formbook | 0b640ca6d0c1ee006bcd033bed109ae3383bbaae6f282d128ca32814f2214211

Analysis

max time kernel
151s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
05/05/2023, 19:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8a1f57853b44e3702f2758a4ad46225af7fa0a847ee22b0a9f190be5c062869b.exe
Size

717KB
MD5

bcae62255fcd6391b3ea099ce345209e
SHA1

a52d0f6ec60908b056727c9af9ceec563f90de35
SHA256

8a1f57853b44e3702f2758a4ad46225af7fa0a847ee22b0a9f190be5c062869b
SHA512

29751604911e5f9250ac098d344f08cd2f504c7f250de44e2585637fb9b584968833e204a03bc1638051e6a9253dc9a6741489bf86d847ec612428bcd99d7614
SSDEEP

12288:wjgjjLkCS3b5GDo5w/8u13IwR1Cf6Vfj+TktHNjmKkjDv:wjgjjLkCSL5H5w/VYSVfiYrzkXv

Score

10^/10

formbook sd03 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

sd03

Decoy

bagmart.net

1wuxns.top

guohuifanli.com

facetaxi.xyz

fresnodailynews.online

2854x.com

fxprods.live

alley-oop.app

lolabanet.com

websleuths.africa

billydeluca.com

bbmmarketinginc.com

aldcrew.com

laolaijx.com

bflaherty.work

catawbabank.com

nesty.africa

infochat.top

burningsensationtreatment.site

translogistic.africa

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/5044-140-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1028 set thread context of 5044	1028	8a1f57853b44e3702f2758a4ad46225af7fa0a847ee22b0a9f190be5c062869b.exe	90

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5044	8a1f57853b44e3702f2758a4ad46225af7fa0a847ee22b0a9f190be5c062869b.exe
5044	8a1f57853b44e3702f2758a4ad46225af7fa0a847ee22b0a9f190be5c062869b.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1028 wrote to memory of 5044	1028	8a1f57853b44e3702f2758a4ad46225af7fa0a847ee22b0a9f190be5c062869b.exe	90
PID 1028 wrote to memory of 5044	1028	8a1f57853b44e3702f2758a4ad46225af7fa0a847ee22b0a9f190be5c062869b.exe	90
PID 1028 wrote to memory of 5044	1028	8a1f57853b44e3702f2758a4ad46225af7fa0a847ee22b0a9f190be5c062869b.exe	90
PID 1028 wrote to memory of 5044	1028	8a1f57853b44e3702f2758a4ad46225af7fa0a847ee22b0a9f190be5c062869b.exe	90
PID 1028 wrote to memory of 5044	1028	8a1f57853b44e3702f2758a4ad46225af7fa0a847ee22b0a9f190be5c062869b.exe	90
PID 1028 wrote to memory of 5044	1028	8a1f57853b44e3702f2758a4ad46225af7fa0a847ee22b0a9f190be5c062869b.exe	90

C:\Users\Admin\AppData\Local\Temp\8a1f57853b44e3702f2758a4ad46225af7fa0a847ee22b0a9f190be5c062869b.exe
"C:\Users\Admin\AppData\Local\Temp\8a1f57853b44e3702f2758a4ad46225af7fa0a847ee22b0a9f190be5c062869b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Users\Admin\AppData\Local\Temp\8a1f57853b44e3702f2758a4ad46225af7fa0a847ee22b0a9f190be5c062869b.exe
  "C:\Users\Admin\AppData\Local\Temp\8a1f57853b44e3702f2758a4ad46225af7fa0a847ee22b0a9f190be5c062869b.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1028-133-0x0000000000EA0000-0x0000000000F5A000-memory.dmp

Filesize
744KB

Download
memory/1028-134-0x0000000005E50000-0x00000000063F4000-memory.dmp

Filesize
5.6MB

Download
memory/1028-135-0x0000000005940000-0x00000000059D2000-memory.dmp

Filesize
584KB

Download
memory/1028-136-0x0000000005930000-0x000000000593A000-memory.dmp

Filesize
40KB

Download
memory/1028-137-0x00000000058E0000-0x00000000058F0000-memory.dmp

Filesize
64KB

Download
memory/1028-138-0x00000000058E0000-0x00000000058F0000-memory.dmp

Filesize
64KB

Download
memory/1028-139-0x0000000001720000-0x00000000017BC000-memory.dmp

Filesize
624KB

Download
memory/5044-140-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5044-142-0x0000000001740000-0x0000000001A8A000-memory.dmp

Filesize
3.3MB

Download