formbook | 4f6677dc3954982a155ebc120a4600225403047689acecaaab00cbed11b7f6d7

Analysis

max time kernel
57s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-12-2022 00:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a17248c6c5c5ffbc978d43dfa4b6a167.exe
Size

552KB
MD5

a17248c6c5c5ffbc978d43dfa4b6a167
SHA1

c99417cb8615416a978cc0b4c9cb90d80928457a
SHA256

4f6677dc3954982a155ebc120a4600225403047689acecaaab00cbed11b7f6d7
SHA512

ecb72869466aa1c9dafd2a75aa3dbb4cbb190bf2b141a1b6f3b91f03f78740ba7abc1492f6ed31cedd85512d08c6ad4aeb09752049ce9362bb714c1df6dfa19b
SSDEEP

12288:Urcq/eKxqvEm8+uqePNAx4EUUu1ovVj9jq:E/eKovE6VePCx4qvh9j

Score

10^/10

formbook b5jr rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

b5jr

Decoy

0de6wt9fDj2VzxFqyWStU2IZ

CEIlhC3/D4QckHwMOdQ=

324+OHk+LFMruPQ9L80=

052Bh/ajSEHVHMVOuQkQ

9DfC8AWAPlfh8P8=

+4Zqgb98ctfC/sT1EK31+8i9zyQ=

fkISYqdAD/gETU1glGl6ow==

muKtqNNZLlfh8P8=

qXtWc7RyEEJcdPkP

uL6XqPW6YUKi4UGNsQ==

iQT57xCknBF0qdAtV/Q88sRX8LzWzoSk

ZzYKFzTOjad8wuY=

D8Va1XR/BkMvcAxaQpofB6Og+yaT

IP7S065oQrQ/yA==

aEIWMUXk4hdw+ClvnoUBL8i9zyQ=

bjoiiSUS4sjYJPQ9L80=

+8Sk90TLmX4nbfdOuQkQ

ukEMGzCnXT/FIMz2n7T8lHIT

JzDsQuW6h3T9UQgzlGl6ow==

ugPgPem5vCmtvzE9q9bIOMN7ow==

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Suspicious use of SetThreadContext 1 IoCs

Processes:

a17248c6c5c5ffbc978d43dfa4b6a167.exe

description pid process target process

PID 1708 set thread context of 1984 1708 a17248c6c5c5ffbc978d43dfa4b6a167.exe a17248c6c5c5ffbc978d43dfa4b6a167.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

a17248c6c5c5ffbc978d43dfa4b6a167.exe

pid process

1984 a17248c6c5c5ffbc978d43dfa4b6a167.exe

description	pid	process	target process
PID 1708 set thread context of 1984	1708	a17248c6c5c5ffbc978d43dfa4b6a167.exe	a17248c6c5c5ffbc978d43dfa4b6a167.exe

pid	process
1984	a17248c6c5c5ffbc978d43dfa4b6a167.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

a17248c6c5c5ffbc978d43dfa4b6a167.exe

description	pid	process	target process
PID 1708 wrote to memory of 1984	1708	a17248c6c5c5ffbc978d43dfa4b6a167.exe	a17248c6c5c5ffbc978d43dfa4b6a167.exe
PID 1708 wrote to memory of 1984	1708	a17248c6c5c5ffbc978d43dfa4b6a167.exe	a17248c6c5c5ffbc978d43dfa4b6a167.exe
PID 1708 wrote to memory of 1984	1708	a17248c6c5c5ffbc978d43dfa4b6a167.exe	a17248c6c5c5ffbc978d43dfa4b6a167.exe
PID 1708 wrote to memory of 1984	1708	a17248c6c5c5ffbc978d43dfa4b6a167.exe	a17248c6c5c5ffbc978d43dfa4b6a167.exe
PID 1708 wrote to memory of 1984	1708	a17248c6c5c5ffbc978d43dfa4b6a167.exe	a17248c6c5c5ffbc978d43dfa4b6a167.exe
PID 1708 wrote to memory of 1984	1708	a17248c6c5c5ffbc978d43dfa4b6a167.exe	a17248c6c5c5ffbc978d43dfa4b6a167.exe
PID 1708 wrote to memory of 1984	1708	a17248c6c5c5ffbc978d43dfa4b6a167.exe	a17248c6c5c5ffbc978d43dfa4b6a167.exe

C:\Users\Admin\AppData\Local\Temp\a17248c6c5c5ffbc978d43dfa4b6a167.exe
"C:\Users\Admin\AppData\Local\Temp\a17248c6c5c5ffbc978d43dfa4b6a167.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1708

C:\Users\Admin\AppData\Local\Temp\a17248c6c5c5ffbc978d43dfa4b6a167.exe
"C:\Users\Admin\AppData\Local\Temp\a17248c6c5c5ffbc978d43dfa4b6a167.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1984

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1708-54-0x00000000010C0000-0x000000000114A000-memory.dmp

Filesize
552KB

Download
memory/1708-55-0x0000000076121000-0x0000000076123000-memory.dmp

Filesize
8KB

Download
memory/1708-56-0x0000000000500000-0x0000000000516000-memory.dmp

Filesize
88KB

Download
memory/1708-57-0x0000000000520000-0x000000000052E000-memory.dmp

Filesize
56KB

Download
memory/1708-58-0x0000000005080000-0x00000000050F0000-memory.dmp

Filesize
448KB

Download
memory/1708-59-0x0000000000F80000-0x0000000000FB4000-memory.dmp

Filesize
208KB

Download
memory/1984-60-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1984-61-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1984-63-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1984-64-0x00000000004012B0-mapping.dmp

Download
memory/1984-66-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1984-67-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/1984-68-0x0000000000A40000-0x0000000000D43000-memory.dmp

Filesize
3.0MB

Download