formbook | 913b4c5b56c9810727dd256451bfc8e687905102bd503ec814bc26baef7dec13

Analysis

max time kernel
42s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23/12/2022, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
287b48c1e89f40d22e0f236077fbc388.exe
Size 1.0MB
Sample221223-e6542sfh47
SHA256 913b4c5b56c9810727dd256451bfc8e687905102bd503ec814bc26baef7dec13
MD5 287b48c1e89f40d22e0f236077fbc388
SHA1 0de55f29fe36c970b1245ae0c94772582d5b9427
SHA512 53d1d0b0ab65b6d7dc5d7bc91edff6f754055602fd0777c4a48f270366ac27a1f8a631b7241f25447b014855e893eea523d3d9fc46b57a1f67d2078af7ecd2d3
SSDEEP 12288:0Z+2iN1/Sr+p2H8c+9e/JWPdiZ4eSXFEI3XZThKEvcyvKnKSR2ef+mDXttarruVI:h1e+2H80OOyWIHZNyKSM
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook vr84 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

vr84

Decoy

intouchenergy.co.uk
lalumalkaliram.com
hillgreenholidays.co.uk
fluentliteracy.com
buildingworkerpower.com
by23577.com
gate-ch375019.online
jayess-decor.com
larkslife.com
swsnacks.co.uk
bigturtletiny.com
egggge.xyz
olastore.africa
lightshowsnewengland.com
daily-lox.com
empireoba.com
91302events.com
lawrencecountyfirechiefs.com
abrahamslibrary.com
cleaner365.online
getmicrostock.net
lightyearsmgmt.com
dentanorma.store
jbproductions.net
acideastern.com
jayess-decor.com
harpy.life
arcadiatownhomesut.com
407loans.com
kxzi803.com
flirtmate.network
mogi.africa
goohodao.xyz
rijnaq.xyz
valourcollection.africa
lateliergc.com
tsunamieng.africa
ctjhpw3.vip
dikevolesav.info
everyclick.africa
595255.biz
aissw.com
digitalpro.africa
giantcourtyard.com
windkind.net
gp5757.com
kino-plasmat.com
led-lighting-90688.com
cyzhan.top
connectionsluxury.com
14782.se
alekseevich1.ru
3wmsr.com
checkssuanalong.com
coveringattorney.com
alshshamil.com
justkillem.com
jmd58.net
e0pvb3.shop
fireballmedia5.com
markallenit.com
dampymatter.com
hrunmall2193.com
faithfultransitions.com
fyndme.net

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 2 IoCs

rat

resource	yara_rule
behavioral1/memory/1324-63-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1324-64-0x000000000041F060-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1724 set thread context of 1324	1724	287b48c1e89f40d22e0f236077fbc388.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1324	287b48c1e89f40d22e0f236077fbc388.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 1324	1724	287b48c1e89f40d22e0f236077fbc388.exe	28
PID 1724 wrote to memory of 1324	1724	287b48c1e89f40d22e0f236077fbc388.exe	28
PID 1724 wrote to memory of 1324	1724	287b48c1e89f40d22e0f236077fbc388.exe	28
PID 1724 wrote to memory of 1324	1724	287b48c1e89f40d22e0f236077fbc388.exe	28
PID 1724 wrote to memory of 1324	1724	287b48c1e89f40d22e0f236077fbc388.exe	28
PID 1724 wrote to memory of 1324	1724	287b48c1e89f40d22e0f236077fbc388.exe	28
PID 1724 wrote to memory of 1324	1724	287b48c1e89f40d22e0f236077fbc388.exe	28

C:\Users\Admin\AppData\Local\Temp\287b48c1e89f40d22e0f236077fbc388.exe
"C:\Users\Admin\AppData\Local\Temp\287b48c1e89f40d22e0f236077fbc388.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Users\Admin\AppData\Local\Temp\287b48c1e89f40d22e0f236077fbc388.exe
  "C:\Users\Admin\AppData\Local\Temp\287b48c1e89f40d22e0f236077fbc388.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1324

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1324-60-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1324-61-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1324-63-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1324-65-0x0000000000B90000-0x0000000000E93000-memory.dmp

Download

memory/1724-54-0x00000000008F0000-0x00000000009F6000-memory.dmp

Download

memory/1724-55-0x0000000075D51000-0x0000000075D53000-memory.dmp

Download

memory/1724-56-0x0000000000350000-0x0000000000360000-memory.dmp

Download

memory/1724-57-0x00000000004D0000-0x00000000004DA000-memory.dmp

Download

memory/1724-58-0x00000000055E0000-0x0000000005650000-memory.dmp

Download

memory/1724-59-0x0000000004830000-0x0000000004864000-memory.dmp

Download