formbook | f877daae32612cf737745b22467c63f63e1961a6135289125dd228604fa0c29e

Analysis

max time kernel
135s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
05/05/2023, 20:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f877daae32612cf737745b22467c63f63e1961a6135289125dd228604fa0c29e.exe
Size

684KB
MD5

33b08a6f291d2d62ce11bc349ed3487d
SHA1

a06c3031d3098a51160179458f604b0382c26a16
SHA256

f877daae32612cf737745b22467c63f63e1961a6135289125dd228604fa0c29e
SHA512

a194432af284a2284cb7a2a8b18405e1d1b2a42057d8463d819ae1a00bdb98223a418c6017e5673bcb8d7a979bb716c35c560dcd86542baaca8e9f2e711617ae
SSDEEP

12288:YWda76TLGyuxNYZaOWiOBR7Eb1VW7YRkV42mEFdCH:YW3SVx2ZaqOB9W1qFXFUH

Score

10^/10

formbook e8fg rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

e8fg

Decoy

rmaex.xyz

thegreenambition.com

ifmcustomerevents.com

agencewebimage.com

w0a00dbe.buzz

shopbequynhff.com

webpetarung.online

girlgonecyber.com

lexoutwest.com

gramshilpartandcraft.com

kemeioficial.com

track-race-package.com

shop-domanopro.com

bohanshow.com

ateliermedispa.com

paragonhonda-ny.com

calzadosnova.com

thephoenixoneproject.com

pl66380.com

nightowlmarketinggroup.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/1424-140-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2196 set thread context of 1424	2196	f877daae32612cf737745b22467c63f63e1961a6135289125dd228604fa0c29e.exe	90

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1424	f877daae32612cf737745b22467c63f63e1961a6135289125dd228604fa0c29e.exe
1424	f877daae32612cf737745b22467c63f63e1961a6135289125dd228604fa0c29e.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 1424	2196	f877daae32612cf737745b22467c63f63e1961a6135289125dd228604fa0c29e.exe	90
PID 2196 wrote to memory of 1424	2196	f877daae32612cf737745b22467c63f63e1961a6135289125dd228604fa0c29e.exe	90
PID 2196 wrote to memory of 1424	2196	f877daae32612cf737745b22467c63f63e1961a6135289125dd228604fa0c29e.exe	90
PID 2196 wrote to memory of 1424	2196	f877daae32612cf737745b22467c63f63e1961a6135289125dd228604fa0c29e.exe	90
PID 2196 wrote to memory of 1424	2196	f877daae32612cf737745b22467c63f63e1961a6135289125dd228604fa0c29e.exe	90
PID 2196 wrote to memory of 1424	2196	f877daae32612cf737745b22467c63f63e1961a6135289125dd228604fa0c29e.exe	90

C:\Users\Admin\AppData\Local\Temp\f877daae32612cf737745b22467c63f63e1961a6135289125dd228604fa0c29e.exe
"C:\Users\Admin\AppData\Local\Temp\f877daae32612cf737745b22467c63f63e1961a6135289125dd228604fa0c29e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Users\Admin\AppData\Local\Temp\f877daae32612cf737745b22467c63f63e1961a6135289125dd228604fa0c29e.exe
  "C:\Users\Admin\AppData\Local\Temp\f877daae32612cf737745b22467c63f63e1961a6135289125dd228604fa0c29e.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1424

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1424-140-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1424-142-0x0000000001460000-0x00000000017AA000-memory.dmp

Filesize
3.3MB

Download
memory/2196-133-0x0000000000A70000-0x0000000000B22000-memory.dmp

Filesize
712KB

Download
memory/2196-134-0x0000000005BF0000-0x0000000006194000-memory.dmp

Filesize
5.6MB

Download
memory/2196-135-0x00000000054E0000-0x0000000005572000-memory.dmp

Filesize
584KB

Download
memory/2196-136-0x0000000005580000-0x000000000558A000-memory.dmp

Filesize
40KB

Download
memory/2196-137-0x00000000057E0000-0x00000000057F0000-memory.dmp

Filesize
64KB

Download
memory/2196-138-0x00000000057E0000-0x00000000057F0000-memory.dmp

Filesize
64KB

Download
memory/2196-139-0x0000000008210000-0x00000000082AC000-memory.dmp

Filesize
624KB

Download