formbook | fb9ff8cbde506cb2cfdb40e88fe3fd6877a2e9945a71f07c7252647271763e71

Resubmissions

30/12/2022, 03:53

221230-efty4aab7y 10

29/12/2022, 16:16

221229-tqsaksdd99 10

Analysis

max time kernel
56s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
30/12/2022, 03:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fb9ff8cbde506cb2cfdb40e88fe3fd6877a2e9945a71f07c7252647271763e71.exe
Size

840KB
MD5

837fd128d246ccb07647515dd273f4f9
SHA1

8fa22f3f426216aa7f1301d127582aa7434c9d4b
SHA256

fb9ff8cbde506cb2cfdb40e88fe3fd6877a2e9945a71f07c7252647271763e71
SHA512

19f668b337f08ce16e831fe811876edf632d9e5c06b3d311bd9c7057c480fbe3ba2fc1c9d446cba4b755d375dff7bdbcd80224223b79204ce7324de19fd665c1
SSDEEP

12288:UZ/fiJLRc2evo2Ursov0KT4zHsyYgH/PT134slbbHl2qPVGNbTuMuKBD7hpvA/N:JAo/s7HsynTB4ATST0sDdIN

Score

10^/10

formbook et2d rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

et2d

Decoy

wcaconline.com

travelbackpackss.com

ao-m-nishinomiya.com

tilania.com

vegbydesign.net

mybabysisterscloset.com

sanctitude-cuspidated.com

russtybeats.com

dichvubangchuan.com

su-seikatu.info

eratosantorini.com

ninetofivemama.com

delishany.com

pawchamamapet.net

nissicloud.com

strictlyotaku.net

kissmanga.pro

appalachianfx.com

aralending.com

forbrighterlife.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 2 IoCs

rat

resource	yara_rule
behavioral1/memory/552-63-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/552-64-0x000000000041ED50-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 860 set thread context of 552	860	fb9ff8cbde506cb2cfdb40e88fe3fd6877a2e9945a71f07c7252647271763e71.exe	27

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
860	fb9ff8cbde506cb2cfdb40e88fe3fd6877a2e9945a71f07c7252647271763e71.exe
552	fb9ff8cbde506cb2cfdb40e88fe3fd6877a2e9945a71f07c7252647271763e71.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	860	fb9ff8cbde506cb2cfdb40e88fe3fd6877a2e9945a71f07c7252647271763e71.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 860 wrote to memory of 552	860	fb9ff8cbde506cb2cfdb40e88fe3fd6877a2e9945a71f07c7252647271763e71.exe	27
PID 860 wrote to memory of 552	860	fb9ff8cbde506cb2cfdb40e88fe3fd6877a2e9945a71f07c7252647271763e71.exe	27
PID 860 wrote to memory of 552	860	fb9ff8cbde506cb2cfdb40e88fe3fd6877a2e9945a71f07c7252647271763e71.exe	27
PID 860 wrote to memory of 552	860	fb9ff8cbde506cb2cfdb40e88fe3fd6877a2e9945a71f07c7252647271763e71.exe	27
PID 860 wrote to memory of 552	860	fb9ff8cbde506cb2cfdb40e88fe3fd6877a2e9945a71f07c7252647271763e71.exe	27
PID 860 wrote to memory of 552	860	fb9ff8cbde506cb2cfdb40e88fe3fd6877a2e9945a71f07c7252647271763e71.exe	27
PID 860 wrote to memory of 552	860	fb9ff8cbde506cb2cfdb40e88fe3fd6877a2e9945a71f07c7252647271763e71.exe	27

C:\Users\Admin\AppData\Local\Temp\fb9ff8cbde506cb2cfdb40e88fe3fd6877a2e9945a71f07c7252647271763e71.exe
"C:\Users\Admin\AppData\Local\Temp\fb9ff8cbde506cb2cfdb40e88fe3fd6877a2e9945a71f07c7252647271763e71.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:860
- C:\Users\Admin\AppData\Local\Temp\fb9ff8cbde506cb2cfdb40e88fe3fd6877a2e9945a71f07c7252647271763e71.exe
  "C:\Users\Admin\AppData\Local\Temp\fb9ff8cbde506cb2cfdb40e88fe3fd6877a2e9945a71f07c7252647271763e71.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:552

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/552-60-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/552-61-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/552-63-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/552-65-0x0000000000850000-0x0000000000B53000-memory.dmp

Filesize
3.0MB

Download
memory/860-54-0x0000000000EF0000-0x0000000000FC8000-memory.dmp

Filesize
864KB

Download
memory/860-55-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download
memory/860-56-0x0000000025810000-0x0000000025822000-memory.dmp

Filesize
72KB

Download
memory/860-57-0x00000000043D0000-0x0000000004426000-memory.dmp

Filesize
344KB

Download
memory/860-58-0x00000000007D0000-0x00000000007DC000-memory.dmp

Filesize
48KB

Download
memory/860-59-0x0000000004420000-0x0000000004456000-memory.dmp

Filesize
216KB

Download