formbook | 1e99e3ef6027ed7a0f49f67796042a0ff2b303c120bf8720901387d9a71542fe

Analysis

max time kernel
170s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2022 12:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1e99e3ef6027ed7a0f49f67796042a0ff2b303c120bf8720901387d9a71542fe.exe
Size

526KB
MD5

53b73e4b80ef2f787b81ef94a9e8a0a9
SHA1

59a4562f2eba9df1e56541fe4f0240e77a8f57ce
SHA256

1e99e3ef6027ed7a0f49f67796042a0ff2b303c120bf8720901387d9a71542fe
SHA512

6afb8a02eaf4f1d52ae63c0a766ad6c7799014aa78c2292ef965978410d6b211ef4abe69dfaa72d2d2d990d7162770996ea3f29540a92b3b29b73887bc9d3b1e
SSDEEP

12288:XCT/rgEZ+h8gzlj4kayHe5uvPBD0j1XFumjhUErq1/Uo2IOpgE/oRegM:g/rgZhflj4jy/vPij1XFu4iEm1/UvIOb

Score

10^/10

formbook r16 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

3.9

Campaign

r16

Decoy

kingshero.net

coinhoue.com

brittanysanddejuanswedding.com

jerseysvipsmall.com

moderneserviezen.com

nyccustody.com

2bj9yzli.biz

azure-documentation.com

alomin1.com

mybluemedsupp.com

cumbera.com

hurricaneirma-claims.com

supportsupportcases.com

safenurses.com

xedxs.com

cosck.net

activekarpaty.com

cbdoilsc.com

kejadigital.com

metalportasbh.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1144-139-0x0000000000400000-0x000000000042A000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

1e99e3ef6027ed7a0f49f67796042a0ff2b303c120bf8720901387d9a71542fe.exe

description	pid	process	target process
PID 648 set thread context of 1144	648	1e99e3ef6027ed7a0f49f67796042a0ff2b303c120bf8720901387d9a71542fe.exe	1e99e3ef6027ed7a0f49f67796042a0ff2b303c120bf8720901387d9a71542fe.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

1e99e3ef6027ed7a0f49f67796042a0ff2b303c120bf8720901387d9a71542fe.exe

pid	process
1144	1e99e3ef6027ed7a0f49f67796042a0ff2b303c120bf8720901387d9a71542fe.exe
1144	1e99e3ef6027ed7a0f49f67796042a0ff2b303c120bf8720901387d9a71542fe.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

1e99e3ef6027ed7a0f49f67796042a0ff2b303c120bf8720901387d9a71542fe.exe

pid process

648 1e99e3ef6027ed7a0f49f67796042a0ff2b303c120bf8720901387d9a71542fe.exe

pid	process
648	1e99e3ef6027ed7a0f49f67796042a0ff2b303c120bf8720901387d9a71542fe.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

1e99e3ef6027ed7a0f49f67796042a0ff2b303c120bf8720901387d9a71542fe.exe

description	pid	process	target process
PID 648 wrote to memory of 1144	648	1e99e3ef6027ed7a0f49f67796042a0ff2b303c120bf8720901387d9a71542fe.exe	1e99e3ef6027ed7a0f49f67796042a0ff2b303c120bf8720901387d9a71542fe.exe
PID 648 wrote to memory of 1144	648	1e99e3ef6027ed7a0f49f67796042a0ff2b303c120bf8720901387d9a71542fe.exe	1e99e3ef6027ed7a0f49f67796042a0ff2b303c120bf8720901387d9a71542fe.exe
PID 648 wrote to memory of 1144	648	1e99e3ef6027ed7a0f49f67796042a0ff2b303c120bf8720901387d9a71542fe.exe	1e99e3ef6027ed7a0f49f67796042a0ff2b303c120bf8720901387d9a71542fe.exe

C:\Users\Admin\AppData\Local\Temp\1e99e3ef6027ed7a0f49f67796042a0ff2b303c120bf8720901387d9a71542fe.exe
"C:\Users\Admin\AppData\Local\Temp\1e99e3ef6027ed7a0f49f67796042a0ff2b303c120bf8720901387d9a71542fe.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:648

C:\Users\Admin\AppData\Local\Temp\1e99e3ef6027ed7a0f49f67796042a0ff2b303c120bf8720901387d9a71542fe.exe
C:\Users\Admin\AppData\Local\Temp\1e99e3ef6027ed7a0f49f67796042a0ff2b303c120bf8720901387d9a71542fe.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1144

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/648-134-0x00000000031E0000-0x00000000031E7000-memory.dmp

Filesize
28KB

Download
memory/648-136-0x0000000077B20000-0x0000000077CC3000-memory.dmp

Filesize
1.6MB

Download
memory/1144-135-0x0000000000000000-mapping.dmp

Download
memory/1144-137-0x0000000077B20000-0x0000000077CC3000-memory.dmp

Filesize
1.6MB

Download
memory/1144-139-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1144-140-0x0000000077B20000-0x0000000077CC3000-memory.dmp

Filesize
1.6MB

Download
memory/1144-141-0x0000000006DB0000-0x00000000070FA000-memory.dmp

Filesize
3.3MB

Download
memory/1144-142-0x0000000077B20000-0x0000000077CC3000-memory.dmp

Filesize
1.6MB

Download