formbook | 4d0418d6ed89ac0dd6a7be7b8b73fbf85d69e0823ce8e392398b3ad005d5839f

Analysis

max time kernel
68s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30-11-2022 16:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d0418d6ed89ac0dd6a7be7b8b73fbf85d69e0823ce8e392398b3ad005d5839f.exe
Size

659KB
MD5

20ce27d410e9cb9d9ac96ab615e607c6
SHA1

1132b5764975577b8f26c8b3cf9b2b17aa51a095
SHA256

4d0418d6ed89ac0dd6a7be7b8b73fbf85d69e0823ce8e392398b3ad005d5839f
SHA512

f6c9433178e992feaef4f36807dee4cb2e19e268284f5cb8515b4b217e23aff3c1e35d8ac5fe20908ee4e4d3341e7e7a8cc0dd91af0a7d837d244c5481c6f4b8
SSDEEP

12288:gYxBYG+2AM0TFoei0W+7Bt7NNdO9AbrPJnwJo6UWa3urQ:dxBYiWSe2oBt7Nu23cmWG

Score

10^/10

formbook gbl rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

gbl

Decoy

dx268.com

textbot4you.com

critictable.com

fsclub.info

order-review.com

tkgenergy.com

contavip.info

fashionests.com

sieromart.com

miamimobiletesting.com

oxforhabits.com

yugoslavilk.online

inieenterprises.com

bythebucketfranchise.com

parcelified.com

signalcyclers.com

starryeyedproject.com

proteacherstore.com

horos.tech

bovadaracebook.sucks

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2044-61-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/2044-62-0x000000000041ED20-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

4d0418d6ed89ac0dd6a7be7b8b73fbf85d69e0823ce8e392398b3ad005d5839f.exe

description	pid	process	target process
PID 1520 set thread context of 2044	1520	4d0418d6ed89ac0dd6a7be7b8b73fbf85d69e0823ce8e392398b3ad005d5839f.exe	4d0418d6ed89ac0dd6a7be7b8b73fbf85d69e0823ce8e392398b3ad005d5839f.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

4d0418d6ed89ac0dd6a7be7b8b73fbf85d69e0823ce8e392398b3ad005d5839f.exe

pid process

2044 4d0418d6ed89ac0dd6a7be7b8b73fbf85d69e0823ce8e392398b3ad005d5839f.exe

pid	process
2044	4d0418d6ed89ac0dd6a7be7b8b73fbf85d69e0823ce8e392398b3ad005d5839f.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

4d0418d6ed89ac0dd6a7be7b8b73fbf85d69e0823ce8e392398b3ad005d5839f.exe

description	pid	process	target process
PID 1520 wrote to memory of 2044	1520	4d0418d6ed89ac0dd6a7be7b8b73fbf85d69e0823ce8e392398b3ad005d5839f.exe	4d0418d6ed89ac0dd6a7be7b8b73fbf85d69e0823ce8e392398b3ad005d5839f.exe
PID 1520 wrote to memory of 2044	1520	4d0418d6ed89ac0dd6a7be7b8b73fbf85d69e0823ce8e392398b3ad005d5839f.exe	4d0418d6ed89ac0dd6a7be7b8b73fbf85d69e0823ce8e392398b3ad005d5839f.exe
PID 1520 wrote to memory of 2044	1520	4d0418d6ed89ac0dd6a7be7b8b73fbf85d69e0823ce8e392398b3ad005d5839f.exe	4d0418d6ed89ac0dd6a7be7b8b73fbf85d69e0823ce8e392398b3ad005d5839f.exe
PID 1520 wrote to memory of 2044	1520	4d0418d6ed89ac0dd6a7be7b8b73fbf85d69e0823ce8e392398b3ad005d5839f.exe	4d0418d6ed89ac0dd6a7be7b8b73fbf85d69e0823ce8e392398b3ad005d5839f.exe
PID 1520 wrote to memory of 2044	1520	4d0418d6ed89ac0dd6a7be7b8b73fbf85d69e0823ce8e392398b3ad005d5839f.exe	4d0418d6ed89ac0dd6a7be7b8b73fbf85d69e0823ce8e392398b3ad005d5839f.exe
PID 1520 wrote to memory of 2044	1520	4d0418d6ed89ac0dd6a7be7b8b73fbf85d69e0823ce8e392398b3ad005d5839f.exe	4d0418d6ed89ac0dd6a7be7b8b73fbf85d69e0823ce8e392398b3ad005d5839f.exe
PID 1520 wrote to memory of 2044	1520	4d0418d6ed89ac0dd6a7be7b8b73fbf85d69e0823ce8e392398b3ad005d5839f.exe	4d0418d6ed89ac0dd6a7be7b8b73fbf85d69e0823ce8e392398b3ad005d5839f.exe

C:\Users\Admin\AppData\Local\Temp\4d0418d6ed89ac0dd6a7be7b8b73fbf85d69e0823ce8e392398b3ad005d5839f.exe
"C:\Users\Admin\AppData\Local\Temp\4d0418d6ed89ac0dd6a7be7b8b73fbf85d69e0823ce8e392398b3ad005d5839f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Users\Admin\AppData\Local\Temp\4d0418d6ed89ac0dd6a7be7b8b73fbf85d69e0823ce8e392398b3ad005d5839f.exe
  "C:\Users\Admin\AppData\Local\Temp\4d0418d6ed89ac0dd6a7be7b8b73fbf85d69e0823ce8e392398b3ad005d5839f.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1520-54-0x00000000102C0000-0x000000001036A000-memory.dmp

Filesize
680KB

Download
memory/1520-55-0x0000000074D61000-0x0000000074D63000-memory.dmp

Filesize
8KB

Download
memory/1520-56-0x0000000000640000-0x000000000064A000-memory.dmp

Filesize
40KB

Download
memory/1520-57-0x0000000004930000-0x0000000004994000-memory.dmp

Filesize
400KB

Download
memory/2044-58-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2044-59-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2044-61-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2044-62-0x000000000041ED20-mapping.dmp

Download
memory/2044-63-0x0000000000990000-0x0000000000C93000-memory.dmp

Filesize
3.0MB

Download