formbook | bca5d8c8e6b1abbf2f9ed462fda3dc22c4f3b37ef2bd6f2bd6772c00fe7dc1af

Analysis

max time kernel
135s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
01-06-2023 03:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ce1c55a5196da204d9f949b097e67060.exe
Size

690KB
MD5

ce1c55a5196da204d9f949b097e67060
SHA1

bee3d05da7b8913368f16f34306dbfbd1bf4fab7
SHA256

bca5d8c8e6b1abbf2f9ed462fda3dc22c4f3b37ef2bd6f2bd6772c00fe7dc1af
SHA512

0ce30e590cb2c5703c316e94792af9a5ea691caf132fbde1d9794564aeb2eb94c72e4c272139fbec632e062f9564ab40e3b74bcbe2b363c03db18f983f2f351e
SSDEEP

12288:V0hmzZBEP85JpsN74ypvfv3jVTGEbaZwqje4Arb++mZfFGB1v:D9BEP8jmN7tHPRT1beP1Ar23GB1v

Score

10^/10

formbook ca82 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ca82

Decoy

idunresearch.com

loiioo1.site

aimobilify.com

limousineswebdesign.com

darshan-enterprises.online

javad.top

dd-spy.com

metamysme.co.uk

earticlesdirect.com

ldkj78v.vip

dariusevory.com

bestyoutubepromoter.com

dogcoinacademy.com

mestredosexo.net

mrnofree.africa

plan.rsvp

hoangnam.site

cadcamperform.com

091888.net

artwaylogistics.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/4552-143-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4764 set thread context of 4552	4764	ce1c55a5196da204d9f949b097e67060.exe	90

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4552	ce1c55a5196da204d9f949b097e67060.exe
4552	ce1c55a5196da204d9f949b097e67060.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 4552	4764	ce1c55a5196da204d9f949b097e67060.exe	90
PID 4764 wrote to memory of 4552	4764	ce1c55a5196da204d9f949b097e67060.exe	90
PID 4764 wrote to memory of 4552	4764	ce1c55a5196da204d9f949b097e67060.exe	90
PID 4764 wrote to memory of 4552	4764	ce1c55a5196da204d9f949b097e67060.exe	90
PID 4764 wrote to memory of 4552	4764	ce1c55a5196da204d9f949b097e67060.exe	90
PID 4764 wrote to memory of 4552	4764	ce1c55a5196da204d9f949b097e67060.exe	90

C:\Users\Admin\AppData\Local\Temp\ce1c55a5196da204d9f949b097e67060.exe
"C:\Users\Admin\AppData\Local\Temp\ce1c55a5196da204d9f949b097e67060.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Users\Admin\AppData\Local\Temp\ce1c55a5196da204d9f949b097e67060.exe
  "C:\Users\Admin\AppData\Local\Temp\ce1c55a5196da204d9f949b097e67060.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4552

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4552-143-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4552-145-0x00000000010D0000-0x000000000141A000-memory.dmp

Filesize
3.3MB

Download
memory/4764-136-0x0000000000890000-0x0000000000942000-memory.dmp

Filesize
712KB

Download
memory/4764-137-0x0000000005720000-0x0000000005CC4000-memory.dmp

Filesize
5.6MB

Download
memory/4764-138-0x0000000005210000-0x00000000052A2000-memory.dmp

Filesize
584KB

Download
memory/4764-139-0x00000000051D0000-0x00000000051DA000-memory.dmp

Filesize
40KB

Download
memory/4764-140-0x00000000054A0000-0x00000000054B0000-memory.dmp

Filesize
64KB

Download
memory/4764-141-0x00000000054A0000-0x00000000054B0000-memory.dmp

Filesize
64KB

Download
memory/4764-142-0x00000000072A0000-0x000000000733C000-memory.dmp

Filesize
624KB

Download