formbook | 7e31febe07e9ee30b6e6f04fbc58cd1a12c7f95c524ed29ba99e5613886f0369

Analysis

max time kernel
235s
max time network
336s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
30-11-2022 17:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7e31febe07e9ee30b6e6f04fbc58cd1a12c7f95c524ed29ba99e5613886f0369.exe
Size

494KB
MD5

884e261ad3861b83f650deff6c1540a8
SHA1

e0d8597a0b35e2fe4c25d170491a82a6a648c94b
SHA256

7e31febe07e9ee30b6e6f04fbc58cd1a12c7f95c524ed29ba99e5613886f0369
SHA512

fab5bc89269683b2e490aabca6e2b8210c75f27878a2e240a5d71ea8c4e2771eb793857a08409e08fcc2cda831f9f3e947f3ec1ca2412ca0e7652913e5851cf9
SSDEEP

12288:iiz6hG4eAbcvGZbD8sBlGCen9p/MK7mKWMrvdFD9V:AZbDz6C8D6fMrFtH

Score

10^/10

formbook 2bg rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

2bg

Decoy

ohhowfluent.com

puppy-pets.com

coquetasybonitas.com

eberhard-pharma.com

dolphinsvs-patriots.com

htsyseq.com

curentcareri.com

syybjd.com

zlandscaping.net

jobsinkc.com

moonlightpcworks.com

greedysafely.com

quarryfinearts.com

gelaidexinli.com

mealsmojo.com

myeyecandybeauty.com

dropshippermillionaire.com

frogrout.life

wordpresschool.com

leggingstore.one

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/664-61-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/664-62-0x000000000041EB10-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

7e31febe07e9ee30b6e6f04fbc58cd1a12c7f95c524ed29ba99e5613886f0369.exe

description	pid	process	target process
PID 652 set thread context of 664	652	7e31febe07e9ee30b6e6f04fbc58cd1a12c7f95c524ed29ba99e5613886f0369.exe	7e31febe07e9ee30b6e6f04fbc58cd1a12c7f95c524ed29ba99e5613886f0369.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

7e31febe07e9ee30b6e6f04fbc58cd1a12c7f95c524ed29ba99e5613886f0369.exe

pid process

664 7e31febe07e9ee30b6e6f04fbc58cd1a12c7f95c524ed29ba99e5613886f0369.exe

pid	process
664	7e31febe07e9ee30b6e6f04fbc58cd1a12c7f95c524ed29ba99e5613886f0369.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

7e31febe07e9ee30b6e6f04fbc58cd1a12c7f95c524ed29ba99e5613886f0369.exe

description	pid	process	target process
PID 652 wrote to memory of 664	652	7e31febe07e9ee30b6e6f04fbc58cd1a12c7f95c524ed29ba99e5613886f0369.exe	7e31febe07e9ee30b6e6f04fbc58cd1a12c7f95c524ed29ba99e5613886f0369.exe
PID 652 wrote to memory of 664	652	7e31febe07e9ee30b6e6f04fbc58cd1a12c7f95c524ed29ba99e5613886f0369.exe	7e31febe07e9ee30b6e6f04fbc58cd1a12c7f95c524ed29ba99e5613886f0369.exe
PID 652 wrote to memory of 664	652	7e31febe07e9ee30b6e6f04fbc58cd1a12c7f95c524ed29ba99e5613886f0369.exe	7e31febe07e9ee30b6e6f04fbc58cd1a12c7f95c524ed29ba99e5613886f0369.exe
PID 652 wrote to memory of 664	652	7e31febe07e9ee30b6e6f04fbc58cd1a12c7f95c524ed29ba99e5613886f0369.exe	7e31febe07e9ee30b6e6f04fbc58cd1a12c7f95c524ed29ba99e5613886f0369.exe
PID 652 wrote to memory of 664	652	7e31febe07e9ee30b6e6f04fbc58cd1a12c7f95c524ed29ba99e5613886f0369.exe	7e31febe07e9ee30b6e6f04fbc58cd1a12c7f95c524ed29ba99e5613886f0369.exe
PID 652 wrote to memory of 664	652	7e31febe07e9ee30b6e6f04fbc58cd1a12c7f95c524ed29ba99e5613886f0369.exe	7e31febe07e9ee30b6e6f04fbc58cd1a12c7f95c524ed29ba99e5613886f0369.exe
PID 652 wrote to memory of 664	652	7e31febe07e9ee30b6e6f04fbc58cd1a12c7f95c524ed29ba99e5613886f0369.exe	7e31febe07e9ee30b6e6f04fbc58cd1a12c7f95c524ed29ba99e5613886f0369.exe

C:\Users\Admin\AppData\Local\Temp\7e31febe07e9ee30b6e6f04fbc58cd1a12c7f95c524ed29ba99e5613886f0369.exe
"C:\Users\Admin\AppData\Local\Temp\7e31febe07e9ee30b6e6f04fbc58cd1a12c7f95c524ed29ba99e5613886f0369.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:652

C:\Users\Admin\AppData\Local\Temp\7e31febe07e9ee30b6e6f04fbc58cd1a12c7f95c524ed29ba99e5613886f0369.exe
"C:\Users\Admin\AppData\Local\Temp\7e31febe07e9ee30b6e6f04fbc58cd1a12c7f95c524ed29ba99e5613886f0369.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:664

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/652-54-0x0000000000D90000-0x0000000000E12000-memory.dmp

Filesize
520KB

Download
memory/652-55-0x0000000074ED1000-0x0000000074ED3000-memory.dmp

Filesize
8KB

Download
memory/652-56-0x0000000000320000-0x000000000032A000-memory.dmp

Filesize
40KB

Download
memory/652-57-0x0000000000D00000-0x0000000000D5C000-memory.dmp

Filesize
368KB

Download
memory/664-58-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/664-59-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/664-61-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/664-62-0x000000000041EB10-mapping.dmp

Download
memory/664-63-0x0000000000970000-0x0000000000C73000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads