formbook | dcc8a16c411d371bf110f3d0bfe6a4224a53810844ef1bc02d3f89f2e02e7c0b

Analysis

max time kernel
100s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30-11-2022 17:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dcc8a16c411d371bf110f3d0bfe6a4224a53810844ef1bc02d3f89f2e02e7c0b.exe
Size

576KB
MD5

4218b9cf266916690af26776acf29627
SHA1

d69e2af929a0d406d7eea8316e9747db1d4a7ff0
SHA256

dcc8a16c411d371bf110f3d0bfe6a4224a53810844ef1bc02d3f89f2e02e7c0b
SHA512

fad04a07efa85b91c64022f0b9b1fefdc80a59cd9127e6c1d750f803e2377c71793f20add0532ab2ed595cc9a98a8c9d522c6c42bc6fc07cfdfd2eddf9954d05
SSDEEP

12288:xWO+lpbKbfO7FoxgcSkgyZyfOL5eJxnS4ta5NG3WlViKY:xWnbKzxgcSkgyZeO0TtWN+

Score

10^/10

formbook dcn0 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

dcn0

Decoy

ZVx68vDtAMBCwg==

oBMBvsNORkM/O/ox

Ff9pISWkm6eG4lByIspp

c2T42c6CIIF6B8xTxm9XzpVw

bvjhxRbnAC183w==

0lTttSNG4HUDNflyIspp

hPXFlstqiHA/O/ox

WLR+MeerxZ0cNn1ja+IQAYo=

IHRn4xXOVKi477zarG+ObSy7YJA=

Xhf3e+tdAC183w==

Xk0ZAezv2rWH

kngo+vBeSRN7AszNwam3Osmguuqc0MoC

a2Qp7a+E8fSw7LDjpnqEKjsRZA==

3zjy4E7+QM48wg==

YcCmqT3OUNAigVott2pBKiy7YJA=

4+SMeX1juat/5cZ1AZihcyy7YJA=

/+m7sro0OBTl3TMpCw==

i2ctEfe4//a64yklMsgS2J90

+loZ2QKGX0UWgpvErMs=

b9BNCnJWQJS8IfsR0uR3bCy7YJA=

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

dcc8a16c411d371bf110f3d0bfe6a4224a53810844ef1bc02d3f89f2e02e7c0b.exe

description	pid	process	target process
PID 1612 set thread context of 1288	1612	dcc8a16c411d371bf110f3d0bfe6a4224a53810844ef1bc02d3f89f2e02e7c0b.exe	dcc8a16c411d371bf110f3d0bfe6a4224a53810844ef1bc02d3f89f2e02e7c0b.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

dcc8a16c411d371bf110f3d0bfe6a4224a53810844ef1bc02d3f89f2e02e7c0b.exe

pid process

1288 dcc8a16c411d371bf110f3d0bfe6a4224a53810844ef1bc02d3f89f2e02e7c0b.exe

pid	process
1288	dcc8a16c411d371bf110f3d0bfe6a4224a53810844ef1bc02d3f89f2e02e7c0b.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

dcc8a16c411d371bf110f3d0bfe6a4224a53810844ef1bc02d3f89f2e02e7c0b.exe

description	pid	process	target process
PID 1612 wrote to memory of 1288	1612	dcc8a16c411d371bf110f3d0bfe6a4224a53810844ef1bc02d3f89f2e02e7c0b.exe	dcc8a16c411d371bf110f3d0bfe6a4224a53810844ef1bc02d3f89f2e02e7c0b.exe
PID 1612 wrote to memory of 1288	1612	dcc8a16c411d371bf110f3d0bfe6a4224a53810844ef1bc02d3f89f2e02e7c0b.exe	dcc8a16c411d371bf110f3d0bfe6a4224a53810844ef1bc02d3f89f2e02e7c0b.exe
PID 1612 wrote to memory of 1288	1612	dcc8a16c411d371bf110f3d0bfe6a4224a53810844ef1bc02d3f89f2e02e7c0b.exe	dcc8a16c411d371bf110f3d0bfe6a4224a53810844ef1bc02d3f89f2e02e7c0b.exe
PID 1612 wrote to memory of 1288	1612	dcc8a16c411d371bf110f3d0bfe6a4224a53810844ef1bc02d3f89f2e02e7c0b.exe	dcc8a16c411d371bf110f3d0bfe6a4224a53810844ef1bc02d3f89f2e02e7c0b.exe
PID 1612 wrote to memory of 1288	1612	dcc8a16c411d371bf110f3d0bfe6a4224a53810844ef1bc02d3f89f2e02e7c0b.exe	dcc8a16c411d371bf110f3d0bfe6a4224a53810844ef1bc02d3f89f2e02e7c0b.exe
PID 1612 wrote to memory of 1288	1612	dcc8a16c411d371bf110f3d0bfe6a4224a53810844ef1bc02d3f89f2e02e7c0b.exe	dcc8a16c411d371bf110f3d0bfe6a4224a53810844ef1bc02d3f89f2e02e7c0b.exe
PID 1612 wrote to memory of 1288	1612	dcc8a16c411d371bf110f3d0bfe6a4224a53810844ef1bc02d3f89f2e02e7c0b.exe	dcc8a16c411d371bf110f3d0bfe6a4224a53810844ef1bc02d3f89f2e02e7c0b.exe

C:\Users\Admin\AppData\Local\Temp\dcc8a16c411d371bf110f3d0bfe6a4224a53810844ef1bc02d3f89f2e02e7c0b.exe
"C:\Users\Admin\AppData\Local\Temp\dcc8a16c411d371bf110f3d0bfe6a4224a53810844ef1bc02d3f89f2e02e7c0b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1612

C:\Users\Admin\AppData\Local\Temp\dcc8a16c411d371bf110f3d0bfe6a4224a53810844ef1bc02d3f89f2e02e7c0b.exe
"C:\Users\Admin\AppData\Local\Temp\dcc8a16c411d371bf110f3d0bfe6a4224a53810844ef1bc02d3f89f2e02e7c0b.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1288

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1288-64-0x00000000004012B0-mapping.dmp

Download
memory/1288-60-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1288-61-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1288-63-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1288-66-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1288-67-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/1288-68-0x0000000000950000-0x0000000000C53000-memory.dmp

Filesize
3.0MB

Download
memory/1612-55-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download
memory/1612-56-0x0000000000530000-0x0000000000546000-memory.dmp

Filesize
88KB

Download
memory/1612-57-0x0000000000880000-0x000000000088E000-memory.dmp

Filesize
56KB

Download
memory/1612-58-0x0000000005420000-0x0000000005490000-memory.dmp

Filesize
448KB

Download
memory/1612-59-0x0000000000A70000-0x0000000000AA4000-memory.dmp

Filesize
208KB

Download
memory/1612-54-0x0000000001130000-0x00000000011C6000-memory.dmp

Filesize
600KB

Download