formbook | 17738f933c264f5979a6ea7ddc4e4b4770432f32e3773e4e6b909e3bf3f2cd3c

Analysis

max time kernel
140s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
30-11-2022 12:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17738f933c264f5979a6ea7ddc4e4b4770432f32e3773e4e6b909e3bf3f2cd3c.exe
Size

744KB
MD5

185ee8d153bc97bd21cf3baef478dec0
SHA1

82d941989e8feba6a6c25b8e6812b8e22be51fd3
SHA256

17738f933c264f5979a6ea7ddc4e4b4770432f32e3773e4e6b909e3bf3f2cd3c
SHA512

38de1cff02350f6ac7acc0a3fadb0029c33368465af9b75806fe2627eb12eafbb1fdceea749f37af70263fac04a1ceefc902344eb5b8338eb3f171f6f01d3c41
SSDEEP

12288:TQirjDMcnoE0LtEx6UxNqj+stiD5mKsmlNy53tlRRm/YNUzn:TQuD1t0LtExjqj+wwctmS3t8QN

Score

10^/10

formbook grv rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

grv

Decoy

morganofatlanta.com

vz473.com

hengetelt.com

bailcally.com

virtuosoonline.com

tenthousandli.com

ohanamascota.com

digi-plates.com

prismagtech.com

we-cinema.com

372680.com

smartautoexpert.xyz

mrxzg.com

apartment-brussels.com

reverseincubator.com

linkasean.com

yummicrabva.com

diguchaye.com

reaktorfatura.com

thecatsaysno.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1396-61-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/1396-62-0x000000000041EC20-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

17738f933c264f5979a6ea7ddc4e4b4770432f32e3773e4e6b909e3bf3f2cd3c.exe

description	pid	process	target process
PID 1996 set thread context of 1396	1996	17738f933c264f5979a6ea7ddc4e4b4770432f32e3773e4e6b909e3bf3f2cd3c.exe	17738f933c264f5979a6ea7ddc4e4b4770432f32e3773e4e6b909e3bf3f2cd3c.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

17738f933c264f5979a6ea7ddc4e4b4770432f32e3773e4e6b909e3bf3f2cd3c.exe17738f933c264f5979a6ea7ddc4e4b4770432f32e3773e4e6b909e3bf3f2cd3c.exe

pid	process
1996	17738f933c264f5979a6ea7ddc4e4b4770432f32e3773e4e6b909e3bf3f2cd3c.exe
1996	17738f933c264f5979a6ea7ddc4e4b4770432f32e3773e4e6b909e3bf3f2cd3c.exe
1396	17738f933c264f5979a6ea7ddc4e4b4770432f32e3773e4e6b909e3bf3f2cd3c.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

17738f933c264f5979a6ea7ddc4e4b4770432f32e3773e4e6b909e3bf3f2cd3c.exe

description pid process

Token: SeDebugPrivilege 1996 17738f933c264f5979a6ea7ddc4e4b4770432f32e3773e4e6b909e3bf3f2cd3c.exe

description	pid	process
Token: SeDebugPrivilege	1996	17738f933c264f5979a6ea7ddc4e4b4770432f32e3773e4e6b909e3bf3f2cd3c.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

17738f933c264f5979a6ea7ddc4e4b4770432f32e3773e4e6b909e3bf3f2cd3c.exe

description	pid	process	target process
PID 1996 wrote to memory of 1396	1996	17738f933c264f5979a6ea7ddc4e4b4770432f32e3773e4e6b909e3bf3f2cd3c.exe	17738f933c264f5979a6ea7ddc4e4b4770432f32e3773e4e6b909e3bf3f2cd3c.exe
PID 1996 wrote to memory of 1396	1996	17738f933c264f5979a6ea7ddc4e4b4770432f32e3773e4e6b909e3bf3f2cd3c.exe	17738f933c264f5979a6ea7ddc4e4b4770432f32e3773e4e6b909e3bf3f2cd3c.exe
PID 1996 wrote to memory of 1396	1996	17738f933c264f5979a6ea7ddc4e4b4770432f32e3773e4e6b909e3bf3f2cd3c.exe	17738f933c264f5979a6ea7ddc4e4b4770432f32e3773e4e6b909e3bf3f2cd3c.exe
PID 1996 wrote to memory of 1396	1996	17738f933c264f5979a6ea7ddc4e4b4770432f32e3773e4e6b909e3bf3f2cd3c.exe	17738f933c264f5979a6ea7ddc4e4b4770432f32e3773e4e6b909e3bf3f2cd3c.exe
PID 1996 wrote to memory of 1396	1996	17738f933c264f5979a6ea7ddc4e4b4770432f32e3773e4e6b909e3bf3f2cd3c.exe	17738f933c264f5979a6ea7ddc4e4b4770432f32e3773e4e6b909e3bf3f2cd3c.exe
PID 1996 wrote to memory of 1396	1996	17738f933c264f5979a6ea7ddc4e4b4770432f32e3773e4e6b909e3bf3f2cd3c.exe	17738f933c264f5979a6ea7ddc4e4b4770432f32e3773e4e6b909e3bf3f2cd3c.exe
PID 1996 wrote to memory of 1396	1996	17738f933c264f5979a6ea7ddc4e4b4770432f32e3773e4e6b909e3bf3f2cd3c.exe	17738f933c264f5979a6ea7ddc4e4b4770432f32e3773e4e6b909e3bf3f2cd3c.exe

C:\Users\Admin\AppData\Local\Temp\17738f933c264f5979a6ea7ddc4e4b4770432f32e3773e4e6b909e3bf3f2cd3c.exe
"C:\Users\Admin\AppData\Local\Temp\17738f933c264f5979a6ea7ddc4e4b4770432f32e3773e4e6b909e3bf3f2cd3c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1996

C:\Users\Admin\AppData\Local\Temp\17738f933c264f5979a6ea7ddc4e4b4770432f32e3773e4e6b909e3bf3f2cd3c.exe
"C:\Users\Admin\AppData\Local\Temp\17738f933c264f5979a6ea7ddc4e4b4770432f32e3773e4e6b909e3bf3f2cd3c.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1396

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1396-58-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1396-59-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1396-61-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1396-62-0x000000000041EC20-mapping.dmp

Download
memory/1396-63-0x0000000000920000-0x0000000000C23000-memory.dmp

Filesize
3.0MB

Download
memory/1996-54-0x0000000000CF0000-0x0000000000DB0000-memory.dmp

Filesize
768KB

Download
memory/1996-55-0x0000000075D61000-0x0000000075D63000-memory.dmp

Filesize
8KB

Download
memory/1996-56-0x00000000003B0000-0x00000000003BA000-memory.dmp

Filesize
40KB

Download
memory/1996-57-0x0000000006FC0000-0x0000000007022000-memory.dmp

Filesize
392KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads