941.14960.17808.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.44941.14960.17808.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4376

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.44941.14960.17808.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.44941.14960.17808.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3520

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3520-138-0x0000000000000000-mapping.dmp

Download
memory/3520-139-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3520-140-0x0000000001A00000-0x0000000001D4A000-memory.dmp

Filesize
3.3MB

Download
memory/4376-132-0x00000000004F0000-0x00000000005EC000-memory.dmp

Filesize
1008KB

Download
memory/4376-133-0x00000000055B0000-0x0000000005B54000-memory.dmp

Filesize
5.6MB

Download
memory/4376-134-0x0000000005000000-0x0000000005092000-memory.dmp

Filesize
584KB

Download
memory/4376-135-0x0000000004F80000-0x0000000004F8A000-memory.dmp

Filesize
40KB

Download
memory/4376-136-0x000000000B130000-0x000000000B1CC000-memory.dmp

Filesize
624KB

Download
memory/4376-137-0x000000000B1D0000-0x000000000B236000-memory.dmp

Filesize
408KB

Download