formbook | b5d3713200d78ffa108a19cecc8e5f9e27ca778a72eabc4e038821a1e9d56caa

Analysis

max time kernel
91s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2022 14:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b5d3713200d78ffa108a19cecc8e5f9e27ca778a72eabc4e038821a1e9d56caa.exe
Size

955KB
MD5

91a972c03758ab433f7e7bbde4158e4d
SHA1

b31e8bec1883e2f6d69f0ee8cbfed15454e87c8c
SHA256

b5d3713200d78ffa108a19cecc8e5f9e27ca778a72eabc4e038821a1e9d56caa
SHA512

ccbbfe77338b609f09e5a76f5881e003d4711f8c0e15a9f21fa1b978518bb7a54453be9fa849f3d7d3318bb980c04e8375120965add9fb734b2cc458c438ffca
SSDEEP

12288:1umGKSUdXLIXyKQEy3NbeEOIoWhtfvKtEKu0I:omGKndbIrQEy3NbetsVvnKZI

Score

10^/10

formbook gbr rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

gbr

Decoy

serabet.com

galanggroup.com

zweitmeinung-urologie.com

damsalon.com

binliwine.com

lifeladderindia.com

flyingwranchmanagement.com

tripsandturns.com

3headdesign.com

aluminumfacade.com

toprestau.com

facetreatspa.com

periodrescuekit.com

dbaojian.com

altinotokurtarma.com

gkpelle.com

loguslife.com

treatse.com

lghglzcnkx.net

jawharabh.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1484-139-0x0000000000400000-0x000000000042E000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

b5d3713200d78ffa108a19cecc8e5f9e27ca778a72eabc4e038821a1e9d56caa.exe

description	pid	process	target process
PID 5016 set thread context of 1484	5016	b5d3713200d78ffa108a19cecc8e5f9e27ca778a72eabc4e038821a1e9d56caa.exe	b5d3713200d78ffa108a19cecc8e5f9e27ca778a72eabc4e038821a1e9d56caa.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

b5d3713200d78ffa108a19cecc8e5f9e27ca778a72eabc4e038821a1e9d56caa.exe

pid	process
1484	b5d3713200d78ffa108a19cecc8e5f9e27ca778a72eabc4e038821a1e9d56caa.exe
1484	b5d3713200d78ffa108a19cecc8e5f9e27ca778a72eabc4e038821a1e9d56caa.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

b5d3713200d78ffa108a19cecc8e5f9e27ca778a72eabc4e038821a1e9d56caa.exe

description	pid	process	target process
PID 5016 wrote to memory of 1484	5016	b5d3713200d78ffa108a19cecc8e5f9e27ca778a72eabc4e038821a1e9d56caa.exe	b5d3713200d78ffa108a19cecc8e5f9e27ca778a72eabc4e038821a1e9d56caa.exe
PID 5016 wrote to memory of 1484	5016	b5d3713200d78ffa108a19cecc8e5f9e27ca778a72eabc4e038821a1e9d56caa.exe	b5d3713200d78ffa108a19cecc8e5f9e27ca778a72eabc4e038821a1e9d56caa.exe
PID 5016 wrote to memory of 1484	5016	b5d3713200d78ffa108a19cecc8e5f9e27ca778a72eabc4e038821a1e9d56caa.exe	b5d3713200d78ffa108a19cecc8e5f9e27ca778a72eabc4e038821a1e9d56caa.exe
PID 5016 wrote to memory of 1484	5016	b5d3713200d78ffa108a19cecc8e5f9e27ca778a72eabc4e038821a1e9d56caa.exe	b5d3713200d78ffa108a19cecc8e5f9e27ca778a72eabc4e038821a1e9d56caa.exe
PID 5016 wrote to memory of 1484	5016	b5d3713200d78ffa108a19cecc8e5f9e27ca778a72eabc4e038821a1e9d56caa.exe	b5d3713200d78ffa108a19cecc8e5f9e27ca778a72eabc4e038821a1e9d56caa.exe
PID 5016 wrote to memory of 1484	5016	b5d3713200d78ffa108a19cecc8e5f9e27ca778a72eabc4e038821a1e9d56caa.exe	b5d3713200d78ffa108a19cecc8e5f9e27ca778a72eabc4e038821a1e9d56caa.exe

C:\Users\Admin\AppData\Local\Temp\b5d3713200d78ffa108a19cecc8e5f9e27ca778a72eabc4e038821a1e9d56caa.exe
"C:\Users\Admin\AppData\Local\Temp\b5d3713200d78ffa108a19cecc8e5f9e27ca778a72eabc4e038821a1e9d56caa.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Users\Admin\AppData\Local\Temp\b5d3713200d78ffa108a19cecc8e5f9e27ca778a72eabc4e038821a1e9d56caa.exe
  "C:\Users\Admin\AppData\Local\Temp\b5d3713200d78ffa108a19cecc8e5f9e27ca778a72eabc4e038821a1e9d56caa.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1484

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1484-138-0x0000000000000000-mapping.dmp

Download
memory/1484-139-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1484-140-0x0000000000F50000-0x000000000129A000-memory.dmp

Filesize
3.3MB

Download
memory/5016-132-0x00000000004F0000-0x00000000005E6000-memory.dmp

Filesize
984KB

Download
memory/5016-133-0x0000000004F20000-0x0000000004FBC000-memory.dmp

Filesize
624KB

Download
memory/5016-134-0x00000000055F0000-0x0000000005B94000-memory.dmp

Filesize
5.6MB

Download
memory/5016-135-0x00000000050E0000-0x0000000005172000-memory.dmp

Filesize
584KB

Download
memory/5016-136-0x0000000005020000-0x000000000502A000-memory.dmp

Filesize
40KB

Download
memory/5016-137-0x0000000005270000-0x00000000052C6000-memory.dmp

Filesize
344KB

Download