formbook | 1e99e3ef6027ed7a0f49f67796042a0ff2b303c120bf8720901387d9a71542fe

Analysis

max time kernel
117s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30-11-2022 12:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1e99e3ef6027ed7a0f49f67796042a0ff2b303c120bf8720901387d9a71542fe.exe
Size

526KB
MD5

53b73e4b80ef2f787b81ef94a9e8a0a9
SHA1

59a4562f2eba9df1e56541fe4f0240e77a8f57ce
SHA256

1e99e3ef6027ed7a0f49f67796042a0ff2b303c120bf8720901387d9a71542fe
SHA512

6afb8a02eaf4f1d52ae63c0a766ad6c7799014aa78c2292ef965978410d6b211ef4abe69dfaa72d2d2d990d7162770996ea3f29540a92b3b29b73887bc9d3b1e
SSDEEP

12288:XCT/rgEZ+h8gzlj4kayHe5uvPBD0j1XFumjhUErq1/Uo2IOpgE/oRegM:g/rgZhflj4jy/vPij1XFu4iEm1/UvIOb

Score

10^/10

formbook r16 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

3.9

Campaign

r16

Decoy

kingshero.net

coinhoue.com

brittanysanddejuanswedding.com

jerseysvipsmall.com

moderneserviezen.com

nyccustody.com

2bj9yzli.biz

azure-documentation.com

alomin1.com

mybluemedsupp.com

cumbera.com

hurricaneirma-claims.com

supportsupportcases.com

safenurses.com

xedxs.com

cosck.net

activekarpaty.com

cbdoilsc.com

kejadigital.com

metalportasbh.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1896-62-0x0000000000400000-0x000000000042A000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

1e99e3ef6027ed7a0f49f67796042a0ff2b303c120bf8720901387d9a71542fe.exe

description	pid	process	target process
PID 1900 set thread context of 1896	1900	1e99e3ef6027ed7a0f49f67796042a0ff2b303c120bf8720901387d9a71542fe.exe	1e99e3ef6027ed7a0f49f67796042a0ff2b303c120bf8720901387d9a71542fe.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

1e99e3ef6027ed7a0f49f67796042a0ff2b303c120bf8720901387d9a71542fe.exe

pid process

1896 1e99e3ef6027ed7a0f49f67796042a0ff2b303c120bf8720901387d9a71542fe.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

1e99e3ef6027ed7a0f49f67796042a0ff2b303c120bf8720901387d9a71542fe.exe

pid process

1900 1e99e3ef6027ed7a0f49f67796042a0ff2b303c120bf8720901387d9a71542fe.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

1e99e3ef6027ed7a0f49f67796042a0ff2b303c120bf8720901387d9a71542fe.exe

pid process

1896 1e99e3ef6027ed7a0f49f67796042a0ff2b303c120bf8720901387d9a71542fe.exe

pid	process
1896	1e99e3ef6027ed7a0f49f67796042a0ff2b303c120bf8720901387d9a71542fe.exe

pid	process
1900	1e99e3ef6027ed7a0f49f67796042a0ff2b303c120bf8720901387d9a71542fe.exe

pid	process
1896	1e99e3ef6027ed7a0f49f67796042a0ff2b303c120bf8720901387d9a71542fe.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1e99e3ef6027ed7a0f49f67796042a0ff2b303c120bf8720901387d9a71542fe.exe

description	pid	process	target process
PID 1900 wrote to memory of 1896	1900	1e99e3ef6027ed7a0f49f67796042a0ff2b303c120bf8720901387d9a71542fe.exe	1e99e3ef6027ed7a0f49f67796042a0ff2b303c120bf8720901387d9a71542fe.exe
PID 1900 wrote to memory of 1896	1900	1e99e3ef6027ed7a0f49f67796042a0ff2b303c120bf8720901387d9a71542fe.exe	1e99e3ef6027ed7a0f49f67796042a0ff2b303c120bf8720901387d9a71542fe.exe
PID 1900 wrote to memory of 1896	1900	1e99e3ef6027ed7a0f49f67796042a0ff2b303c120bf8720901387d9a71542fe.exe	1e99e3ef6027ed7a0f49f67796042a0ff2b303c120bf8720901387d9a71542fe.exe
PID 1900 wrote to memory of 1896	1900	1e99e3ef6027ed7a0f49f67796042a0ff2b303c120bf8720901387d9a71542fe.exe	1e99e3ef6027ed7a0f49f67796042a0ff2b303c120bf8720901387d9a71542fe.exe

C:\Users\Admin\AppData\Local\Temp\1e99e3ef6027ed7a0f49f67796042a0ff2b303c120bf8720901387d9a71542fe.exe
"C:\Users\Admin\AppData\Local\Temp\1e99e3ef6027ed7a0f49f67796042a0ff2b303c120bf8720901387d9a71542fe.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1900

C:\Users\Admin\AppData\Local\Temp\1e99e3ef6027ed7a0f49f67796042a0ff2b303c120bf8720901387d9a71542fe.exe
C:\Users\Admin\AppData\Local\Temp\1e99e3ef6027ed7a0f49f67796042a0ff2b303c120bf8720901387d9a71542fe.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:1896

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1896-58-0x00000000004756CE-mapping.dmp

Download
memory/1896-62-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1896-63-0x0000000077010000-0x0000000077190000-memory.dmp

Filesize
1.5MB

Download
memory/1896-64-0x00000000069D0000-0x0000000006CD3000-memory.dmp

Filesize
3.0MB

Download
memory/1900-56-0x0000000000340000-0x0000000000347000-memory.dmp

Filesize
28KB

Download
memory/1900-57-0x0000000075131000-0x0000000075133000-memory.dmp

Filesize
8KB

Download
memory/1900-59-0x0000000077010000-0x0000000077190000-memory.dmp

Filesize
1.5MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads