formbook | 268552c2ffe8fbb6b8a2244ce2931ca115a4057d74bfb72fc7ba91b95d95ac63

Analysis

max time kernel
176s
max time network
211s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
07-12-2022 04:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

268552c2ffe8fbb6b8a2244ce2931ca115a4057d74bfb72fc7ba91b95d95ac63.exe
Size

897KB
MD5

bd811d9e445bb6882d2864faaf80f668
SHA1

1ee49be423203c7034a6189b0364abfab6e02036
SHA256

268552c2ffe8fbb6b8a2244ce2931ca115a4057d74bfb72fc7ba91b95d95ac63
SHA512

7f1421afb65de1d60dfe5515a497b9d3c1b4c94f827d85604fa8106c0b69162f4a95463d4dd9c34b1eeb69a55ecdedce175bc938985d5a4b141e6a5b89c202df
SSDEEP

12288:x7oQgKZ/nXt7virmWhlGLaQYI1N6kowFheAjRjWf2yS/nhkehKuk5p/kAJF4JzrM:xLvFhecWf2bky0/P45rAQfWeQkNs

Score

10^/10

formbook w086 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

w086

Decoy

F6jSz+l9QmYXguG/xUipf/6ixrik

cQZre8twfBVOOJgLenGTGA==

pG5kW2/wqwEOCVxZ

KORXeYwt7wF8J3BR

HL0ZdBMjeHet

TR57b4Yi6wJ8J3BR

fRyK2yaqeDRGHiQTTw==

RwhsqfRxABNZS59wenGTGA==

GuZaY4H4ahcWKjUdVg==

I5C4/Wyz3fglj+o=

Te5QPEu3NjZ0P58LenGTGA==

M9YJLwifZIi9pfnj2Nj/kA6+ZlU=

c/JFdRndG8f/HiQTTw==

nMmcD1UjeHet

QWR7+9Rh8/l8J3BR

9MD+BzOyI6mXtM4w6LMyEA==

WABgaYPqdJzl2TviGbdH

02OexRebqj3+U2kXhQ0=

j17M2R3/fQwFHiQTTw==

dQpReYss5/l8J3BR

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

268552c2ffe8fbb6b8a2244ce2931ca115a4057d74bfb72fc7ba91b95d95ac63.exe

description	pid	process	target process
PID 2752 set thread context of 2076	2752	268552c2ffe8fbb6b8a2244ce2931ca115a4057d74bfb72fc7ba91b95d95ac63.exe	268552c2ffe8fbb6b8a2244ce2931ca115a4057d74bfb72fc7ba91b95d95ac63.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

268552c2ffe8fbb6b8a2244ce2931ca115a4057d74bfb72fc7ba91b95d95ac63.exe

pid	process
2076	268552c2ffe8fbb6b8a2244ce2931ca115a4057d74bfb72fc7ba91b95d95ac63.exe
2076	268552c2ffe8fbb6b8a2244ce2931ca115a4057d74bfb72fc7ba91b95d95ac63.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

268552c2ffe8fbb6b8a2244ce2931ca115a4057d74bfb72fc7ba91b95d95ac63.exe

description	pid	process	target process
PID 2752 wrote to memory of 2076	2752	268552c2ffe8fbb6b8a2244ce2931ca115a4057d74bfb72fc7ba91b95d95ac63.exe	268552c2ffe8fbb6b8a2244ce2931ca115a4057d74bfb72fc7ba91b95d95ac63.exe
PID 2752 wrote to memory of 2076	2752	268552c2ffe8fbb6b8a2244ce2931ca115a4057d74bfb72fc7ba91b95d95ac63.exe	268552c2ffe8fbb6b8a2244ce2931ca115a4057d74bfb72fc7ba91b95d95ac63.exe
PID 2752 wrote to memory of 2076	2752	268552c2ffe8fbb6b8a2244ce2931ca115a4057d74bfb72fc7ba91b95d95ac63.exe	268552c2ffe8fbb6b8a2244ce2931ca115a4057d74bfb72fc7ba91b95d95ac63.exe
PID 2752 wrote to memory of 2076	2752	268552c2ffe8fbb6b8a2244ce2931ca115a4057d74bfb72fc7ba91b95d95ac63.exe	268552c2ffe8fbb6b8a2244ce2931ca115a4057d74bfb72fc7ba91b95d95ac63.exe
PID 2752 wrote to memory of 2076	2752	268552c2ffe8fbb6b8a2244ce2931ca115a4057d74bfb72fc7ba91b95d95ac63.exe	268552c2ffe8fbb6b8a2244ce2931ca115a4057d74bfb72fc7ba91b95d95ac63.exe
PID 2752 wrote to memory of 2076	2752	268552c2ffe8fbb6b8a2244ce2931ca115a4057d74bfb72fc7ba91b95d95ac63.exe	268552c2ffe8fbb6b8a2244ce2931ca115a4057d74bfb72fc7ba91b95d95ac63.exe

C:\Users\Admin\AppData\Local\Temp\268552c2ffe8fbb6b8a2244ce2931ca115a4057d74bfb72fc7ba91b95d95ac63.exe
"C:\Users\Admin\AppData\Local\Temp\268552c2ffe8fbb6b8a2244ce2931ca115a4057d74bfb72fc7ba91b95d95ac63.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2752

C:\Users\Admin\AppData\Local\Temp\268552c2ffe8fbb6b8a2244ce2931ca115a4057d74bfb72fc7ba91b95d95ac63.exe
"C:\Users\Admin\AppData\Local\Temp\268552c2ffe8fbb6b8a2244ce2931ca115a4057d74bfb72fc7ba91b95d95ac63.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2076-137-0x0000000000000000-mapping.dmp

Download
memory/2076-138-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2076-140-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2076-141-0x0000000000401000-0x000000000042F000-memory.dmp

Filesize
184KB

Download
memory/2076-142-0x0000000001B20000-0x0000000001E6A000-memory.dmp

Filesize
3.3MB

Download
memory/2752-132-0x0000000000DD0000-0x0000000000EB6000-memory.dmp

Filesize
920KB

Download
memory/2752-133-0x0000000005EB0000-0x0000000006454000-memory.dmp

Filesize
5.6MB

Download
memory/2752-134-0x0000000005900000-0x0000000005992000-memory.dmp

Filesize
584KB

Download
memory/2752-135-0x0000000005850000-0x000000000585A000-memory.dmp

Filesize
40KB

Download
memory/2752-136-0x0000000005B90000-0x0000000005C2C000-memory.dmp

Filesize
624KB

Download