formbook | 0b7fdf87eaef4aacb2b9443e59783840acbe87ea018c14af6601c5311261c4ce

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
09-12-2022 02:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b7fdf87eaef4aacb2b9443e59783840acbe87ea018c14af6601c5311261c4ce.exe
Size

913KB
MD5

c0cb8402b1f4d35c839936512ca83cb2
SHA1

a01b85c6f3477d5870508401bf0b4b26cc141608
SHA256

0b7fdf87eaef4aacb2b9443e59783840acbe87ea018c14af6601c5311261c4ce
SHA512

8193a8be758580126ad11eac8981c3cae68c825fe94fb46eee7a1fddf55e64c2acaa2f4fc419d677287e4694a431283861f939e7d2a9b73527f7f436501a8bda
SSDEEP

12288:tre/tfHGthrPoUWqnZL/UX/VbTNZf4H7ZbAyFncrBY:EpHGzrod8UX/VXGMNY

Score

10^/10

formbook k056 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

k056

Decoy

I6ZtzMO4tX+tliE+qt4=

qXwc4gD7yggogn987j5wQsZnc+OhAVE=

nwnBB5b4yZzLwpZtMajutbGT

OPq8wCLHoBNRnmK+wxBDDw==

bTzuol7JkFaHt0Yjm9w=

RVb6jJxpFYSv68mTCxmjAR9EpZc=

gJYxuLCQJ8jpICAakIj5TRIz5d5nAg==

YcNluGLPr6riqCE+qt4=

7tJ2VmdlX7vg97aPDEVtyjjliIg=

oogs8ATrvjR2wK2SEURppMapY0aGKC/Z

rZNRJ05YUdcJNQHYg35h1DjliIg=

fKhsEh/trUJtfzCdkKnAf7g=

RErWQtoPxr3ZgDwd53Sg8K4FuyAbCg==

WmD0j56Vdcb7lWh/svwB

O03oaGRYI2eaNCKTl1KYpv9vXA==

mx7bLs05CuYL16R6NqzutbGT

kNZrspSqg1uq7us=

NyrglqmvhbYmdlnR0J0J

byKycKqcY9f9aQaIyg==

4apJHpfrlofCi0osmHfCAXkglo4=

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

0b7fdf87eaef4aacb2b9443e59783840acbe87ea018c14af6601c5311261c4ce.exe

description	pid	process	target process
PID 4196 set thread context of 1224	4196	0b7fdf87eaef4aacb2b9443e59783840acbe87ea018c14af6601c5311261c4ce.exe	0b7fdf87eaef4aacb2b9443e59783840acbe87ea018c14af6601c5311261c4ce.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

0b7fdf87eaef4aacb2b9443e59783840acbe87ea018c14af6601c5311261c4ce.exe

pid	process
1224	0b7fdf87eaef4aacb2b9443e59783840acbe87ea018c14af6601c5311261c4ce.exe
1224	0b7fdf87eaef4aacb2b9443e59783840acbe87ea018c14af6601c5311261c4ce.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

0b7fdf87eaef4aacb2b9443e59783840acbe87ea018c14af6601c5311261c4ce.exe

description	pid	process	target process
PID 4196 wrote to memory of 1224	4196	0b7fdf87eaef4aacb2b9443e59783840acbe87ea018c14af6601c5311261c4ce.exe	0b7fdf87eaef4aacb2b9443e59783840acbe87ea018c14af6601c5311261c4ce.exe
PID 4196 wrote to memory of 1224	4196	0b7fdf87eaef4aacb2b9443e59783840acbe87ea018c14af6601c5311261c4ce.exe	0b7fdf87eaef4aacb2b9443e59783840acbe87ea018c14af6601c5311261c4ce.exe
PID 4196 wrote to memory of 1224	4196	0b7fdf87eaef4aacb2b9443e59783840acbe87ea018c14af6601c5311261c4ce.exe	0b7fdf87eaef4aacb2b9443e59783840acbe87ea018c14af6601c5311261c4ce.exe
PID 4196 wrote to memory of 1224	4196	0b7fdf87eaef4aacb2b9443e59783840acbe87ea018c14af6601c5311261c4ce.exe	0b7fdf87eaef4aacb2b9443e59783840acbe87ea018c14af6601c5311261c4ce.exe
PID 4196 wrote to memory of 1224	4196	0b7fdf87eaef4aacb2b9443e59783840acbe87ea018c14af6601c5311261c4ce.exe	0b7fdf87eaef4aacb2b9443e59783840acbe87ea018c14af6601c5311261c4ce.exe
PID 4196 wrote to memory of 1224	4196	0b7fdf87eaef4aacb2b9443e59783840acbe87ea018c14af6601c5311261c4ce.exe	0b7fdf87eaef4aacb2b9443e59783840acbe87ea018c14af6601c5311261c4ce.exe

C:\Users\Admin\AppData\Local\Temp\0b7fdf87eaef4aacb2b9443e59783840acbe87ea018c14af6601c5311261c4ce.exe
"C:\Users\Admin\AppData\Local\Temp\0b7fdf87eaef4aacb2b9443e59783840acbe87ea018c14af6601c5311261c4ce.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4196

C:\Users\Admin\AppData\Local\Temp\0b7fdf87eaef4aacb2b9443e59783840acbe87ea018c14af6601c5311261c4ce.exe
"C:\Users\Admin\AppData\Local\Temp\0b7fdf87eaef4aacb2b9443e59783840acbe87ea018c14af6601c5311261c4ce.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1224-138-0x0000000000000000-mapping.dmp

Download
memory/1224-139-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1224-140-0x0000000001930000-0x0000000001C7A000-memory.dmp

Filesize
3.3MB

Download
memory/4196-132-0x0000000000100000-0x00000000001EA000-memory.dmp

Filesize
936KB

Download
memory/4196-133-0x00000000050A0000-0x0000000005644000-memory.dmp

Filesize
5.6MB

Download
memory/4196-134-0x0000000004B90000-0x0000000004C22000-memory.dmp

Filesize
584KB

Download
memory/4196-135-0x0000000004C40000-0x0000000004C4A000-memory.dmp

Filesize
40KB

Download
memory/4196-136-0x00000000088D0000-0x000000000896C000-memory.dmp

Filesize
624KB

Download
memory/4196-137-0x0000000008970000-0x00000000089D6000-memory.dmp

Filesize
408KB

Download