formbook | 9c22f08fc1cbbb249b54adba03b6a03957cef4181c4161401085db2dd4383570

Analysis

max time kernel
91s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05-11-2022 01:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9c22f08fc1cbbb249b54adba03b6a03957cef4181c4161401085db2dd4383570.exe
Size

631KB
MD5

7d6ff1922141c5a973665b8fbf23ad28
SHA1

d3e359ba67218bc6ee10a87fb4e5f4d811f2b8cd
SHA256

9c22f08fc1cbbb249b54adba03b6a03957cef4181c4161401085db2dd4383570
SHA512

009cb7a687d11300a01ebf506abd0d91bc43b199ac8bea0155cfc9c86ae19640fbb2422ed4390ee2c0b4ffa7501849b6e225bbd25300d032e107e7a03baede7e
SSDEEP

12288:AwhuJ1Qvhzps7LZ3CUlebztjq7dfaveSS8Ol7amatoVYX9csg87:zuJWs7LZoztjqTS5Ol7akVYXy5

Score

10^/10

formbook d06c rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

d06c

Decoy

douglasdetoledopiza.com

yxcc.online

primo.llc

mediamomos.com

cosmetiq-pro.com

22labs.tech

turbowashing.com

lindaivell.site

princess-bed.club

groundget.cfd

agretaminiousa.com

lomoni.com

nessesse.us

lexgo.cloud

halilsener.xyz

kirokubo.cloud

corotip.sbs

meghq.net

5y6s.world

weasib.online

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/3068-138-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

9c22f08fc1cbbb249b54adba03b6a03957cef4181c4161401085db2dd4383570.exe

description	pid	process	target process
PID 904 set thread context of 3068	904	9c22f08fc1cbbb249b54adba03b6a03957cef4181c4161401085db2dd4383570.exe	9c22f08fc1cbbb249b54adba03b6a03957cef4181c4161401085db2dd4383570.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

9c22f08fc1cbbb249b54adba03b6a03957cef4181c4161401085db2dd4383570.exe

pid	process
3068	9c22f08fc1cbbb249b54adba03b6a03957cef4181c4161401085db2dd4383570.exe
3068	9c22f08fc1cbbb249b54adba03b6a03957cef4181c4161401085db2dd4383570.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

9c22f08fc1cbbb249b54adba03b6a03957cef4181c4161401085db2dd4383570.exe

description	pid	process	target process
PID 904 wrote to memory of 3068	904	9c22f08fc1cbbb249b54adba03b6a03957cef4181c4161401085db2dd4383570.exe	9c22f08fc1cbbb249b54adba03b6a03957cef4181c4161401085db2dd4383570.exe
PID 904 wrote to memory of 3068	904	9c22f08fc1cbbb249b54adba03b6a03957cef4181c4161401085db2dd4383570.exe	9c22f08fc1cbbb249b54adba03b6a03957cef4181c4161401085db2dd4383570.exe
PID 904 wrote to memory of 3068	904	9c22f08fc1cbbb249b54adba03b6a03957cef4181c4161401085db2dd4383570.exe	9c22f08fc1cbbb249b54adba03b6a03957cef4181c4161401085db2dd4383570.exe
PID 904 wrote to memory of 3068	904	9c22f08fc1cbbb249b54adba03b6a03957cef4181c4161401085db2dd4383570.exe	9c22f08fc1cbbb249b54adba03b6a03957cef4181c4161401085db2dd4383570.exe
PID 904 wrote to memory of 3068	904	9c22f08fc1cbbb249b54adba03b6a03957cef4181c4161401085db2dd4383570.exe	9c22f08fc1cbbb249b54adba03b6a03957cef4181c4161401085db2dd4383570.exe
PID 904 wrote to memory of 3068	904	9c22f08fc1cbbb249b54adba03b6a03957cef4181c4161401085db2dd4383570.exe	9c22f08fc1cbbb249b54adba03b6a03957cef4181c4161401085db2dd4383570.exe

C:\Users\Admin\AppData\Local\Temp\9c22f08fc1cbbb249b54adba03b6a03957cef4181c4161401085db2dd4383570.exe
"C:\Users\Admin\AppData\Local\Temp\9c22f08fc1cbbb249b54adba03b6a03957cef4181c4161401085db2dd4383570.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:904

C:\Users\Admin\AppData\Local\Temp\9c22f08fc1cbbb249b54adba03b6a03957cef4181c4161401085db2dd4383570.exe
"C:\Users\Admin\AppData\Local\Temp\9c22f08fc1cbbb249b54adba03b6a03957cef4181c4161401085db2dd4383570.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/904-132-0x0000000000170000-0x0000000000214000-memory.dmp

Filesize
656KB

Download
memory/904-133-0x0000000005150000-0x00000000056F4000-memory.dmp

Filesize
5.6MB

Download
memory/904-134-0x0000000004C40000-0x0000000004CD2000-memory.dmp

Filesize
584KB

Download
memory/904-135-0x0000000004BB0000-0x0000000004BBA000-memory.dmp

Filesize
40KB

Download
memory/904-136-0x00000000077A0000-0x000000000783C000-memory.dmp

Filesize
624KB

Download
memory/3068-137-0x0000000000000000-mapping.dmp

Download
memory/3068-138-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3068-139-0x0000000001560000-0x00000000018AA000-memory.dmp

Filesize
3.3MB

Download