formbook | d8a138fbcb8fd354203f749dcd8e70f21a19af4935bb3cd9f34fa3ac74ce561b

Analysis

max time kernel
48s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
26-04-2023 01:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c643ce9cf3045a605b3ed588dc7e992de791468c841013fcdb310e751b237ad3.exe
Size

718KB
MD5

d67d9bf7354e7969abe6a4ced998b145
SHA1

12ac15d5eb62eb68f88d6bd149497a57e43e6fa2
SHA256

c643ce9cf3045a605b3ed588dc7e992de791468c841013fcdb310e751b237ad3
SHA512

e7c15ba7dbbdd0d7ea7103079feead806252dbf80a0d129f15c400614703e3380d1c6c68984dad1f932d5ef7d10a28867667ee5fc13413498546ad41d3806204
SSDEEP

12288:0ZgjjkkCS3OydyH73bJ4gnVfo2ZQTR23onxpQH3oJSAT1i1NFW49Mx:0ZgjjkkCSPySN2ZQk4nxQ3cF0Mx

Score

10^/10

formbook btrd rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

btrd

Decoy

toulouse.gold

launchyouglobal.com

margarita-services.com

dasnail.club

casa-hilo.com

hardscapesofflorida.com

thepositivitypulse.com

kkmyanev.cfd

love6ace22.top

castorcruise.com

chch6.com

h59f07jy.cfd

saatvikteerthyatra.com

fxsecuretrading-option.com

mostbet-k1o.click

36-m.beauty

ko-or-a-news.com

eurekatextile.com

gynlkj.com

deepsouthcraftsman.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/584-64-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1768 set thread context of 584	1768	c643ce9cf3045a605b3ed588dc7e992de791468c841013fcdb310e751b237ad3.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
584	c643ce9cf3045a605b3ed588dc7e992de791468c841013fcdb310e751b237ad3.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 584	1768	c643ce9cf3045a605b3ed588dc7e992de791468c841013fcdb310e751b237ad3.exe	28
PID 1768 wrote to memory of 584	1768	c643ce9cf3045a605b3ed588dc7e992de791468c841013fcdb310e751b237ad3.exe	28
PID 1768 wrote to memory of 584	1768	c643ce9cf3045a605b3ed588dc7e992de791468c841013fcdb310e751b237ad3.exe	28
PID 1768 wrote to memory of 584	1768	c643ce9cf3045a605b3ed588dc7e992de791468c841013fcdb310e751b237ad3.exe	28
PID 1768 wrote to memory of 584	1768	c643ce9cf3045a605b3ed588dc7e992de791468c841013fcdb310e751b237ad3.exe	28
PID 1768 wrote to memory of 584	1768	c643ce9cf3045a605b3ed588dc7e992de791468c841013fcdb310e751b237ad3.exe	28
PID 1768 wrote to memory of 584	1768	c643ce9cf3045a605b3ed588dc7e992de791468c841013fcdb310e751b237ad3.exe	28

C:\Users\Admin\AppData\Local\Temp\c643ce9cf3045a605b3ed588dc7e992de791468c841013fcdb310e751b237ad3.exe
"C:\Users\Admin\AppData\Local\Temp\c643ce9cf3045a605b3ed588dc7e992de791468c841013fcdb310e751b237ad3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Users\Admin\AppData\Local\Temp\c643ce9cf3045a605b3ed588dc7e992de791468c841013fcdb310e751b237ad3.exe
  "C:\Users\Admin\AppData\Local\Temp\c643ce9cf3045a605b3ed588dc7e992de791468c841013fcdb310e751b237ad3.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:584

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/584-61-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/584-62-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/584-63-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/584-64-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/584-65-0x0000000000A50000-0x0000000000D53000-memory.dmp

Filesize
3.0MB

Download
memory/1768-54-0x0000000000990000-0x0000000000A4A000-memory.dmp

Filesize
744KB

Download
memory/1768-55-0x0000000004430000-0x0000000004470000-memory.dmp

Filesize
256KB

Download
memory/1768-56-0x00000000003D0000-0x00000000003E4000-memory.dmp

Filesize
80KB

Download
memory/1768-57-0x0000000004430000-0x0000000004470000-memory.dmp

Filesize
256KB

Download
memory/1768-58-0x0000000000490000-0x000000000049C000-memory.dmp

Filesize
48KB

Download
memory/1768-59-0x0000000004E40000-0x0000000004EB0000-memory.dmp

Filesize
448KB

Download
memory/1768-60-0x0000000004CF0000-0x0000000004D28000-memory.dmp

Filesize
224KB

Download