formbook | 3bac0715b2f1f0a408c7640ea62cea43789e92dc97caad6dfa206d6d805fb266

Analysis

max time kernel
90s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 13:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
567088d3013ac44bc25ad9f0fcffdfe6.exe
Size 816KB
Sample221107-qlm9aahcd9
SHA256 3bac0715b2f1f0a408c7640ea62cea43789e92dc97caad6dfa206d6d805fb266
MD5 567088d3013ac44bc25ad9f0fcffdfe6
SHA1 7f09f77ffa032ca245e3e0fbaa631695c72f4077
SHA512 800b048ad6540d7695cf088c0cadc5f9c64c1e2d05221effd83090d1adf6367a877e5dc07bc6ae62ae01d05e0edb8e34ebc545f6d02d27e6c534df2e6c969b8e
SSDEEP 12288:yrWxQir2iNR27toeMPVRST1qwm508eIjEgmUlIsbQN5DjNAiS/x1aHkVojcHrrJ3:yAr13aHMtY50lEUIiYAZxQX4HrJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook mgah rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

mgah

Decoy

Ga/EQGhABsbQ5owg2G/5oPZnI2A=
/3iTRooxSOJyM/D+2s12Yy9gTw==
3GSDD14Chww6H7zCmD9ynHmX
Taq4VrZPNAxl7eUe34Q=
3jAUg3OGzE9b/rLrwYKXqlyLPJTioHvYGg==
pyI17hAyA7tR+pso13D+ovZnI2A=
iQidpK8EE4ruTAEv
VoC+z/xSCeNxEcfl4A==
fNqiP5k6xGW8GMoEz2p9sQ==
UX434OsCal7/0Yg=
GZGI9uo1sTqPBaTYnn13rg==
oypWAhpp+ZigRPUVpC1JtYDeV+LP
UJJ25dHwenIU7JM=
FoUiKRg6Jq8387VRFNpzlQ1BRw==
M5P2HBpCkk2qMPQl
6XMKM2j9QQAjOODfDf5tJ8Tp4mg=
icSTi3uo8bndiBUiIfwglQ1BRw==
MF6VwSbQ5av73I4=
cOqgfcgJaQBKrUa9szY8
FYJpLJEcOxwyGcTenNR1bfZnI2A=
ngIMnKgGjxspxmnWcTc/
v+SiSqgxmAoyBejv9w==
wFHlqdJIvUhiGhUYC4o=
7UacDaC5lrbR/JY=
Mlb4eqKTnav73I4=
seiK/sLCEVOABejv9w==
OMDdaW7ATdrjtm2TayJynHmX
JGJNwcIasDKOVAPL0JU=
A1Q30Q269MVj7KbZnn13rg==
qTJD6wQlANB/Ecfl4A==
syUlpaPndwIsBejv9w==
jidIsdtm/Mzuii8//rGrGxAj5kpJrw==
GqtMZFxyrr8K5ow=
mB+eqQBfrlt2nbyDxuA7aG8=
wRoFfITXZwwhwmjWcTc/
N1ilv+wiEaI+AbgEx1obzWc=
ieI0Wkxpq4IY9aU/DuA7aG8=
9A7IV1y5Vub+5JfJ4aPw8szj5mg=
wC6rveZs2nF9Bg2DfgMi
Tnc81fNpYvSNEcfl4A==
RnUi4zuKWR2pBejv9w==
HZsbJh5Hkav73I4=
0UbB3RO8PcfellvWcTc/
/jf6e6YPlrbR/JY=
MYNo29AZoQ8rBejv9w==
BzfyY5E40mJpJekHkiVynHmX
C5wpUWhtmGaQRBXl6Q==
hNrXcqxEYiYwBejv9w==
JXN8E3QbTYKqMPQl
+joZsPSXu4klsXKXcQIkaPco+jospQ==
Oqok8lLwsMjV5A==
tvq2OX3KFe++bwEn
2gg/X8serMDg7g==
p+ylUbJSnFFnYgGbWQyNgXY=
2TeDgb1cf0Q1nq3WcTc/
ltrHPydMxFJZDJ25kDpf43+gX30=
g8STMYgttUZnOeL46YMgKvZnI2A=
T4cd3cMnJZM=
0yIKqc0MhAli9Kfb6g==
HXYAIojXwLsnPPEj
IWWOpgKptkLRUSzFzpU=
RJt0BkGnbwYp
f5xR4+H/ZwkoBKqmbSdynHmX
yOzpXdIesMjV5A==
maanshanbiyang.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1512 set thread context of 1704	1512	567088d3013ac44bc25ad9f0fcffdfe6.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1704	567088d3013ac44bc25ad9f0fcffdfe6.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 1704	1512	567088d3013ac44bc25ad9f0fcffdfe6.exe	27
PID 1512 wrote to memory of 1704	1512	567088d3013ac44bc25ad9f0fcffdfe6.exe	27
PID 1512 wrote to memory of 1704	1512	567088d3013ac44bc25ad9f0fcffdfe6.exe	27
PID 1512 wrote to memory of 1704	1512	567088d3013ac44bc25ad9f0fcffdfe6.exe	27
PID 1512 wrote to memory of 1704	1512	567088d3013ac44bc25ad9f0fcffdfe6.exe	27
PID 1512 wrote to memory of 1704	1512	567088d3013ac44bc25ad9f0fcffdfe6.exe	27
PID 1512 wrote to memory of 1704	1512	567088d3013ac44bc25ad9f0fcffdfe6.exe	27

C:\Users\Admin\AppData\Local\Temp\567088d3013ac44bc25ad9f0fcffdfe6.exe
"C:\Users\Admin\AppData\Local\Temp\567088d3013ac44bc25ad9f0fcffdfe6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Users\Admin\AppData\Local\Temp\567088d3013ac44bc25ad9f0fcffdfe6.exe
  "C:\Users\Admin\AppData\Local\Temp\567088d3013ac44bc25ad9f0fcffdfe6.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1512-54-0x0000000000C20000-0x0000000000CF2000-memory.dmp

Download

memory/1512-55-0x00000000756A1000-0x00000000756A3000-memory.dmp

Download

memory/1512-56-0x0000000000790000-0x00000000007A2000-memory.dmp

Download

memory/1512-57-0x00000000009E0000-0x00000000009EC000-memory.dmp

Download

memory/1512-58-0x0000000004E70000-0x0000000004EFE000-memory.dmp

Download

memory/1512-59-0x0000000004880000-0x00000000048D6000-memory.dmp

Download

memory/1704-60-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1704-61-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1704-63-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1704-66-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1704-67-0x0000000000401000-0x000000000042F000-memory.dmp

Download

memory/1704-68-0x00000000008C0000-0x0000000000BC3000-memory.dmp

Download