formbook | c8702255a89a489a0e9dbad263a8f491038191c78a20f6cf57429af09b2c2dda

Analysis

max time kernel
171s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07-12-2022 13:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8702255a89a489a0e9dbad263a8f491038191c78a20f6cf57429af09b2c2dda.exe
Size

807KB
MD5

458132ead8d6b28dc153956a514a2c27
SHA1

434f76cc3ac8fa7f36e1e4c87944eb6036affd3b
SHA256

c8702255a89a489a0e9dbad263a8f491038191c78a20f6cf57429af09b2c2dda
SHA512

3b9d708da96e5ba98bbd7c2b606ef41863928c02c682d604a9f6b76fcad8281ca3e8216a9799d2e6d1c6c514800e1d4f536899c31223a3f205b9cb475ae1fe49
SSDEEP

24576:vr18+L74mBfNUstzokjSU4mpfT6Cm3r8JN:vrEU4mpmCmI

Score

10^/10

formbook g25e rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

g25e

Decoy

2491254125.xyz

hookd.gay

uxmelange.com

startupvision3.com

evanwoosley-reed.com

uspalupdser.info

lx0599.com

grupoiaez.com

londonpapershop.com

cremas.store

risespec.com

olivierverdoyant.com

creatednow.com

epicureanhometreats.com

iqijp.com

vcraftboutique.com

furnaristudios.com

dealsgolf.com

djwoojs.com

boatslave.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1496-138-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

c8702255a89a489a0e9dbad263a8f491038191c78a20f6cf57429af09b2c2dda.exe

description	pid	process	target process
PID 3416 set thread context of 1496	3416	c8702255a89a489a0e9dbad263a8f491038191c78a20f6cf57429af09b2c2dda.exe	c8702255a89a489a0e9dbad263a8f491038191c78a20f6cf57429af09b2c2dda.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

c8702255a89a489a0e9dbad263a8f491038191c78a20f6cf57429af09b2c2dda.exe

pid	process
1496	c8702255a89a489a0e9dbad263a8f491038191c78a20f6cf57429af09b2c2dda.exe
1496	c8702255a89a489a0e9dbad263a8f491038191c78a20f6cf57429af09b2c2dda.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

c8702255a89a489a0e9dbad263a8f491038191c78a20f6cf57429af09b2c2dda.exe

description	pid	process	target process
PID 3416 wrote to memory of 1496	3416	c8702255a89a489a0e9dbad263a8f491038191c78a20f6cf57429af09b2c2dda.exe	c8702255a89a489a0e9dbad263a8f491038191c78a20f6cf57429af09b2c2dda.exe
PID 3416 wrote to memory of 1496	3416	c8702255a89a489a0e9dbad263a8f491038191c78a20f6cf57429af09b2c2dda.exe	c8702255a89a489a0e9dbad263a8f491038191c78a20f6cf57429af09b2c2dda.exe
PID 3416 wrote to memory of 1496	3416	c8702255a89a489a0e9dbad263a8f491038191c78a20f6cf57429af09b2c2dda.exe	c8702255a89a489a0e9dbad263a8f491038191c78a20f6cf57429af09b2c2dda.exe
PID 3416 wrote to memory of 1496	3416	c8702255a89a489a0e9dbad263a8f491038191c78a20f6cf57429af09b2c2dda.exe	c8702255a89a489a0e9dbad263a8f491038191c78a20f6cf57429af09b2c2dda.exe
PID 3416 wrote to memory of 1496	3416	c8702255a89a489a0e9dbad263a8f491038191c78a20f6cf57429af09b2c2dda.exe	c8702255a89a489a0e9dbad263a8f491038191c78a20f6cf57429af09b2c2dda.exe
PID 3416 wrote to memory of 1496	3416	c8702255a89a489a0e9dbad263a8f491038191c78a20f6cf57429af09b2c2dda.exe	c8702255a89a489a0e9dbad263a8f491038191c78a20f6cf57429af09b2c2dda.exe

C:\Users\Admin\AppData\Local\Temp\c8702255a89a489a0e9dbad263a8f491038191c78a20f6cf57429af09b2c2dda.exe
"C:\Users\Admin\AppData\Local\Temp\c8702255a89a489a0e9dbad263a8f491038191c78a20f6cf57429af09b2c2dda.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3416

C:\Users\Admin\AppData\Local\Temp\c8702255a89a489a0e9dbad263a8f491038191c78a20f6cf57429af09b2c2dda.exe
"C:\Users\Admin\AppData\Local\Temp\c8702255a89a489a0e9dbad263a8f491038191c78a20f6cf57429af09b2c2dda.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1496

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1496-137-0x0000000000000000-mapping.dmp

Download
memory/1496-138-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1496-139-0x0000000001800000-0x0000000001B4A000-memory.dmp

Filesize
3.3MB

Download
memory/3416-132-0x0000000000B60000-0x0000000000C30000-memory.dmp

Filesize
832KB

Download
memory/3416-133-0x0000000005990000-0x0000000005F34000-memory.dmp

Filesize
5.6MB

Download
memory/3416-134-0x0000000005480000-0x0000000005512000-memory.dmp

Filesize
584KB

Download
memory/3416-135-0x0000000005470000-0x000000000547A000-memory.dmp

Filesize
40KB

Download
memory/3416-136-0x0000000007D90000-0x0000000007E2C000-memory.dmp

Filesize
624KB

Download