formbook | 27f2087a1eb0f0ad0178f59eb8924ead92b1104132ed638897fca915c7e5c162

Analysis

max time kernel
118s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
18-10-2022 19:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

27f2087a1eb0f0ad0178f59eb8924ead92b1104132ed638897fca915c7e5c162.exe
Size

988KB
MD5

1af8f4ac0eb2cde05f545828c3f9f04f
SHA1

7a6882b53d98889f815e2eae79a478cb4e6b22d4
SHA256

27f2087a1eb0f0ad0178f59eb8924ead92b1104132ed638897fca915c7e5c162
SHA512

2906e8dbb7b6859a156bafa01d3d07de50a84173519933c63c1066dd9124ca595e716d710f7b21ae07a21136c9a296c8bde1b2c0fdc41ace3b30ce942818557b
SSDEEP

12288:ur1cA2iNaxfvX1QmLIf5hjKEM17GQ7F9cmLy0HAgwpsJDWhqWfu:A1S1wbKr7bcKesJChBf

Score

10^/10

formbook p94a rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

p94a

Decoy

wishgrove.com

parqueveiculos.com

spiderwebs.online

chulkanadham.com

cdtuan.net

zxazm.com

payment6528832.xyz

fengtaiol.com

bffsmovie.com

aliceseagerfitness.com

garisluruskonsulindo.website

analytical-gutter.net

ahcq8.com

fenyoga.com

ecleptic.cat

conjurecrafts.com

aquaway.date

apenpokkenschoonmaakbedrijf.com

zgramr.top

boweknives.site

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1656-139-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

27f2087a1eb0f0ad0178f59eb8924ead92b1104132ed638897fca915c7e5c162.exe

description	pid	process	target process
PID 1988 set thread context of 1656	1988	27f2087a1eb0f0ad0178f59eb8924ead92b1104132ed638897fca915c7e5c162.exe	27f2087a1eb0f0ad0178f59eb8924ead92b1104132ed638897fca915c7e5c162.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

27f2087a1eb0f0ad0178f59eb8924ead92b1104132ed638897fca915c7e5c162.exe

pid	process
1656	27f2087a1eb0f0ad0178f59eb8924ead92b1104132ed638897fca915c7e5c162.exe
1656	27f2087a1eb0f0ad0178f59eb8924ead92b1104132ed638897fca915c7e5c162.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

27f2087a1eb0f0ad0178f59eb8924ead92b1104132ed638897fca915c7e5c162.exe

description	pid	process	target process
PID 1988 wrote to memory of 1656	1988	27f2087a1eb0f0ad0178f59eb8924ead92b1104132ed638897fca915c7e5c162.exe	27f2087a1eb0f0ad0178f59eb8924ead92b1104132ed638897fca915c7e5c162.exe
PID 1988 wrote to memory of 1656	1988	27f2087a1eb0f0ad0178f59eb8924ead92b1104132ed638897fca915c7e5c162.exe	27f2087a1eb0f0ad0178f59eb8924ead92b1104132ed638897fca915c7e5c162.exe
PID 1988 wrote to memory of 1656	1988	27f2087a1eb0f0ad0178f59eb8924ead92b1104132ed638897fca915c7e5c162.exe	27f2087a1eb0f0ad0178f59eb8924ead92b1104132ed638897fca915c7e5c162.exe
PID 1988 wrote to memory of 1656	1988	27f2087a1eb0f0ad0178f59eb8924ead92b1104132ed638897fca915c7e5c162.exe	27f2087a1eb0f0ad0178f59eb8924ead92b1104132ed638897fca915c7e5c162.exe
PID 1988 wrote to memory of 1656	1988	27f2087a1eb0f0ad0178f59eb8924ead92b1104132ed638897fca915c7e5c162.exe	27f2087a1eb0f0ad0178f59eb8924ead92b1104132ed638897fca915c7e5c162.exe
PID 1988 wrote to memory of 1656	1988	27f2087a1eb0f0ad0178f59eb8924ead92b1104132ed638897fca915c7e5c162.exe	27f2087a1eb0f0ad0178f59eb8924ead92b1104132ed638897fca915c7e5c162.exe

C:\Users\Admin\AppData\Local\Temp\27f2087a1eb0f0ad0178f59eb8924ead92b1104132ed638897fca915c7e5c162.exe
"C:\Users\Admin\AppData\Local\Temp\27f2087a1eb0f0ad0178f59eb8924ead92b1104132ed638897fca915c7e5c162.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1988

C:\Users\Admin\AppData\Local\Temp\27f2087a1eb0f0ad0178f59eb8924ead92b1104132ed638897fca915c7e5c162.exe
"C:\Users\Admin\AppData\Local\Temp\27f2087a1eb0f0ad0178f59eb8924ead92b1104132ed638897fca915c7e5c162.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1656-138-0x0000000000000000-mapping.dmp

Download
memory/1656-139-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1656-140-0x00000000010B0000-0x00000000013FA000-memory.dmp

Filesize
3.3MB

Download
memory/1988-132-0x00000000003F0000-0x00000000004EE000-memory.dmp

Filesize
1016KB

Download
memory/1988-133-0x0000000005390000-0x0000000005934000-memory.dmp

Filesize
5.6MB

Download
memory/1988-134-0x0000000004E80000-0x0000000004F12000-memory.dmp

Filesize
584KB

Download
memory/1988-135-0x0000000005040000-0x000000000504A000-memory.dmp

Filesize
40KB

Download
memory/1988-136-0x000000000A5C0000-0x000000000A65C000-memory.dmp

Filesize
624KB

Download
memory/1988-137-0x000000000A6D0000-0x000000000A736000-memory.dmp

Filesize
408KB

Download