formbook | 7e1f215877d458883e98c874ce1226b561f0ddd5114dad6baef44d66d33a98a6

Analysis

max time kernel
144s
max time network
148s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
08-12-2022 08:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7e1f215877d458883e98c874ce1226b561f0ddd5114dad6baef44d66d33a98a6.exe
Size

948KB
MD5

7f53b20635e357caab65fc28f8a3667a
SHA1

62f910bf47b40a1c9bc578e71ce57aaa3dccd06c
SHA256

7e1f215877d458883e98c874ce1226b561f0ddd5114dad6baef44d66d33a98a6
SHA512

0f55a2fcb97c856bf11f66c3b5bdb77e213e296987886507f4b18e4bc4c53f175b217a2318231a5db60891c43392578610e8d7cea570e0083b07e3053fbb5ff7
SSDEEP

12288:Y2SxFBoGPtdUAyeiHuc+6eiK+6Os0a980pY+ZmBjHUk+qxK3o3:JSzBXl9PiHuFpiK+6Os0U8shZmBHO

Score

10^/10

formbook vr84 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

vr84

Decoy

intouchenergy.co.uk

lalumalkaliram.com

hillgreenholidays.co.uk

fluentliteracy.com

buildingworkerpower.com

by23577.com

gate-ch375019.online

jayess-decor.com

larkslife.com

swsnacks.co.uk

bigturtletiny.com

egggge.xyz

olastore.africa

lightshowsnewengland.com

daily-lox.com

empireoba.com

91302events.com

lawrencecountyfirechiefs.com

abrahamslibrary.com

cleaner365.online

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/4664-185-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/4664-186-0x000000000041F060-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

7e1f215877d458883e98c874ce1226b561f0ddd5114dad6baef44d66d33a98a6.exe

description	pid	process	target process
PID 3828 set thread context of 4664	3828	7e1f215877d458883e98c874ce1226b561f0ddd5114dad6baef44d66d33a98a6.exe	7e1f215877d458883e98c874ce1226b561f0ddd5114dad6baef44d66d33a98a6.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

7e1f215877d458883e98c874ce1226b561f0ddd5114dad6baef44d66d33a98a6.exe7e1f215877d458883e98c874ce1226b561f0ddd5114dad6baef44d66d33a98a6.exe

pid	process
3828	7e1f215877d458883e98c874ce1226b561f0ddd5114dad6baef44d66d33a98a6.exe
3828	7e1f215877d458883e98c874ce1226b561f0ddd5114dad6baef44d66d33a98a6.exe
4664	7e1f215877d458883e98c874ce1226b561f0ddd5114dad6baef44d66d33a98a6.exe
4664	7e1f215877d458883e98c874ce1226b561f0ddd5114dad6baef44d66d33a98a6.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

7e1f215877d458883e98c874ce1226b561f0ddd5114dad6baef44d66d33a98a6.exe

description pid process

Token: SeDebugPrivilege 3828 7e1f215877d458883e98c874ce1226b561f0ddd5114dad6baef44d66d33a98a6.exe

description	pid	process
Token: SeDebugPrivilege	3828	7e1f215877d458883e98c874ce1226b561f0ddd5114dad6baef44d66d33a98a6.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

7e1f215877d458883e98c874ce1226b561f0ddd5114dad6baef44d66d33a98a6.exe

description	pid	process	target process
PID 3828 wrote to memory of 4632	3828	7e1f215877d458883e98c874ce1226b561f0ddd5114dad6baef44d66d33a98a6.exe	7e1f215877d458883e98c874ce1226b561f0ddd5114dad6baef44d66d33a98a6.exe
PID 3828 wrote to memory of 4632	3828	7e1f215877d458883e98c874ce1226b561f0ddd5114dad6baef44d66d33a98a6.exe	7e1f215877d458883e98c874ce1226b561f0ddd5114dad6baef44d66d33a98a6.exe
PID 3828 wrote to memory of 4632	3828	7e1f215877d458883e98c874ce1226b561f0ddd5114dad6baef44d66d33a98a6.exe	7e1f215877d458883e98c874ce1226b561f0ddd5114dad6baef44d66d33a98a6.exe
PID 3828 wrote to memory of 4664	3828	7e1f215877d458883e98c874ce1226b561f0ddd5114dad6baef44d66d33a98a6.exe	7e1f215877d458883e98c874ce1226b561f0ddd5114dad6baef44d66d33a98a6.exe
PID 3828 wrote to memory of 4664	3828	7e1f215877d458883e98c874ce1226b561f0ddd5114dad6baef44d66d33a98a6.exe	7e1f215877d458883e98c874ce1226b561f0ddd5114dad6baef44d66d33a98a6.exe
PID 3828 wrote to memory of 4664	3828	7e1f215877d458883e98c874ce1226b561f0ddd5114dad6baef44d66d33a98a6.exe	7e1f215877d458883e98c874ce1226b561f0ddd5114dad6baef44d66d33a98a6.exe
PID 3828 wrote to memory of 4664	3828	7e1f215877d458883e98c874ce1226b561f0ddd5114dad6baef44d66d33a98a6.exe	7e1f215877d458883e98c874ce1226b561f0ddd5114dad6baef44d66d33a98a6.exe
PID 3828 wrote to memory of 4664	3828	7e1f215877d458883e98c874ce1226b561f0ddd5114dad6baef44d66d33a98a6.exe	7e1f215877d458883e98c874ce1226b561f0ddd5114dad6baef44d66d33a98a6.exe
PID 3828 wrote to memory of 4664	3828	7e1f215877d458883e98c874ce1226b561f0ddd5114dad6baef44d66d33a98a6.exe	7e1f215877d458883e98c874ce1226b561f0ddd5114dad6baef44d66d33a98a6.exe

C:\Users\Admin\AppData\Local\Temp\7e1f215877d458883e98c874ce1226b561f0ddd5114dad6baef44d66d33a98a6.exe
"C:\Users\Admin\AppData\Local\Temp\7e1f215877d458883e98c874ce1226b561f0ddd5114dad6baef44d66d33a98a6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3828

C:\Users\Admin\AppData\Local\Temp\7e1f215877d458883e98c874ce1226b561f0ddd5114dad6baef44d66d33a98a6.exe
"C:\Users\Admin\AppData\Local\Temp\7e1f215877d458883e98c874ce1226b561f0ddd5114dad6baef44d66d33a98a6.exe"
2⤵
PID:4632

C:\Users\Admin\AppData\Local\Temp\7e1f215877d458883e98c874ce1226b561f0ddd5114dad6baef44d66d33a98a6.exe
"C:\Users\Admin\AppData\Local\Temp\7e1f215877d458883e98c874ce1226b561f0ddd5114dad6baef44d66d33a98a6.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3828-116-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3828-117-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3828-118-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3828-119-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3828-120-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3828-121-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3828-122-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3828-123-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3828-124-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3828-125-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3828-126-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3828-127-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3828-128-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3828-130-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3828-129-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3828-131-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3828-132-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3828-133-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3828-134-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3828-135-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3828-136-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3828-137-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3828-138-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3828-139-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3828-140-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3828-141-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3828-142-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3828-143-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3828-144-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3828-145-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3828-146-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3828-147-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3828-148-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3828-149-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3828-150-0x0000000000FB0000-0x00000000010A2000-memory.dmp

Filesize
968KB

Download
memory/3828-151-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3828-152-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3828-153-0x0000000005F30000-0x000000000642E000-memory.dmp

Filesize
5.0MB

Download
memory/3828-154-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3828-155-0x00000000058D0000-0x0000000005962000-memory.dmp

Filesize
584KB

Download
memory/3828-156-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3828-157-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3828-158-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3828-159-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3828-160-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3828-161-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3828-162-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3828-163-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3828-164-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3828-165-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3828-166-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3828-167-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3828-168-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3828-169-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3828-170-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3828-171-0x00000000058C0000-0x00000000058CA000-memory.dmp

Filesize
40KB

Download
memory/3828-172-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3828-173-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3828-174-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3828-175-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3828-176-0x00000000059E0000-0x0000000005A02000-memory.dmp

Filesize
136KB

Download
memory/3828-177-0x0000000005A10000-0x0000000005A1E000-memory.dmp

Filesize
56KB

Download
memory/3828-178-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3828-179-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3828-180-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/3828-181-0x0000000006650000-0x00000000066C0000-memory.dmp

Filesize
448KB

Download
memory/3828-182-0x0000000006760000-0x00000000067FC000-memory.dmp

Filesize
624KB

Download
memory/3828-183-0x00000000066F0000-0x0000000006724000-memory.dmp

Filesize
208KB

Download
memory/3828-184-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/4664-185-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4664-186-0x000000000041F060-mapping.dmp

Download
memory/4664-187-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/4664-188-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/4664-189-0x0000000077440000-0x00000000775CE000-memory.dmp

Filesize
1.6MB

Download
memory/4664-193-0x0000000001700000-0x0000000001A20000-memory.dmp

Filesize
3.1MB

Download