formbook | 01ff3a6ce715226b103f3bf80bdb44737fc8bccd38119a7372d8cdcfd3b034c7

Analysis

max time kernel
47s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 10:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01ff3a6ce715226b103f3bf80bdb44737fc8bccd38119a7372d8cdcfd3b034c7.exe
Size

815KB
MD5

d0c93e0d31223227c2fc2c0fcaaedc55
SHA1

da95e18dc3d6e7ac2cf4cd5d5921f26b4a5ee7f2
SHA256

01ff3a6ce715226b103f3bf80bdb44737fc8bccd38119a7372d8cdcfd3b034c7
SHA512

6578f8268f52b8aee586db59e1000b4ded52fb84f8c9b45e44112306469217c9467a8abc3002124f4e1ea6f02ba220276b90972f953fcb0883c771dde1ab8376
SSDEEP

12288:rSWjCds6ggCGMqJPdmqnHaGg2R31UQjTYTSIg95lvTHRyoY:Hugf+VnHadk1Uu0TSIgvpjRpY

Score

10^/10

formbook bmr1 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

bmr1

Decoy

q05YNsJC4MpYLGAf4A==

6KUzKCvwX0fwzrFQXvlucw==

KA4ZibW1w+hWN5Q=

TfgNq18tIWtsM7h+DexncQ==

zspNqjUKBdJVHTkiMMXJYeF7G53bVvMPoA==

hopQr+b8KzPIbMWvw0Yxir6cyw==

2thmt+17FR/MVsakbM/+w3xGOhopJw==

5gO5gfA6jwna/4FNSPqrvvHyr2A=

kqtr0wr9KaOXVMyDDexncQ==

PNldyz0Boa5cLGAf4A==

Gysor7fqabd0UzTwWp3Zir6cyw==

pMRgV18gtLorB21prX4=

ukpf+vu2u+hWN5Q=

pcS/rO+KmPMj69G9cMHnoSEm59cbIQ==

4fWGzv347bFNDYJeeIHKG5co

WXlRyM2Yn+4Ab1EgRAFHWdGDCzf1

ZPoM+2U1cwMzteOBsHY=

o8jQoNron4sT3A/KomE=

7QX8tTpv/A+YKw==

wFvmV8SY/A+YKw==

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

01ff3a6ce715226b103f3bf80bdb44737fc8bccd38119a7372d8cdcfd3b034c7.exe

description	pid	process	target process
PID 960 set thread context of 592	960	01ff3a6ce715226b103f3bf80bdb44737fc8bccd38119a7372d8cdcfd3b034c7.exe	01ff3a6ce715226b103f3bf80bdb44737fc8bccd38119a7372d8cdcfd3b034c7.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

01ff3a6ce715226b103f3bf80bdb44737fc8bccd38119a7372d8cdcfd3b034c7.exe

pid process

592 01ff3a6ce715226b103f3bf80bdb44737fc8bccd38119a7372d8cdcfd3b034c7.exe

pid	process
592	01ff3a6ce715226b103f3bf80bdb44737fc8bccd38119a7372d8cdcfd3b034c7.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

01ff3a6ce715226b103f3bf80bdb44737fc8bccd38119a7372d8cdcfd3b034c7.exe

description	pid	process	target process
PID 960 wrote to memory of 592	960	01ff3a6ce715226b103f3bf80bdb44737fc8bccd38119a7372d8cdcfd3b034c7.exe	01ff3a6ce715226b103f3bf80bdb44737fc8bccd38119a7372d8cdcfd3b034c7.exe
PID 960 wrote to memory of 592	960	01ff3a6ce715226b103f3bf80bdb44737fc8bccd38119a7372d8cdcfd3b034c7.exe	01ff3a6ce715226b103f3bf80bdb44737fc8bccd38119a7372d8cdcfd3b034c7.exe
PID 960 wrote to memory of 592	960	01ff3a6ce715226b103f3bf80bdb44737fc8bccd38119a7372d8cdcfd3b034c7.exe	01ff3a6ce715226b103f3bf80bdb44737fc8bccd38119a7372d8cdcfd3b034c7.exe
PID 960 wrote to memory of 592	960	01ff3a6ce715226b103f3bf80bdb44737fc8bccd38119a7372d8cdcfd3b034c7.exe	01ff3a6ce715226b103f3bf80bdb44737fc8bccd38119a7372d8cdcfd3b034c7.exe
PID 960 wrote to memory of 592	960	01ff3a6ce715226b103f3bf80bdb44737fc8bccd38119a7372d8cdcfd3b034c7.exe	01ff3a6ce715226b103f3bf80bdb44737fc8bccd38119a7372d8cdcfd3b034c7.exe
PID 960 wrote to memory of 592	960	01ff3a6ce715226b103f3bf80bdb44737fc8bccd38119a7372d8cdcfd3b034c7.exe	01ff3a6ce715226b103f3bf80bdb44737fc8bccd38119a7372d8cdcfd3b034c7.exe
PID 960 wrote to memory of 592	960	01ff3a6ce715226b103f3bf80bdb44737fc8bccd38119a7372d8cdcfd3b034c7.exe	01ff3a6ce715226b103f3bf80bdb44737fc8bccd38119a7372d8cdcfd3b034c7.exe

C:\Users\Admin\AppData\Local\Temp\01ff3a6ce715226b103f3bf80bdb44737fc8bccd38119a7372d8cdcfd3b034c7.exe
"C:\Users\Admin\AppData\Local\Temp\01ff3a6ce715226b103f3bf80bdb44737fc8bccd38119a7372d8cdcfd3b034c7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:960

C:\Users\Admin\AppData\Local\Temp\01ff3a6ce715226b103f3bf80bdb44737fc8bccd38119a7372d8cdcfd3b034c7.exe
"C:\Users\Admin\AppData\Local\Temp\01ff3a6ce715226b103f3bf80bdb44737fc8bccd38119a7372d8cdcfd3b034c7.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:592

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/592-64-0x00000000004012B0-mapping.dmp

Download
memory/592-60-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/592-61-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/592-63-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/592-66-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/592-67-0x0000000000401000-0x000000000042F000-memory.dmp

Filesize
184KB

Download
memory/592-68-0x0000000000A60000-0x0000000000D63000-memory.dmp

Filesize
3.0MB

Download
memory/960-55-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download
memory/960-56-0x00000000005C0000-0x00000000005D6000-memory.dmp

Filesize
88KB

Download
memory/960-57-0x0000000000800000-0x000000000080E000-memory.dmp

Filesize
56KB

Download
memory/960-58-0x0000000005970000-0x00000000059E0000-memory.dmp

Filesize
448KB

Download
memory/960-59-0x0000000000A90000-0x0000000000AC4000-memory.dmp

Filesize
208KB

Download
memory/960-54-0x00000000000C0000-0x0000000000192000-memory.dmp

Filesize
840KB

Download