formbook | 2f331b6d11ad09a1b1aaea5d9c7ee120899b6d2a425ad46ef37af10730c3f957

Analysis

max time kernel
135s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
10/01/2023, 12:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2f331b6d11ad09a1b1aaea5d9c7ee120899b6d2a425ad46ef37af10730c3f957.exe
Size

859KB
MD5

165d68ffe2a7c302e2510ad41d7fb190
SHA1

d04b5f03f71b378705f55757e9f87c19022c49f6
SHA256

2f331b6d11ad09a1b1aaea5d9c7ee120899b6d2a425ad46ef37af10730c3f957
SHA512

d24d1d4af9bba95e58dd8d84a8842a1f08346edcbed8ddedd98033220d4874e10bffe71ab46ac4380d8dc6605eb48109bb21004e24f1a2d9f01c6bf571ce0a36
SSDEEP

12288:qoQgKZ/nXt7virmWhlGLaQYIXvemUMoo4NbSxntD8UzsXMLX7HcRtWLkt3Wuijma:U2mHoo488UzGYX7HS0kt3WR

Score

10^/10

formbook soo3 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

soo3

Decoy

ulAoVHCJPFMMCXyU0k8s

gQssJfPDb+58t4k=

CJqTpjOkgMt0gQ==

jpj5qnSxUS0nZ9YOOfA9kw==

wd5b5XFY5eN6dwx3U6VwxRdj8X/F

ETbT5PLdmyyd3/B1Tt8=

v/JoCv2OjOuRiw==

JU/bfD1uA+TuXzEiCANlN1qglMY=

rVpvBOA37dfNB2rDlFvi9jM0

bCgzcDX/q/zJwCdRzs51iO8=

OmvZUJzHUkdL

U37ScNtggMt0gQ==

oynheCRY9snAKbINCZR72Bxj8X/F

mNVWXCXptUsDEhtnxs51iO8=

d4HKWl349Eth1OFEyQ==

O+nh8Lp5G4CKRgdFwQ==

9HkyNjsWo9mj0+IJk9c=

9wJYZ0n/mt297s80gN8tjg==

eTUrRwyugMt0gQ==

EY96tYYp0HQzP1W1/86jibJC0dE=

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1232 set thread context of 3496	1232	2f331b6d11ad09a1b1aaea5d9c7ee120899b6d2a425ad46ef37af10730c3f957.exe	93

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1232	2f331b6d11ad09a1b1aaea5d9c7ee120899b6d2a425ad46ef37af10730c3f957.exe
1232	2f331b6d11ad09a1b1aaea5d9c7ee120899b6d2a425ad46ef37af10730c3f957.exe
3496	2f331b6d11ad09a1b1aaea5d9c7ee120899b6d2a425ad46ef37af10730c3f957.exe
3496	2f331b6d11ad09a1b1aaea5d9c7ee120899b6d2a425ad46ef37af10730c3f957.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1232	2f331b6d11ad09a1b1aaea5d9c7ee120899b6d2a425ad46ef37af10730c3f957.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1232 wrote to memory of 2968	1232	2f331b6d11ad09a1b1aaea5d9c7ee120899b6d2a425ad46ef37af10730c3f957.exe	92
PID 1232 wrote to memory of 2968	1232	2f331b6d11ad09a1b1aaea5d9c7ee120899b6d2a425ad46ef37af10730c3f957.exe	92
PID 1232 wrote to memory of 2968	1232	2f331b6d11ad09a1b1aaea5d9c7ee120899b6d2a425ad46ef37af10730c3f957.exe	92
PID 1232 wrote to memory of 3496	1232	2f331b6d11ad09a1b1aaea5d9c7ee120899b6d2a425ad46ef37af10730c3f957.exe	93
PID 1232 wrote to memory of 3496	1232	2f331b6d11ad09a1b1aaea5d9c7ee120899b6d2a425ad46ef37af10730c3f957.exe	93
PID 1232 wrote to memory of 3496	1232	2f331b6d11ad09a1b1aaea5d9c7ee120899b6d2a425ad46ef37af10730c3f957.exe	93
PID 1232 wrote to memory of 3496	1232	2f331b6d11ad09a1b1aaea5d9c7ee120899b6d2a425ad46ef37af10730c3f957.exe	93
PID 1232 wrote to memory of 3496	1232	2f331b6d11ad09a1b1aaea5d9c7ee120899b6d2a425ad46ef37af10730c3f957.exe	93
PID 1232 wrote to memory of 3496	1232	2f331b6d11ad09a1b1aaea5d9c7ee120899b6d2a425ad46ef37af10730c3f957.exe	93

C:\Users\Admin\AppData\Local\Temp\2f331b6d11ad09a1b1aaea5d9c7ee120899b6d2a425ad46ef37af10730c3f957.exe
"C:\Users\Admin\AppData\Local\Temp\2f331b6d11ad09a1b1aaea5d9c7ee120899b6d2a425ad46ef37af10730c3f957.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Users\Admin\AppData\Local\Temp\2f331b6d11ad09a1b1aaea5d9c7ee120899b6d2a425ad46ef37af10730c3f957.exe
  "C:\Users\Admin\AppData\Local\Temp\2f331b6d11ad09a1b1aaea5d9c7ee120899b6d2a425ad46ef37af10730c3f957.exe"
  2⤵
  PID:2968
- C:\Users\Admin\AppData\Local\Temp\2f331b6d11ad09a1b1aaea5d9c7ee120899b6d2a425ad46ef37af10730c3f957.exe
  "C:\Users\Admin\AppData\Local\Temp\2f331b6d11ad09a1b1aaea5d9c7ee120899b6d2a425ad46ef37af10730c3f957.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3496

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1232-132-0x0000000000F00000-0x0000000000FDE000-memory.dmp

Filesize
888KB

Download
memory/1232-133-0x0000000005E70000-0x0000000006414000-memory.dmp

Filesize
5.6MB

Download
memory/1232-134-0x0000000005970000-0x0000000005A02000-memory.dmp

Filesize
584KB

Download
memory/1232-135-0x0000000005A20000-0x0000000005A2A000-memory.dmp

Filesize
40KB

Download
memory/1232-136-0x0000000005C60000-0x0000000005CFC000-memory.dmp

Filesize
624KB

Download
memory/3496-139-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3496-141-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3496-142-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/3496-143-0x0000000001380000-0x00000000016CA000-memory.dmp

Filesize
3.3MB

Download