formbook | 13714cb6b152e5d8ef04df8c5cf8f59cc8a1414de5be33b52d784e928a67ab0f

Analysis

max time kernel
136s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2023, 12:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
13714cb6b152e5d8ef04df8c5cf8f59cc8a1414de5be33b52d784e928a67ab0f.exe
Size 622KB
Sample230607-pdqtrsab65
SHA256 13714cb6b152e5d8ef04df8c5cf8f59cc8a1414de5be33b52d784e928a67ab0f
MD5 adf9f1eb207088d94953bba4f1b973b7
SHA1 cd4bfc0b22618beb13ac9bf9d7c16d6039ff89fb
SHA512 f7bf0732c656e0ae8df3d33224acd1abdc3578a41b04d52a86fc2492cf5f97e0eedd348624438aa65858b823fb69515329e006082b32ef97b685ff9f8e9fd71d
SSDEEP 12288:CBjvvebB+KAbrqwnnngkaG/mBUx5ltEe:Kv+IbrqwngkasmBe5lt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook gtt8 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

gtt8

Decoy

thesuccessbot.com
rittercivil.com
jt1.fun
d365extension.com
quqoxeq.top
visittworiverswi.com
bfprotienda.com
greenhabitsph.com
ladmere.com
clockboutiques.com
minwart.xyz
xinyuejiancai.online
eggsl.com
fetchingcandles.com
skywatiniya.com
hinkley.news
realityonlineenterprises.com
teamcroissant.com
esfera-pv.ch
herdadedosmontesbastos.com
buddhistprayers.app
talytic-one.com
capital-top.com
pawmultiverse.com
gdrop.biz
africanswers.online
amgconstruct1on.com
review.builders
findinstinct.online
leseditionsdupangolin.site
vector-sale.com
hutesmarke.shop
spacevisualmedia.com
jeweledcrown.shop
divinedivas.store
redirr.online
callifam.com
nickelinfo.com
ginghamstudio.com
launchthepodcast.com
arlisia.com
kerryshields.com
xn--o39aj5xqvflut.com
ramsgatecarwash.com
semrushfreetrails.com
rmpaclub.ru
wtpoexpo.one
amlar.xyz
downlis.top
phrasecheck.com
uk885.top
gdtrn.com
99522v.com
liftdetox2023.online
evo-omega.cloud
iccu3v.link
amd-soft1.site
containermurah.xyz
vineagency.uk
leeprintanddesign.com
bnjyjy.com
bookra-ck.com
ilyinsurance.com
texasmicroneedling.com
osmosstore.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/3296-140-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1164 set thread context of 3296	1164	13714cb6b152e5d8ef04df8c5cf8f59cc8a1414de5be33b52d784e928a67ab0f.exe	84

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3296	13714cb6b152e5d8ef04df8c5cf8f59cc8a1414de5be33b52d784e928a67ab0f.exe
3296	13714cb6b152e5d8ef04df8c5cf8f59cc8a1414de5be33b52d784e928a67ab0f.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1164 wrote to memory of 3296	1164	13714cb6b152e5d8ef04df8c5cf8f59cc8a1414de5be33b52d784e928a67ab0f.exe	84
PID 1164 wrote to memory of 3296	1164	13714cb6b152e5d8ef04df8c5cf8f59cc8a1414de5be33b52d784e928a67ab0f.exe	84
PID 1164 wrote to memory of 3296	1164	13714cb6b152e5d8ef04df8c5cf8f59cc8a1414de5be33b52d784e928a67ab0f.exe	84
PID 1164 wrote to memory of 3296	1164	13714cb6b152e5d8ef04df8c5cf8f59cc8a1414de5be33b52d784e928a67ab0f.exe	84
PID 1164 wrote to memory of 3296	1164	13714cb6b152e5d8ef04df8c5cf8f59cc8a1414de5be33b52d784e928a67ab0f.exe	84
PID 1164 wrote to memory of 3296	1164	13714cb6b152e5d8ef04df8c5cf8f59cc8a1414de5be33b52d784e928a67ab0f.exe	84

C:\Users\Admin\AppData\Local\Temp\13714cb6b152e5d8ef04df8c5cf8f59cc8a1414de5be33b52d784e928a67ab0f.exe
"C:\Users\Admin\AppData\Local\Temp\13714cb6b152e5d8ef04df8c5cf8f59cc8a1414de5be33b52d784e928a67ab0f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1164
- C:\Users\Admin\AppData\Local\Temp\13714cb6b152e5d8ef04df8c5cf8f59cc8a1414de5be33b52d784e928a67ab0f.exe
  "C:\Users\Admin\AppData\Local\Temp\13714cb6b152e5d8ef04df8c5cf8f59cc8a1414de5be33b52d784e928a67ab0f.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3296

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1164-133-0x0000000000720000-0x00000000007C2000-memory.dmp

Download

memory/1164-134-0x00000000057A0000-0x0000000005D44000-memory.dmp

Download

memory/1164-135-0x00000000051F0000-0x0000000005282000-memory.dmp

Download

memory/1164-136-0x0000000005180000-0x000000000518A000-memory.dmp

Download

memory/1164-137-0x0000000005420000-0x0000000005430000-memory.dmp

Download

memory/1164-138-0x0000000005420000-0x0000000005430000-memory.dmp

Download

memory/1164-139-0x0000000008470000-0x000000000850C000-memory.dmp

Download

memory/3296-140-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3296-142-0x0000000001640000-0x000000000198A000-memory.dmp

Download