formbook | ed5c5ef5186a78d9dd02e7dbf36b0bcc9d6c0e733f04a6780f6bcf06dbfc3338

Analysis

max time kernel
149s
max time network
136s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/02/2023, 08:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
REVISED_.EXE.exe
Size 761KB
Sample230202-j6958afe83
SHA256 ed5c5ef5186a78d9dd02e7dbf36b0bcc9d6c0e733f04a6780f6bcf06dbfc3338
MD5 c18c92beacd7e92b9881eb2d8a56d2ad
SHA1 ed42c80e56dfb719435cc58919758a195341055b
SHA512 ed4735fd4d07653e5bc8c7eee0b53996d36f1efed3ef52954ee2e39d51f6a08fbab5b1578fe39c3652fecdac45d665f0b295809f24bdd2cee7f10928510910a9
SSDEEP 12288:3tz8L6gu+xMRSR5SEtKypyE4s09JtWsJIPg8zLvqsEqG4yPa:CLzyRU5Zp74so3WaCTC1qG4yPa
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook gg62 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

gg62

Decoy

growfast.africa
lerema.com
38945.se
wheelfermotors.africa
giftshareforyou.online
burrismktg.com
keepgrowing.uk
efefhomeless.buzz
bryanokoh.com
fashion-clothing-40094.com
andreasunshine.com
naijahood.africa
aditrirealty.com
kinnoitodatsumou.com
cryptoqzclimax.com
hairly.biz
comeuphither4.com
integrity360.ltd
flushywhole.com
8869365.com
fabvance-demos.online
motherpearl.africa
dnsmctmu.com
25779.football
crimson-sunset.ru
haamyounghoon.com
0563news.com
battleb0t.site
transnetfreight.africa
djdaxroadshow.co.uk
bwrps.live
abuin.vip
impressionsbyb.store
findguyscolorado.com
jordanflowerauction.net
fdm50off.com
31seaaa.com
centuryofviolence.co.uk
againstszhanweek.com
injurylawyersconsultants.com
kuotabike.com
cruisejoy.uk
clotaire.ru
hurloic.xyz
anvair.com
ivapeonthis.com
hotsesso.xyz
khramvyazovki.store
mentalistas.dev
cahayasunnah.com
bypro1.online
flavoredkreations.info
inuwallet.com
livingemployebenefits.com
enlighthings.com
focobreathwork.com
emaskhalipahbertam.com
jswl.store
chamaera.com
abbeyspear.com
downwind.one
lovelive.buzz
essentialhealth101.com
irakit.com
cbsht.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 6 IoCs

rat

resource	yara_rule
behavioral1/memory/2040-63-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/2040-64-0x000000000041F0B0-mapping.dmp	formbook
behavioral1/memory/2040-66-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/2040-74-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1692-78-0x0000000000090000-0x00000000000BF000-memory.dmp	formbook
behavioral1/memory/1692-82-0x0000000000090000-0x00000000000BF000-memory.dmp	formbook

Deletes itself 1 IoCs

pid	Process
1352	cmd.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1792 set thread context of 2040	1792	REVISED_.EXE.exe	30
PID 2040 set thread context of 1236	2040	REVISED_.EXE.exe	15
PID 2040 set thread context of 1236	2040	REVISED_.EXE.exe	15
PID 1692 set thread context of 1236	1692	cmstp.exe	15

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
1792	REVISED_.EXE.exe
1792	REVISED_.EXE.exe
2040	REVISED_.EXE.exe
2040	REVISED_.EXE.exe
2040	REVISED_.EXE.exe
1692	cmstp.exe
1692	cmstp.exe
1692	cmstp.exe
1692	cmstp.exe
1692	cmstp.exe
1692	cmstp.exe
1692	cmstp.exe
1692	cmstp.exe
1692	cmstp.exe
1692	cmstp.exe
1692	cmstp.exe
1692	cmstp.exe
1692	cmstp.exe
1692	cmstp.exe
1692	cmstp.exe
1692	cmstp.exe
1692	cmstp.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
2040	REVISED_.EXE.exe
2040	REVISED_.EXE.exe
2040	REVISED_.EXE.exe
2040	REVISED_.EXE.exe
1692	cmstp.exe
1692	cmstp.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1792	REVISED_.EXE.exe
Token: SeDebugPrivilege	2040	REVISED_.EXE.exe
Token: SeDebugPrivilege	1692	cmstp.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1236	Explorer.EXE
1236	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1236	Explorer.EXE
1236	Explorer.EXE

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 1992	1792	REVISED_.EXE.exe	28
PID 1792 wrote to memory of 1992	1792	REVISED_.EXE.exe	28
PID 1792 wrote to memory of 1992	1792	REVISED_.EXE.exe	28
PID 1792 wrote to memory of 1992	1792	REVISED_.EXE.exe	28
PID 1792 wrote to memory of 2036	1792	REVISED_.EXE.exe	29
PID 1792 wrote to memory of 2036	1792	REVISED_.EXE.exe	29
PID 1792 wrote to memory of 2036	1792	REVISED_.EXE.exe	29
PID 1792 wrote to memory of 2036	1792	REVISED_.EXE.exe	29
PID 1792 wrote to memory of 2040	1792	REVISED_.EXE.exe	30
PID 1792 wrote to memory of 2040	1792	REVISED_.EXE.exe	30
PID 1792 wrote to memory of 2040	1792	REVISED_.EXE.exe	30
PID 1792 wrote to memory of 2040	1792	REVISED_.EXE.exe	30
PID 1792 wrote to memory of 2040	1792	REVISED_.EXE.exe	30
PID 1792 wrote to memory of 2040	1792	REVISED_.EXE.exe	30
PID 1792 wrote to memory of 2040	1792	REVISED_.EXE.exe	30
PID 1236 wrote to memory of 1692	1236	Explorer.EXE	50
PID 1236 wrote to memory of 1692	1236	Explorer.EXE	50
PID 1236 wrote to memory of 1692	1236	Explorer.EXE	50
PID 1236 wrote to memory of 1692	1236	Explorer.EXE	50
PID 1236 wrote to memory of 1692	1236	Explorer.EXE	50
PID 1236 wrote to memory of 1692	1236	Explorer.EXE	50
PID 1236 wrote to memory of 1692	1236	Explorer.EXE	50
PID 1692 wrote to memory of 1352	1692	cmstp.exe	51
PID 1692 wrote to memory of 1352	1692	cmstp.exe	51
PID 1692 wrote to memory of 1352	1692	cmstp.exe	51
PID 1692 wrote to memory of 1352	1692	cmstp.exe	51

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Users\Admin\AppData\Local\Temp\REVISED_.EXE.exe
  "C:\Users\Admin\AppData\Local\Temp\REVISED_.EXE.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1792
- - C:\Users\Admin\AppData\Local\Temp\REVISED_.EXE.exe
    "C:\Users\Admin\AppData\Local\Temp\REVISED_.EXE.exe"
    3⤵
    PID:1992
- - C:\Users\Admin\AppData\Local\Temp\REVISED_.EXE.exe
    "C:\Users\Admin\AppData\Local\Temp\REVISED_.EXE.exe"
    3⤵
    PID:2036
- - C:\Users\Admin\AppData\Local\Temp\REVISED_.EXE.exe
    "C:\Users\Admin\AppData\Local\Temp\REVISED_.EXE.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:2040
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:956
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:1360
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:912
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:1176
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:1384
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:1828
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:1052
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:1324
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:268
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:584
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:768
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:1572
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:1556
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:1224
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:804
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:1348
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:1336
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:876
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:552
- C:\Windows\SysWOW64\cmstp.exe
  "C:\Windows\SysWOW64\cmstp.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\REVISED_.EXE.exe"
    3⤵
    - Deletes itself
    PID:1352

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1236-83-0x00000000046A0000-0x000000000474C000-memory.dmp

Download

memory/1236-72-0x00000000063B0000-0x0000000006462000-memory.dmp

Download

memory/1236-69-0x0000000006170000-0x00000000062B5000-memory.dmp

Download

memory/1236-81-0x00000000046A0000-0x000000000474C000-memory.dmp

Download

memory/1692-78-0x0000000000090000-0x00000000000BF000-memory.dmp

Download

memory/1692-82-0x0000000000090000-0x00000000000BF000-memory.dmp

Download

memory/1692-80-0x0000000000960000-0x00000000009F3000-memory.dmp

Download

memory/1692-79-0x0000000002090000-0x0000000002393000-memory.dmp

Download

memory/1692-77-0x0000000000AE0000-0x0000000000AF8000-memory.dmp

Download

memory/1792-54-0x0000000000190000-0x0000000000254000-memory.dmp

Download

memory/1792-59-0x00000000021D0000-0x0000000002206000-memory.dmp

Download

memory/1792-58-0x0000000005C90000-0x0000000005D00000-memory.dmp

Download

memory/1792-57-0x0000000000600000-0x000000000060A000-memory.dmp

Download

memory/1792-56-0x00000000005A0000-0x00000000005B4000-memory.dmp

Download

memory/1792-55-0x0000000076321000-0x0000000076323000-memory.dmp

Download

memory/2040-60-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2040-74-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2040-71-0x0000000000630000-0x0000000000644000-memory.dmp

Download

memory/2040-68-0x0000000000430000-0x0000000000444000-memory.dmp

Download

memory/2040-67-0x0000000000840000-0x0000000000B43000-memory.dmp

Download

memory/2040-66-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2040-63-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2040-61-0x0000000000400000-0x000000000042F000-memory.dmp

Download