formbook | 9c22f08fc1cbbb249b54adba03b6a03957cef4181c4161401085db2dd4383570

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-01-2023 05:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9c22f08fc1cbbb249b54adba03b6a03957cef4181c4161401085db2dd4383570.exe
Size

631KB
MD5

7d6ff1922141c5a973665b8fbf23ad28
SHA1

d3e359ba67218bc6ee10a87fb4e5f4d811f2b8cd
SHA256

9c22f08fc1cbbb249b54adba03b6a03957cef4181c4161401085db2dd4383570
SHA512

009cb7a687d11300a01ebf506abd0d91bc43b199ac8bea0155cfc9c86ae19640fbb2422ed4390ee2c0b4ffa7501849b6e225bbd25300d032e107e7a03baede7e
SSDEEP

12288:AwhuJ1Qvhzps7LZ3CUlebztjq7dfaveSS8Ol7amatoVYX9csg87:zuJWs7LZoztjqTS5Ol7akVYXy5

Score

10^/10

formbook d06c rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

d06c

Decoy

douglasdetoledopiza.com

yxcc.online

primo.llc

mediamomos.com

cosmetiq-pro.com

22labs.tech

turbowashing.com

lindaivell.site

princess-bed.club

groundget.cfd

agretaminiousa.com

lomoni.com

nessesse.us

lexgo.cloud

halilsener.xyz

kirokubo.cloud

corotip.sbs

meghq.net

5y6s.world

weasib.online

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4236-138-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

9c22f08fc1cbbb249b54adba03b6a03957cef4181c4161401085db2dd4383570.exe

description	pid	process	target process
PID 4696 set thread context of 4236	4696	9c22f08fc1cbbb249b54adba03b6a03957cef4181c4161401085db2dd4383570.exe	9c22f08fc1cbbb249b54adba03b6a03957cef4181c4161401085db2dd4383570.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

9c22f08fc1cbbb249b54adba03b6a03957cef4181c4161401085db2dd4383570.exe

pid	process
4236	9c22f08fc1cbbb249b54adba03b6a03957cef4181c4161401085db2dd4383570.exe
4236	9c22f08fc1cbbb249b54adba03b6a03957cef4181c4161401085db2dd4383570.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

9c22f08fc1cbbb249b54adba03b6a03957cef4181c4161401085db2dd4383570.exe

description	pid	process	target process
PID 4696 wrote to memory of 4236	4696	9c22f08fc1cbbb249b54adba03b6a03957cef4181c4161401085db2dd4383570.exe	9c22f08fc1cbbb249b54adba03b6a03957cef4181c4161401085db2dd4383570.exe
PID 4696 wrote to memory of 4236	4696	9c22f08fc1cbbb249b54adba03b6a03957cef4181c4161401085db2dd4383570.exe	9c22f08fc1cbbb249b54adba03b6a03957cef4181c4161401085db2dd4383570.exe
PID 4696 wrote to memory of 4236	4696	9c22f08fc1cbbb249b54adba03b6a03957cef4181c4161401085db2dd4383570.exe	9c22f08fc1cbbb249b54adba03b6a03957cef4181c4161401085db2dd4383570.exe
PID 4696 wrote to memory of 4236	4696	9c22f08fc1cbbb249b54adba03b6a03957cef4181c4161401085db2dd4383570.exe	9c22f08fc1cbbb249b54adba03b6a03957cef4181c4161401085db2dd4383570.exe
PID 4696 wrote to memory of 4236	4696	9c22f08fc1cbbb249b54adba03b6a03957cef4181c4161401085db2dd4383570.exe	9c22f08fc1cbbb249b54adba03b6a03957cef4181c4161401085db2dd4383570.exe
PID 4696 wrote to memory of 4236	4696	9c22f08fc1cbbb249b54adba03b6a03957cef4181c4161401085db2dd4383570.exe	9c22f08fc1cbbb249b54adba03b6a03957cef4181c4161401085db2dd4383570.exe

C:\Users\Admin\AppData\Local\Temp\9c22f08fc1cbbb249b54adba03b6a03957cef4181c4161401085db2dd4383570.exe
"C:\Users\Admin\AppData\Local\Temp\9c22f08fc1cbbb249b54adba03b6a03957cef4181c4161401085db2dd4383570.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4696

C:\Users\Admin\AppData\Local\Temp\9c22f08fc1cbbb249b54adba03b6a03957cef4181c4161401085db2dd4383570.exe
"C:\Users\Admin\AppData\Local\Temp\9c22f08fc1cbbb249b54adba03b6a03957cef4181c4161401085db2dd4383570.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4236

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4236-137-0x0000000000000000-mapping.dmp

Download
memory/4236-138-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4236-139-0x0000000001810000-0x0000000001B5A000-memory.dmp

Filesize
3.3MB

Download
memory/4696-132-0x0000000000130000-0x00000000001D4000-memory.dmp

Filesize
656KB

Download
memory/4696-133-0x00000000051E0000-0x0000000005784000-memory.dmp

Filesize
5.6MB

Download
memory/4696-134-0x0000000004B70000-0x0000000004C02000-memory.dmp

Filesize
584KB

Download
memory/4696-135-0x0000000004B60000-0x0000000004B6A000-memory.dmp

Filesize
40KB

Download
memory/4696-136-0x00000000076D0000-0x000000000776C000-memory.dmp

Filesize
624KB

Download