formbook | 5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a

Analysis

max time kernel
48s
max time network
53s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 11:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe
Size

814KB
MD5

eccc5475dd661be20724e6b8a131f664
SHA1

adbd86d7ccdab284d0080f0a08e3d426a8df21b8
SHA256

5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a
SHA512

f61dfbb25c44e9bcc5334b95c1c54c2275876ee50610995dfda2fc6090b9b05e5da66831d288b53e313b6c1aec4b0e24d001792425965914eb03f6d6bdfd19c6
SSDEEP

12288:vFyMNTl159j9G9+a3DY366UqXbAyBWWapIg95lvTHRyoY:3b1XZGAaT56VrAyepIgvpjRpY

Score

10^/10

formbook g28p rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

g28p

Decoy

whhmgs.asia

wellmedcaredirect.net

beggarded.com

wtpjiv.site

todo-celulares.com

parkitny.net

43345.top

pro-genie.com

cwdxz.com

cbc-inc.xyz

healthspots.net

rulil.top

pyramidaudit.solutions

k8sb15.live

hempaware.report

usclink.life

stayefs.net

05262.top

shop-izakaya-jin.com

iccworldcupnews.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1732-63-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1732-64-0x000000000041F100-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe

description	pid	process	target process
PID 1364 set thread context of 1732	1364	5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe	5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe

pid process

1732 5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe

pid	process
1732	5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe

description	pid	process	target process
PID 1364 wrote to memory of 1732	1364	5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe	5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe
PID 1364 wrote to memory of 1732	1364	5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe	5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe
PID 1364 wrote to memory of 1732	1364	5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe	5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe
PID 1364 wrote to memory of 1732	1364	5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe	5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe
PID 1364 wrote to memory of 1732	1364	5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe	5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe
PID 1364 wrote to memory of 1732	1364	5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe	5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe
PID 1364 wrote to memory of 1732	1364	5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe	5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe

C:\Users\Admin\AppData\Local\Temp\5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe
"C:\Users\Admin\AppData\Local\Temp\5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1364

C:\Users\Admin\AppData\Local\Temp\5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe
"C:\Users\Admin\AppData\Local\Temp\5868cacef685463a6d4ff4d34f487d09e844511fd4d0f22b4c7ab00a92a2818a.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1732

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1364-54-0x00000000011D0000-0x00000000012A2000-memory.dmp

Filesize
840KB

Download
memory/1364-55-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/1364-56-0x0000000000300000-0x0000000000316000-memory.dmp

Filesize
88KB

Download
memory/1364-57-0x0000000000320000-0x000000000032E000-memory.dmp

Filesize
56KB

Download
memory/1364-58-0x0000000005B20000-0x0000000005B90000-memory.dmp

Filesize
448KB

Download
memory/1364-59-0x00000000004C0000-0x00000000004F4000-memory.dmp

Filesize
208KB

Download
memory/1732-60-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1732-61-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1732-63-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1732-64-0x000000000041F100-mapping.dmp

Download
memory/1732-65-0x00000000008B0000-0x0000000000BB3000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads