formbook | 2016-65-0x0000000000400000-0x000000000042F000-memory[.]dmp

General

Target

2016-65-0x0000000000400000-0x000000000042F000-memory.dmp
Size

188KB
MD5

d9c2fb5f1982aea2dc096d323a819b85
SHA1

046ae08508a8449ae76a753d2431bbeb98434d60
SHA256

5811eff354500e6016460d75694d83d39f98853e3b359ebac0abefaabb7011ed
SHA512

6b92829b0a5d5f3eb0cf4a675ba9cb17d7a268aedc5b18cbcb64e0b8e476b464baf67acdfec3a0ae40db3ca366d40a07921f210eedf2e442b68c14fddac6f224
SSDEEP

3072:EkawgkmBuqUEpo3kqQ1ntywCjKLB8VZUeLuG55PzqHOFjy35y3QwW/d:7sDmkX1n8TKLB8QtGPzqyj93C/d

Score

10^/10

rat tc10 formbook

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

tc10

Decoy

mwigyu.com

sepuluholx.com

nsdigitalagency.com

horrorkore.com

santaclaracoimbrakarate.com

myeternalsummer.com

laosmidnight-lotto.com

haremp.xyz

boyace.top

unusualwithdrawal.com

wildflowerkidsri.com

backlitvps.dev

topwellgas.com

k3nnsworld3.com

wanbang.xyz

cntvc.net

sjcamden.church

pussit24.com

claml.com

statisticsturkey.com

Signatures

Formbook family
formbook
Formbook payload 1 IoCs
rat

Processes:

resource yara_rule

sample formbook

resource	yara_rule
sample	formbook

Files

2016-65-0x0000000000400000-0x000000000042F000-memory.dmp
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 180KB - Virtual size: 180KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 180KB - Virtual size: 180KB

.text
Size: 180KB - Virtual size: 180KB