formbook | eb1a15adea4a24e6370ba52b2a47d2e671c642375709d38976b48affd7aa37bd

Analysis

max time kernel
134s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
30-11-2022 13:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eb1a15adea4a24e6370ba52b2a47d2e671c642375709d38976b48affd7aa37bd.exe
Size

764KB
MD5

e13e7a494d841fa3de87bdefebe5f935
SHA1

83475768f36be93a8df4982f68038dcaa7ea0e22
SHA256

eb1a15adea4a24e6370ba52b2a47d2e671c642375709d38976b48affd7aa37bd
SHA512

20ab569f95a5a8c242b244274a31d44cde63dc01a641b038622263beedd8fe44a9b09b3614dfc50dd924317d29680a32119caf0c9e4b1aab0bc76b9924816fde
SSDEEP

12288:mrjm59qCy0agz6hGNffTYcJCs01HPAJVSFa74G1sEfNdYTb7vqQF0srNu4lXjAmB:um5Fy0ae3TYcUSJVSF+4GqEfNdY/

Score

10^/10

formbook 2bg rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

2bg

Decoy

ohhowfluent.com

puppy-pets.com

coquetasybonitas.com

eberhard-pharma.com

dolphinsvs-patriots.com

htsyseq.com

curentcareri.com

syybjd.com

zlandscaping.net

jobsinkc.com

moonlightpcworks.com

greedysafely.com

quarryfinearts.com

gelaidexinli.com

mealsmojo.com

myeyecandybeauty.com

dropshippermillionaire.com

frogrout.life

wordpresschool.com

leggingstore.one

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1484-61-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/1484-62-0x000000000041EB10-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

eb1a15adea4a24e6370ba52b2a47d2e671c642375709d38976b48affd7aa37bd.exe

description	pid	process	target process
PID 1120 set thread context of 1484	1120	eb1a15adea4a24e6370ba52b2a47d2e671c642375709d38976b48affd7aa37bd.exe	eb1a15adea4a24e6370ba52b2a47d2e671c642375709d38976b48affd7aa37bd.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

eb1a15adea4a24e6370ba52b2a47d2e671c642375709d38976b48affd7aa37bd.exe

pid process

1484 eb1a15adea4a24e6370ba52b2a47d2e671c642375709d38976b48affd7aa37bd.exe

pid	process
1484	eb1a15adea4a24e6370ba52b2a47d2e671c642375709d38976b48affd7aa37bd.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

eb1a15adea4a24e6370ba52b2a47d2e671c642375709d38976b48affd7aa37bd.exe

description	pid	process	target process
PID 1120 wrote to memory of 1484	1120	eb1a15adea4a24e6370ba52b2a47d2e671c642375709d38976b48affd7aa37bd.exe	eb1a15adea4a24e6370ba52b2a47d2e671c642375709d38976b48affd7aa37bd.exe
PID 1120 wrote to memory of 1484	1120	eb1a15adea4a24e6370ba52b2a47d2e671c642375709d38976b48affd7aa37bd.exe	eb1a15adea4a24e6370ba52b2a47d2e671c642375709d38976b48affd7aa37bd.exe
PID 1120 wrote to memory of 1484	1120	eb1a15adea4a24e6370ba52b2a47d2e671c642375709d38976b48affd7aa37bd.exe	eb1a15adea4a24e6370ba52b2a47d2e671c642375709d38976b48affd7aa37bd.exe
PID 1120 wrote to memory of 1484	1120	eb1a15adea4a24e6370ba52b2a47d2e671c642375709d38976b48affd7aa37bd.exe	eb1a15adea4a24e6370ba52b2a47d2e671c642375709d38976b48affd7aa37bd.exe
PID 1120 wrote to memory of 1484	1120	eb1a15adea4a24e6370ba52b2a47d2e671c642375709d38976b48affd7aa37bd.exe	eb1a15adea4a24e6370ba52b2a47d2e671c642375709d38976b48affd7aa37bd.exe
PID 1120 wrote to memory of 1484	1120	eb1a15adea4a24e6370ba52b2a47d2e671c642375709d38976b48affd7aa37bd.exe	eb1a15adea4a24e6370ba52b2a47d2e671c642375709d38976b48affd7aa37bd.exe
PID 1120 wrote to memory of 1484	1120	eb1a15adea4a24e6370ba52b2a47d2e671c642375709d38976b48affd7aa37bd.exe	eb1a15adea4a24e6370ba52b2a47d2e671c642375709d38976b48affd7aa37bd.exe

C:\Users\Admin\AppData\Local\Temp\eb1a15adea4a24e6370ba52b2a47d2e671c642375709d38976b48affd7aa37bd.exe
"C:\Users\Admin\AppData\Local\Temp\eb1a15adea4a24e6370ba52b2a47d2e671c642375709d38976b48affd7aa37bd.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1120
- C:\Users\Admin\AppData\Local\Temp\eb1a15adea4a24e6370ba52b2a47d2e671c642375709d38976b48affd7aa37bd.exe
  "C:\Users\Admin\AppData\Local\Temp\eb1a15adea4a24e6370ba52b2a47d2e671c642375709d38976b48affd7aa37bd.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1484

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1120-54-0x0000000001200000-0x00000000012C6000-memory.dmp

Filesize
792KB

Download
memory/1120-55-0x0000000075291000-0x0000000075293000-memory.dmp

Filesize
8KB

Download
memory/1120-56-0x00000000002D0000-0x00000000002DA000-memory.dmp

Filesize
40KB

Download
memory/1120-57-0x0000000000C00000-0x0000000000C5C000-memory.dmp

Filesize
368KB

Download
memory/1484-58-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1484-59-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1484-61-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1484-62-0x000000000041EB10-mapping.dmp

Download
memory/1484-63-0x00000000008F0000-0x0000000000BF3000-memory.dmp

Filesize
3.0MB

Download