formbook | 7e1f215877d458883e98c874ce1226b561f0ddd5114dad6baef44d66d33a98a6

Analysis

max time kernel
151s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
10-12-2022 09:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7f53b20635e357caab65fc28f8a3667a.exe
Size

948KB
MD5

7f53b20635e357caab65fc28f8a3667a
SHA1

62f910bf47b40a1c9bc578e71ce57aaa3dccd06c
SHA256

7e1f215877d458883e98c874ce1226b561f0ddd5114dad6baef44d66d33a98a6
SHA512

0f55a2fcb97c856bf11f66c3b5bdb77e213e296987886507f4b18e4bc4c53f175b217a2318231a5db60891c43392578610e8d7cea570e0083b07e3053fbb5ff7
SSDEEP

12288:Y2SxFBoGPtdUAyeiHuc+6eiK+6Os0a980pY+ZmBjHUk+qxK3o3:JSzBXl9PiHuFpiK+6Os0U8shZmBHO

Score

10^/10

formbook vr84 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

vr84

Decoy

intouchenergy.co.uk

lalumalkaliram.com

hillgreenholidays.co.uk

fluentliteracy.com

buildingworkerpower.com

by23577.com

gate-ch375019.online

jayess-decor.com

larkslife.com

swsnacks.co.uk

bigturtletiny.com

egggge.xyz

olastore.africa

lightshowsnewengland.com

daily-lox.com

empireoba.com

91302events.com

lawrencecountyfirechiefs.com

abrahamslibrary.com

cleaner365.online

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4328-138-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

7f53b20635e357caab65fc28f8a3667a.exe

description pid process target process

PID 3836 set thread context of 4328 3836 7f53b20635e357caab65fc28f8a3667a.exe 7f53b20635e357caab65fc28f8a3667a.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

7f53b20635e357caab65fc28f8a3667a.exe

pid process

4328 7f53b20635e357caab65fc28f8a3667a.exe
4328 7f53b20635e357caab65fc28f8a3667a.exe

description	pid	process	target process
PID 3836 set thread context of 4328	3836	7f53b20635e357caab65fc28f8a3667a.exe	7f53b20635e357caab65fc28f8a3667a.exe

pid	process
4328	7f53b20635e357caab65fc28f8a3667a.exe
4328	7f53b20635e357caab65fc28f8a3667a.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

7f53b20635e357caab65fc28f8a3667a.exe

description	pid	process	target process
PID 3836 wrote to memory of 4328	3836	7f53b20635e357caab65fc28f8a3667a.exe	7f53b20635e357caab65fc28f8a3667a.exe
PID 3836 wrote to memory of 4328	3836	7f53b20635e357caab65fc28f8a3667a.exe	7f53b20635e357caab65fc28f8a3667a.exe
PID 3836 wrote to memory of 4328	3836	7f53b20635e357caab65fc28f8a3667a.exe	7f53b20635e357caab65fc28f8a3667a.exe
PID 3836 wrote to memory of 4328	3836	7f53b20635e357caab65fc28f8a3667a.exe	7f53b20635e357caab65fc28f8a3667a.exe
PID 3836 wrote to memory of 4328	3836	7f53b20635e357caab65fc28f8a3667a.exe	7f53b20635e357caab65fc28f8a3667a.exe
PID 3836 wrote to memory of 4328	3836	7f53b20635e357caab65fc28f8a3667a.exe	7f53b20635e357caab65fc28f8a3667a.exe

C:\Users\Admin\AppData\Local\Temp\7f53b20635e357caab65fc28f8a3667a.exe
"C:\Users\Admin\AppData\Local\Temp\7f53b20635e357caab65fc28f8a3667a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3836
- C:\Users\Admin\AppData\Local\Temp\7f53b20635e357caab65fc28f8a3667a.exe
  "C:\Users\Admin\AppData\Local\Temp\7f53b20635e357caab65fc28f8a3667a.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4328

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3836-132-0x00000000004E0000-0x00000000005D2000-memory.dmp

Filesize
968KB

Download
memory/3836-133-0x00000000054E0000-0x0000000005A84000-memory.dmp

Filesize
5.6MB

Download
memory/3836-134-0x0000000004FD0000-0x0000000005062000-memory.dmp

Filesize
584KB

Download
memory/3836-135-0x0000000004F70000-0x0000000004F7A000-memory.dmp

Filesize
40KB

Download
memory/3836-136-0x0000000005F40000-0x0000000005FDC000-memory.dmp

Filesize
624KB

Download
memory/4328-137-0x0000000000000000-mapping.dmp

Download
memory/4328-138-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4328-139-0x00000000015E0000-0x000000000192A000-memory.dmp

Filesize
3.3MB

Download