formbook | 40bec545f9b01c4438a75cb03d902cc70c65ce8ecf90ecb1fb88aeb00b2c92cc

Analysis

max time kernel
78s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30-11-2022 18:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

40bec545f9b01c4438a75cb03d902cc70c65ce8ecf90ecb1fb88aeb00b2c92cc.exe
Size

394KB
MD5

212f0a0a7237ab09c82f6153361ac1b0
SHA1

1b84fff6041a1700f34c80a6e737e8e8c80d5770
SHA256

40bec545f9b01c4438a75cb03d902cc70c65ce8ecf90ecb1fb88aeb00b2c92cc
SHA512

232d6573a5801af940f13f97adae7f6d7a7cd38a3b61b190437f666387508db5668df77db980de3b911e2dab806587f9a486ccab5887a50f27efabb538ade348
SSDEEP

12288:U1zgVlrWHFZED24Ug/Q50b4Qhw+hjcnUgtICxs3IEeC:U1zgVlrWHwi4+5Y4WzhjcnUgXpE

Score

10^/10

formbook ykj rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ykj

Decoy

polovnitelefoni.net

cateless.com

newbeginnings.club

quanghoagroup.com

pcbet0.com

normal.computer

yoinkyoink.com

lahorekabob.com

charnal-voices.com

hotsleepspot.com

thekashmirfabrics.com

upholsteryormondbeach.com

caramel-lefilm.com

pkitales.com

truancyclub.com

susanmathason.com

sweetlimenail.com

vaaudiotechnic.site

edem-agency.com

rakkonoteineinakurashi.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1744-62-0x000000000041EB60-mapping.dmp	formbook
behavioral1/memory/1744-61-0x0000000000400000-0x000000000042E000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

40bec545f9b01c4438a75cb03d902cc70c65ce8ecf90ecb1fb88aeb00b2c92cc.exe

description	pid	process	target process
PID 1504 set thread context of 1744	1504	40bec545f9b01c4438a75cb03d902cc70c65ce8ecf90ecb1fb88aeb00b2c92cc.exe	40bec545f9b01c4438a75cb03d902cc70c65ce8ecf90ecb1fb88aeb00b2c92cc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

40bec545f9b01c4438a75cb03d902cc70c65ce8ecf90ecb1fb88aeb00b2c92cc.exe40bec545f9b01c4438a75cb03d902cc70c65ce8ecf90ecb1fb88aeb00b2c92cc.exe

pid	process
1504	40bec545f9b01c4438a75cb03d902cc70c65ce8ecf90ecb1fb88aeb00b2c92cc.exe
1744	40bec545f9b01c4438a75cb03d902cc70c65ce8ecf90ecb1fb88aeb00b2c92cc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

40bec545f9b01c4438a75cb03d902cc70c65ce8ecf90ecb1fb88aeb00b2c92cc.exe

description pid process

Token: SeDebugPrivilege 1504 40bec545f9b01c4438a75cb03d902cc70c65ce8ecf90ecb1fb88aeb00b2c92cc.exe

description	pid	process
Token: SeDebugPrivilege	1504	40bec545f9b01c4438a75cb03d902cc70c65ce8ecf90ecb1fb88aeb00b2c92cc.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

40bec545f9b01c4438a75cb03d902cc70c65ce8ecf90ecb1fb88aeb00b2c92cc.exe

description	pid	process	target process
PID 1504 wrote to memory of 1744	1504	40bec545f9b01c4438a75cb03d902cc70c65ce8ecf90ecb1fb88aeb00b2c92cc.exe	40bec545f9b01c4438a75cb03d902cc70c65ce8ecf90ecb1fb88aeb00b2c92cc.exe
PID 1504 wrote to memory of 1744	1504	40bec545f9b01c4438a75cb03d902cc70c65ce8ecf90ecb1fb88aeb00b2c92cc.exe	40bec545f9b01c4438a75cb03d902cc70c65ce8ecf90ecb1fb88aeb00b2c92cc.exe
PID 1504 wrote to memory of 1744	1504	40bec545f9b01c4438a75cb03d902cc70c65ce8ecf90ecb1fb88aeb00b2c92cc.exe	40bec545f9b01c4438a75cb03d902cc70c65ce8ecf90ecb1fb88aeb00b2c92cc.exe
PID 1504 wrote to memory of 1744	1504	40bec545f9b01c4438a75cb03d902cc70c65ce8ecf90ecb1fb88aeb00b2c92cc.exe	40bec545f9b01c4438a75cb03d902cc70c65ce8ecf90ecb1fb88aeb00b2c92cc.exe
PID 1504 wrote to memory of 1744	1504	40bec545f9b01c4438a75cb03d902cc70c65ce8ecf90ecb1fb88aeb00b2c92cc.exe	40bec545f9b01c4438a75cb03d902cc70c65ce8ecf90ecb1fb88aeb00b2c92cc.exe
PID 1504 wrote to memory of 1744	1504	40bec545f9b01c4438a75cb03d902cc70c65ce8ecf90ecb1fb88aeb00b2c92cc.exe	40bec545f9b01c4438a75cb03d902cc70c65ce8ecf90ecb1fb88aeb00b2c92cc.exe
PID 1504 wrote to memory of 1744	1504	40bec545f9b01c4438a75cb03d902cc70c65ce8ecf90ecb1fb88aeb00b2c92cc.exe	40bec545f9b01c4438a75cb03d902cc70c65ce8ecf90ecb1fb88aeb00b2c92cc.exe

C:\Users\Admin\AppData\Local\Temp\40bec545f9b01c4438a75cb03d902cc70c65ce8ecf90ecb1fb88aeb00b2c92cc.exe
"C:\Users\Admin\AppData\Local\Temp\40bec545f9b01c4438a75cb03d902cc70c65ce8ecf90ecb1fb88aeb00b2c92cc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1504

C:\Users\Admin\AppData\Local\Temp\40bec545f9b01c4438a75cb03d902cc70c65ce8ecf90ecb1fb88aeb00b2c92cc.exe
"C:\Users\Admin\AppData\Local\Temp\40bec545f9b01c4438a75cb03d902cc70c65ce8ecf90ecb1fb88aeb00b2c92cc.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1744

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1504-54-0x00000000010C0000-0x0000000001128000-memory.dmp

Filesize
416KB

Download
memory/1504-55-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download
memory/1504-56-0x0000000000450000-0x000000000045A000-memory.dmp

Filesize
40KB

Download
memory/1504-57-0x0000000004CE0000-0x0000000004D42000-memory.dmp

Filesize
392KB

Download
memory/1744-62-0x000000000041EB60-mapping.dmp

Download
memory/1744-61-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1744-59-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1744-58-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1744-63-0x0000000000840000-0x0000000000B43000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads