formbook | d1dd1f80a7b08c0b8ee7c3067df3d35dadc6af79b02761ccf70dfcaa53f76cd7

Analysis

max time kernel
198s
max time network
204s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 21:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d1dd1f80a7b08c0b8ee7c3067df3d35dadc6af79b02761ccf70dfcaa53f76cd7.exe
Size

636KB
MD5

f0d59737a03d771cef9ac6fee3d09943
SHA1

d517eab4a14ce87a8d0a551ca3d046145e739dd5
SHA256

d1dd1f80a7b08c0b8ee7c3067df3d35dadc6af79b02761ccf70dfcaa53f76cd7
SHA512

318b662f312298d5eb8dd6345ad6c96c58bb8fc818268091646d049414e7df96585eaccbd06220beb635725ca25c15f3b4ab7dae06a354054410cdbeb8beed53
SSDEEP

12288:YTczpbKbfu90F4t72M6/nFo0B+aFo7keY528R+:YgFbKie2x4/kZ7kr

Score

10^/10

formbook snky rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

snky

Decoy

AiMFvkl6+A4HEgZ99q5x4naN7lGmvJo=

tvj/KUTKeKgxszIemQ==

DTrTokBrjB5leF4=

tPeTOuIjJPtH

taxtMdIygEdpskxzOQ2ZjoAEeA==

CxLuaKAFRrJyuIqQUPbhZw==

Tn4fapT5kPmk1H0gpXQ=

h5p8hDqGSiRzdSbV

i3lg8tbRNRU6jC9pQSOxzHYZgpbnOKBx

EwbfBo6m+UXU2qaVUPbhZw==

WpeenFSMquJ3xXD1/b43

niV5qTFu3tfmcgrI

fqyyyElbdxWswJ7A

Lh7o92ZOr4ghbwvK

Y2RYMDue4x+KszIemQ==

lN3Y3z5AS85eah1MDvfFQQA=

uq+Oqh8MNRxHOOkqA9lqYEZZhJU=

FEtGDeGnnRoSQEM=

TkMlruotvsmtpFwg6shr03LjwMWGow==

7PGx8hNMep8EMj5Q39dsq16IbbaIrA==

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

d1dd1f80a7b08c0b8ee7c3067df3d35dadc6af79b02761ccf70dfcaa53f76cd7.exe

description	pid	process	target process
PID 1756 set thread context of 2892	1756	d1dd1f80a7b08c0b8ee7c3067df3d35dadc6af79b02761ccf70dfcaa53f76cd7.exe	d1dd1f80a7b08c0b8ee7c3067df3d35dadc6af79b02761ccf70dfcaa53f76cd7.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

d1dd1f80a7b08c0b8ee7c3067df3d35dadc6af79b02761ccf70dfcaa53f76cd7.exe

pid	process
2892	d1dd1f80a7b08c0b8ee7c3067df3d35dadc6af79b02761ccf70dfcaa53f76cd7.exe
2892	d1dd1f80a7b08c0b8ee7c3067df3d35dadc6af79b02761ccf70dfcaa53f76cd7.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

d1dd1f80a7b08c0b8ee7c3067df3d35dadc6af79b02761ccf70dfcaa53f76cd7.exe

description	pid	process	target process
PID 1756 wrote to memory of 2892	1756	d1dd1f80a7b08c0b8ee7c3067df3d35dadc6af79b02761ccf70dfcaa53f76cd7.exe	d1dd1f80a7b08c0b8ee7c3067df3d35dadc6af79b02761ccf70dfcaa53f76cd7.exe
PID 1756 wrote to memory of 2892	1756	d1dd1f80a7b08c0b8ee7c3067df3d35dadc6af79b02761ccf70dfcaa53f76cd7.exe	d1dd1f80a7b08c0b8ee7c3067df3d35dadc6af79b02761ccf70dfcaa53f76cd7.exe
PID 1756 wrote to memory of 2892	1756	d1dd1f80a7b08c0b8ee7c3067df3d35dadc6af79b02761ccf70dfcaa53f76cd7.exe	d1dd1f80a7b08c0b8ee7c3067df3d35dadc6af79b02761ccf70dfcaa53f76cd7.exe
PID 1756 wrote to memory of 2892	1756	d1dd1f80a7b08c0b8ee7c3067df3d35dadc6af79b02761ccf70dfcaa53f76cd7.exe	d1dd1f80a7b08c0b8ee7c3067df3d35dadc6af79b02761ccf70dfcaa53f76cd7.exe
PID 1756 wrote to memory of 2892	1756	d1dd1f80a7b08c0b8ee7c3067df3d35dadc6af79b02761ccf70dfcaa53f76cd7.exe	d1dd1f80a7b08c0b8ee7c3067df3d35dadc6af79b02761ccf70dfcaa53f76cd7.exe
PID 1756 wrote to memory of 2892	1756	d1dd1f80a7b08c0b8ee7c3067df3d35dadc6af79b02761ccf70dfcaa53f76cd7.exe	d1dd1f80a7b08c0b8ee7c3067df3d35dadc6af79b02761ccf70dfcaa53f76cd7.exe

C:\Users\Admin\AppData\Local\Temp\d1dd1f80a7b08c0b8ee7c3067df3d35dadc6af79b02761ccf70dfcaa53f76cd7.exe
"C:\Users\Admin\AppData\Local\Temp\d1dd1f80a7b08c0b8ee7c3067df3d35dadc6af79b02761ccf70dfcaa53f76cd7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1756

C:\Users\Admin\AppData\Local\Temp\d1dd1f80a7b08c0b8ee7c3067df3d35dadc6af79b02761ccf70dfcaa53f76cd7.exe
"C:\Users\Admin\AppData\Local\Temp\d1dd1f80a7b08c0b8ee7c3067df3d35dadc6af79b02761ccf70dfcaa53f76cd7.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1756-132-0x00000000006C0000-0x0000000000766000-memory.dmp

Filesize
664KB

Download
memory/1756-133-0x0000000005600000-0x0000000005BA4000-memory.dmp

Filesize
5.6MB

Download
memory/1756-134-0x0000000005130000-0x00000000051C2000-memory.dmp

Filesize
584KB

Download
memory/1756-135-0x0000000005110000-0x000000000511A000-memory.dmp

Filesize
40KB

Download
memory/1756-136-0x00000000074E0000-0x000000000757C000-memory.dmp

Filesize
624KB

Download
memory/2892-137-0x0000000000000000-mapping.dmp

Download
memory/2892-138-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2892-140-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2892-141-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2892-142-0x0000000001B60000-0x0000000001EAA000-memory.dmp

Filesize
3.3MB

Download