formbook | 484a773ea467d473190ad7c22e0c28ea84c14198dbfe22599508697c2df5773f

Analysis

max time kernel
43s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
12-12-2022 15:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c797ec1e79935bb4186091dd2497ecb9.exe
Size

902KB
MD5

c797ec1e79935bb4186091dd2497ecb9
SHA1

1183605174d54e31c90641de28693b690c1a7302
SHA256

484a773ea467d473190ad7c22e0c28ea84c14198dbfe22599508697c2df5773f
SHA512

78bc72ab135a9e1e9adca84ebc893c71782e2f4d072ea9b7252892f9200cf45fc3cbb8a2323179e8ab2963a78d616fc8984b6c2f177aa7f089c2542fe25caa6d
SSDEEP

24576:oWXvRemER/Q9GeYovTx4GRO3GxSY67GKTgG:oaGu9GLo7xLw3ASh

Score

10^/10

formbook ng04 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ng04

Decoy

tevimaq.com

easterspecialtystore.com

smartlever.tech

10312.uk

tanjawiharbi.co.uk

471338.com

horusventure.com

empress-care.com

sinrian.com

465951.com

aemsti.com

nxcourier.com

stargatefarms.com

lalyquainvestment.com

dailysportsadvice.com

justlistmoore.com

stoneonroll.online

tatianakolomiets.com

barcodebbm.com

protectorship.world

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/560-63-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/560-64-0x000000000041F020-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

c797ec1e79935bb4186091dd2497ecb9.exe

description pid process target process

PID 1304 set thread context of 560 1304 c797ec1e79935bb4186091dd2497ecb9.exe c797ec1e79935bb4186091dd2497ecb9.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

c797ec1e79935bb4186091dd2497ecb9.exe

pid process

560 c797ec1e79935bb4186091dd2497ecb9.exe

description	pid	process	target process
PID 1304 set thread context of 560	1304	c797ec1e79935bb4186091dd2497ecb9.exe	c797ec1e79935bb4186091dd2497ecb9.exe

pid	process
560	c797ec1e79935bb4186091dd2497ecb9.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

c797ec1e79935bb4186091dd2497ecb9.exe

description	pid	process	target process
PID 1304 wrote to memory of 560	1304	c797ec1e79935bb4186091dd2497ecb9.exe	c797ec1e79935bb4186091dd2497ecb9.exe
PID 1304 wrote to memory of 560	1304	c797ec1e79935bb4186091dd2497ecb9.exe	c797ec1e79935bb4186091dd2497ecb9.exe
PID 1304 wrote to memory of 560	1304	c797ec1e79935bb4186091dd2497ecb9.exe	c797ec1e79935bb4186091dd2497ecb9.exe
PID 1304 wrote to memory of 560	1304	c797ec1e79935bb4186091dd2497ecb9.exe	c797ec1e79935bb4186091dd2497ecb9.exe
PID 1304 wrote to memory of 560	1304	c797ec1e79935bb4186091dd2497ecb9.exe	c797ec1e79935bb4186091dd2497ecb9.exe
PID 1304 wrote to memory of 560	1304	c797ec1e79935bb4186091dd2497ecb9.exe	c797ec1e79935bb4186091dd2497ecb9.exe
PID 1304 wrote to memory of 560	1304	c797ec1e79935bb4186091dd2497ecb9.exe	c797ec1e79935bb4186091dd2497ecb9.exe

C:\Users\Admin\AppData\Local\Temp\c797ec1e79935bb4186091dd2497ecb9.exe
"C:\Users\Admin\AppData\Local\Temp\c797ec1e79935bb4186091dd2497ecb9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1304

C:\Users\Admin\AppData\Local\Temp\c797ec1e79935bb4186091dd2497ecb9.exe
"C:\Users\Admin\AppData\Local\Temp\c797ec1e79935bb4186091dd2497ecb9.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:560

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/560-60-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/560-61-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/560-63-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/560-64-0x000000000041F020-mapping.dmp

Download
memory/560-65-0x0000000000D80000-0x0000000001083000-memory.dmp

Filesize
3.0MB

Download
memory/1304-54-0x0000000000C90000-0x0000000000D78000-memory.dmp

Filesize
928KB

Download
memory/1304-55-0x0000000075F21000-0x0000000075F23000-memory.dmp

Filesize
8KB

Download
memory/1304-56-0x00000000003A0000-0x00000000003BA000-memory.dmp

Filesize
104KB

Download
memory/1304-57-0x0000000000570000-0x000000000057E000-memory.dmp

Filesize
56KB

Download
memory/1304-58-0x0000000005AB0000-0x0000000005B3C000-memory.dmp

Filesize
560KB

Download
memory/1304-59-0x0000000005680000-0x00000000056D2000-memory.dmp

Filesize
328KB

Download