formbook | e61660e229f87b61562735d3d6f44326329b5d9e659198d02de592402984b7c7

Analysis

max time kernel
134s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 19:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e61660e229f87b61562735d3d6f44326329b5d9e659198d02de592402984b7c7.exe
Size

722KB
MD5

33d7ef98d681afdfb0cf7a6fb10bc414
SHA1

b10fe2ecb4031b32266ea16a94a1ba222222930e
SHA256

e61660e229f87b61562735d3d6f44326329b5d9e659198d02de592402984b7c7
SHA512

38c77a3c95ce46b9c9662e33cadd3476bab60be9559d786d034331963b66cdd95ac995445a9983a6aa4197505daa9e04efb2787765fd89e420e550d0d337558b
SSDEEP

12288:Ru5YDtn6Sou9k2x30mRe3Cqk6CHhZ8Wyes1Zo5D82FTtbyh:R4YDt6SP9pxdRe3QRhZ8ws7CvTtbyh

Score

10^/10

formbook ua69 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ua69

Decoy

uslanmayizz.com

rrucrowd.com

nerexy.online

guolang-clan.com

meteleabogados.com

sh-gottipati.com

themesmiui.com

anananlan.com

roghanala.com

yekitiba.com

echoskinco.com

btlpour.xyz

shoyo-samaa.com

fuzzywumpus.net

malerzeit.com

xiam.online

brandibraunalissa.com

cryptominis.pro

we-living.com

dc-invest.online

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/2836-138-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1688 set thread context of 2836	1688	e61660e229f87b61562735d3d6f44326329b5d9e659198d02de592402984b7c7.exe	85

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2836	e61660e229f87b61562735d3d6f44326329b5d9e659198d02de592402984b7c7.exe
2836	e61660e229f87b61562735d3d6f44326329b5d9e659198d02de592402984b7c7.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 2836	1688	e61660e229f87b61562735d3d6f44326329b5d9e659198d02de592402984b7c7.exe	85
PID 1688 wrote to memory of 2836	1688	e61660e229f87b61562735d3d6f44326329b5d9e659198d02de592402984b7c7.exe	85
PID 1688 wrote to memory of 2836	1688	e61660e229f87b61562735d3d6f44326329b5d9e659198d02de592402984b7c7.exe	85
PID 1688 wrote to memory of 2836	1688	e61660e229f87b61562735d3d6f44326329b5d9e659198d02de592402984b7c7.exe	85
PID 1688 wrote to memory of 2836	1688	e61660e229f87b61562735d3d6f44326329b5d9e659198d02de592402984b7c7.exe	85
PID 1688 wrote to memory of 2836	1688	e61660e229f87b61562735d3d6f44326329b5d9e659198d02de592402984b7c7.exe	85

C:\Users\Admin\AppData\Local\Temp\e61660e229f87b61562735d3d6f44326329b5d9e659198d02de592402984b7c7.exe
"C:\Users\Admin\AppData\Local\Temp\e61660e229f87b61562735d3d6f44326329b5d9e659198d02de592402984b7c7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Users\Admin\AppData\Local\Temp\e61660e229f87b61562735d3d6f44326329b5d9e659198d02de592402984b7c7.exe
  "C:\Users\Admin\AppData\Local\Temp\e61660e229f87b61562735d3d6f44326329b5d9e659198d02de592402984b7c7.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2836

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1688-132-0x0000000000490000-0x000000000054A000-memory.dmp

Filesize
744KB

Download
memory/1688-133-0x00000000054F0000-0x0000000005A94000-memory.dmp

Filesize
5.6MB

Download
memory/1688-134-0x0000000004F40000-0x0000000004FD2000-memory.dmp

Filesize
584KB

Download
memory/1688-135-0x0000000004F00000-0x0000000004F0A000-memory.dmp

Filesize
40KB

Download
memory/1688-136-0x0000000007BB0000-0x0000000007C4C000-memory.dmp

Filesize
624KB

Download
memory/2836-138-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2836-139-0x0000000001020000-0x000000000136A000-memory.dmp

Filesize
3.3MB

Download