formbook | 40bec545f9b01c4438a75cb03d902cc70c65ce8ecf90ecb1fb88aeb00b2c92cc

Analysis

max time kernel
142s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2022 18:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

40bec545f9b01c4438a75cb03d902cc70c65ce8ecf90ecb1fb88aeb00b2c92cc.exe
Size

394KB
MD5

212f0a0a7237ab09c82f6153361ac1b0
SHA1

1b84fff6041a1700f34c80a6e737e8e8c80d5770
SHA256

40bec545f9b01c4438a75cb03d902cc70c65ce8ecf90ecb1fb88aeb00b2c92cc
SHA512

232d6573a5801af940f13f97adae7f6d7a7cd38a3b61b190437f666387508db5668df77db980de3b911e2dab806587f9a486ccab5887a50f27efabb538ade348
SSDEEP

12288:U1zgVlrWHFZED24Ug/Q50b4Qhw+hjcnUgtICxs3IEeC:U1zgVlrWHwi4+5Y4WzhjcnUgXpE

Score

10^/10

formbook ykj rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ykj

Decoy

polovnitelefoni.net

cateless.com

newbeginnings.club

quanghoagroup.com

pcbet0.com

normal.computer

yoinkyoink.com

lahorekabob.com

charnal-voices.com

hotsleepspot.com

thekashmirfabrics.com

upholsteryormondbeach.com

caramel-lefilm.com

pkitales.com

truancyclub.com

susanmathason.com

sweetlimenail.com

vaaudiotechnic.site

edem-agency.com

rakkonoteineinakurashi.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1352-139-0x0000000000400000-0x000000000042E000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

40bec545f9b01c4438a75cb03d902cc70c65ce8ecf90ecb1fb88aeb00b2c92cc.exe

description	pid	process	target process
PID 3520 set thread context of 1352	3520	40bec545f9b01c4438a75cb03d902cc70c65ce8ecf90ecb1fb88aeb00b2c92cc.exe	40bec545f9b01c4438a75cb03d902cc70c65ce8ecf90ecb1fb88aeb00b2c92cc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

40bec545f9b01c4438a75cb03d902cc70c65ce8ecf90ecb1fb88aeb00b2c92cc.exe

pid	process
1352	40bec545f9b01c4438a75cb03d902cc70c65ce8ecf90ecb1fb88aeb00b2c92cc.exe
1352	40bec545f9b01c4438a75cb03d902cc70c65ce8ecf90ecb1fb88aeb00b2c92cc.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

40bec545f9b01c4438a75cb03d902cc70c65ce8ecf90ecb1fb88aeb00b2c92cc.exe

description	pid	process	target process
PID 3520 wrote to memory of 1352	3520	40bec545f9b01c4438a75cb03d902cc70c65ce8ecf90ecb1fb88aeb00b2c92cc.exe	40bec545f9b01c4438a75cb03d902cc70c65ce8ecf90ecb1fb88aeb00b2c92cc.exe
PID 3520 wrote to memory of 1352	3520	40bec545f9b01c4438a75cb03d902cc70c65ce8ecf90ecb1fb88aeb00b2c92cc.exe	40bec545f9b01c4438a75cb03d902cc70c65ce8ecf90ecb1fb88aeb00b2c92cc.exe
PID 3520 wrote to memory of 1352	3520	40bec545f9b01c4438a75cb03d902cc70c65ce8ecf90ecb1fb88aeb00b2c92cc.exe	40bec545f9b01c4438a75cb03d902cc70c65ce8ecf90ecb1fb88aeb00b2c92cc.exe
PID 3520 wrote to memory of 1352	3520	40bec545f9b01c4438a75cb03d902cc70c65ce8ecf90ecb1fb88aeb00b2c92cc.exe	40bec545f9b01c4438a75cb03d902cc70c65ce8ecf90ecb1fb88aeb00b2c92cc.exe
PID 3520 wrote to memory of 1352	3520	40bec545f9b01c4438a75cb03d902cc70c65ce8ecf90ecb1fb88aeb00b2c92cc.exe	40bec545f9b01c4438a75cb03d902cc70c65ce8ecf90ecb1fb88aeb00b2c92cc.exe
PID 3520 wrote to memory of 1352	3520	40bec545f9b01c4438a75cb03d902cc70c65ce8ecf90ecb1fb88aeb00b2c92cc.exe	40bec545f9b01c4438a75cb03d902cc70c65ce8ecf90ecb1fb88aeb00b2c92cc.exe

C:\Users\Admin\AppData\Local\Temp\40bec545f9b01c4438a75cb03d902cc70c65ce8ecf90ecb1fb88aeb00b2c92cc.exe
"C:\Users\Admin\AppData\Local\Temp\40bec545f9b01c4438a75cb03d902cc70c65ce8ecf90ecb1fb88aeb00b2c92cc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3520

C:\Users\Admin\AppData\Local\Temp\40bec545f9b01c4438a75cb03d902cc70c65ce8ecf90ecb1fb88aeb00b2c92cc.exe
"C:\Users\Admin\AppData\Local\Temp\40bec545f9b01c4438a75cb03d902cc70c65ce8ecf90ecb1fb88aeb00b2c92cc.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1352

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1352-138-0x0000000000000000-mapping.dmp

Download
memory/1352-139-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1352-140-0x0000000001900000-0x0000000001C4A000-memory.dmp

Filesize
3.3MB

Download
memory/3520-132-0x0000000000320000-0x0000000000388000-memory.dmp

Filesize
416KB

Download
memory/3520-133-0x0000000004C00000-0x0000000004C9C000-memory.dmp

Filesize
624KB

Download
memory/3520-134-0x0000000005250000-0x00000000057F4000-memory.dmp

Filesize
5.6MB

Download
memory/3520-135-0x0000000004D40000-0x0000000004DD2000-memory.dmp

Filesize
584KB

Download
memory/3520-136-0x0000000004CA0000-0x0000000004CAA000-memory.dmp

Filesize
40KB

Download
memory/3520-137-0x0000000004ED0000-0x0000000004F26000-memory.dmp

Filesize
344KB

Download