formbook | e2ab9f8e6ccfd04fb283217ddc26ef9805a7218060036303571cd092d17ed97e

Analysis

max time kernel
44s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
16-03-2023 06:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5dc52da7b97835654bab2a3a39e93d412a50608bfd7dfccb87ff716c9aba6a37.exe
Size

761KB
MD5

0d9b2efac64b4245292e7c3112ec8771
SHA1

61b32ec6303fd7fa890dadc3f3f18128f2c264c9
SHA256

5dc52da7b97835654bab2a3a39e93d412a50608bfd7dfccb87ff716c9aba6a37
SHA512

47d00d1a6e705662d18fb3a9885af5a8a51ad3ef4ad3bbbcabf544e5b9a959dc49be99fdea562ff6db59981941db91de761d7f3dbf59ccaaa12a9a35357081ed
SSDEEP

12288:QCZzLzeEILPryAzRVelrKhVaZF6NPeUDQ1cwCbGOaS80v2ekdeoFuPD7hXJGRTw:QCZzeEIrryORVep2QF6N/Q1bWGDTFmJT

Score

10^/10

formbook ar73 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ar73

Decoy

classgorilla.com

b6817.com

1wwuwa.top

dgslimited.africa

deepwaterships.com

hkshshoptw.shop

hurricanevalleyatvjamboree.com

ckpconsulting.com

laojiangmath.com

authenticityhacking.com

family-doctor-53205.com

investinstgeorgeut.com

lithoearthsolution.africa

quickhealcareltd.co.uk

delightkgrillw.top

freezeclosettoilet.com

coo1star.com

gemgamut.com

enrichednetworksolutions.com

betterbeeclean.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1048-65-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

5dc52da7b97835654bab2a3a39e93d412a50608bfd7dfccb87ff716c9aba6a37.exe

description	pid	process	target process
PID 1236 set thread context of 1048	1236	5dc52da7b97835654bab2a3a39e93d412a50608bfd7dfccb87ff716c9aba6a37.exe	5dc52da7b97835654bab2a3a39e93d412a50608bfd7dfccb87ff716c9aba6a37.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

5dc52da7b97835654bab2a3a39e93d412a50608bfd7dfccb87ff716c9aba6a37.exe

pid process

1048 5dc52da7b97835654bab2a3a39e93d412a50608bfd7dfccb87ff716c9aba6a37.exe

pid	process
1048	5dc52da7b97835654bab2a3a39e93d412a50608bfd7dfccb87ff716c9aba6a37.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

5dc52da7b97835654bab2a3a39e93d412a50608bfd7dfccb87ff716c9aba6a37.exe

description	pid	process	target process
PID 1236 wrote to memory of 1048	1236	5dc52da7b97835654bab2a3a39e93d412a50608bfd7dfccb87ff716c9aba6a37.exe	5dc52da7b97835654bab2a3a39e93d412a50608bfd7dfccb87ff716c9aba6a37.exe
PID 1236 wrote to memory of 1048	1236	5dc52da7b97835654bab2a3a39e93d412a50608bfd7dfccb87ff716c9aba6a37.exe	5dc52da7b97835654bab2a3a39e93d412a50608bfd7dfccb87ff716c9aba6a37.exe
PID 1236 wrote to memory of 1048	1236	5dc52da7b97835654bab2a3a39e93d412a50608bfd7dfccb87ff716c9aba6a37.exe	5dc52da7b97835654bab2a3a39e93d412a50608bfd7dfccb87ff716c9aba6a37.exe
PID 1236 wrote to memory of 1048	1236	5dc52da7b97835654bab2a3a39e93d412a50608bfd7dfccb87ff716c9aba6a37.exe	5dc52da7b97835654bab2a3a39e93d412a50608bfd7dfccb87ff716c9aba6a37.exe
PID 1236 wrote to memory of 1048	1236	5dc52da7b97835654bab2a3a39e93d412a50608bfd7dfccb87ff716c9aba6a37.exe	5dc52da7b97835654bab2a3a39e93d412a50608bfd7dfccb87ff716c9aba6a37.exe
PID 1236 wrote to memory of 1048	1236	5dc52da7b97835654bab2a3a39e93d412a50608bfd7dfccb87ff716c9aba6a37.exe	5dc52da7b97835654bab2a3a39e93d412a50608bfd7dfccb87ff716c9aba6a37.exe
PID 1236 wrote to memory of 1048	1236	5dc52da7b97835654bab2a3a39e93d412a50608bfd7dfccb87ff716c9aba6a37.exe	5dc52da7b97835654bab2a3a39e93d412a50608bfd7dfccb87ff716c9aba6a37.exe

C:\Users\Admin\AppData\Local\Temp\5dc52da7b97835654bab2a3a39e93d412a50608bfd7dfccb87ff716c9aba6a37.exe
"C:\Users\Admin\AppData\Local\Temp\5dc52da7b97835654bab2a3a39e93d412a50608bfd7dfccb87ff716c9aba6a37.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1236

C:\Users\Admin\AppData\Local\Temp\5dc52da7b97835654bab2a3a39e93d412a50608bfd7dfccb87ff716c9aba6a37.exe
"C:\Users\Admin\AppData\Local\Temp\5dc52da7b97835654bab2a3a39e93d412a50608bfd7dfccb87ff716c9aba6a37.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1048

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1048-62-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1048-66-0x0000000000810000-0x0000000000B13000-memory.dmp

Filesize
3.0MB

Download
memory/1048-65-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1048-64-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1048-63-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1236-57-0x0000000000C80000-0x0000000000CC0000-memory.dmp

Filesize
256KB

Download
memory/1236-60-0x0000000000C70000-0x0000000000C78000-memory.dmp

Filesize
32KB

Download
memory/1236-61-0x00000000043C0000-0x00000000043F8000-memory.dmp

Filesize
224KB

Download
memory/1236-59-0x0000000005650000-0x0000000005700000-memory.dmp

Filesize
704KB

Download
memory/1236-58-0x00000000004D0000-0x00000000004DC000-memory.dmp

Filesize
48KB

Download
memory/1236-54-0x0000000000E70000-0x0000000000F34000-memory.dmp

Filesize
784KB

Download
memory/1236-56-0x0000000000590000-0x00000000005AE000-memory.dmp

Filesize
120KB

Download
memory/1236-55-0x0000000000C80000-0x0000000000CC0000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads