formbook | 9867dc4c4aad89a47aa9fcdc726b5296dac1a3150520140e6d7da4836448d970

Analysis

max time kernel
46s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
08/06/2023, 10:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9867dc4c4aad89a47aa9fcdc726b5296dac1a3150520140e6d7da4836448d970.exe
Size 968KB
Sample230608-mxtcwsed99
SHA256 9867dc4c4aad89a47aa9fcdc726b5296dac1a3150520140e6d7da4836448d970
MD5 31b4c9a8410d02e19dfd38ac81944b90
SHA1 3196a4fa70bae053fa9c4aabb34eef6d6c8d1516
SHA512 8b15ecce9f6efb4c22a34cf4d0b58b2da3b25f73e3ec0794959c111582902f1386de73eb01bc84ae83fdee195600f1f5363a4e711e230dcd8fa11acd07a0c541
SSDEEP 24576:ddeb8P0iW3NMWVp+0w1Nj2dglxwmEgwF96fk:rP0iAiWP+0wDggsmEgmqk
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook gg04 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

gg04

Decoy

clothandsoulfabricllc.com
kx1336.com
4638.global
fixlaunchcredtunionmemb.online
indivexport.com
betuluzun.online
colossusboutique.com
hgcst.com
authorizer.online
hong-travel.com
globalwealthstrategiesco.com
fobberq.com
tribally.net
cook-a.com
todipjane.africa
membershipexams.africa
3dseal.online
abris-spb.ru
mkkkkk.net
chargecentral.store
chaudhrytraders.com
kooperatifemlak.com
cutematxhy.com
kasoraenterprises.com
juicydisco.app
bryconbenefits.com
kaleebet955.xyz
gfxadeel.tech
hanyawiki.xyz
vineuse.co.uk
dgoguincho.net
kngm-metall.ru
anime-room.com
clients-web.com
freeadmissiontickets.com
ctxlab.online
ds85.top
glossaryfashions.com
threesome.africa
invictusbr.online
dinyu001.com
cilumer.com
internationalfreight.tech
choicetricker.com
lukasladistores.africa
data-analyticsdegree.com
downloadtemplate.site
acebit.xyz
sunliftathleisure.com
socialunites.org.uk
4483.uk
aboutmeclothes.online
lovetext.africa
luieshop.com
xn--opoderosodogo-7eb.app
buggsfurniture.com
fanslylove.com
estockuk.co.uk
linkonweb.com
customscubadiving.com
sxcontu.xyz
thetobacconist.africa
africansinuk.co.uk
havenadvisorypartners.net
coquitoweek.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/1112-64-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 748 set thread context of 1112	748	9867dc4c4aad89a47aa9fcdc726b5296dac1a3150520140e6d7da4836448d970.exe	26

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1112	9867dc4c4aad89a47aa9fcdc726b5296dac1a3150520140e6d7da4836448d970.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 748 wrote to memory of 1112	748	9867dc4c4aad89a47aa9fcdc726b5296dac1a3150520140e6d7da4836448d970.exe	26
PID 748 wrote to memory of 1112	748	9867dc4c4aad89a47aa9fcdc726b5296dac1a3150520140e6d7da4836448d970.exe	26
PID 748 wrote to memory of 1112	748	9867dc4c4aad89a47aa9fcdc726b5296dac1a3150520140e6d7da4836448d970.exe	26
PID 748 wrote to memory of 1112	748	9867dc4c4aad89a47aa9fcdc726b5296dac1a3150520140e6d7da4836448d970.exe	26
PID 748 wrote to memory of 1112	748	9867dc4c4aad89a47aa9fcdc726b5296dac1a3150520140e6d7da4836448d970.exe	26
PID 748 wrote to memory of 1112	748	9867dc4c4aad89a47aa9fcdc726b5296dac1a3150520140e6d7da4836448d970.exe	26
PID 748 wrote to memory of 1112	748	9867dc4c4aad89a47aa9fcdc726b5296dac1a3150520140e6d7da4836448d970.exe	26

C:\Users\Admin\AppData\Local\Temp\9867dc4c4aad89a47aa9fcdc726b5296dac1a3150520140e6d7da4836448d970.exe
"C:\Users\Admin\AppData\Local\Temp\9867dc4c4aad89a47aa9fcdc726b5296dac1a3150520140e6d7da4836448d970.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:748
- C:\Users\Admin\AppData\Local\Temp\9867dc4c4aad89a47aa9fcdc726b5296dac1a3150520140e6d7da4836448d970.exe
  "C:\Users\Admin\AppData\Local\Temp\9867dc4c4aad89a47aa9fcdc726b5296dac1a3150520140e6d7da4836448d970.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1112

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/748-54-0x0000000000830000-0x0000000000928000-memory.dmp

Download

memory/748-55-0x0000000004CC0000-0x0000000004D00000-memory.dmp

Download

memory/748-56-0x00000000007A0000-0x00000000007B0000-memory.dmp

Download

memory/748-57-0x0000000004CC0000-0x0000000004D00000-memory.dmp

Download

memory/748-58-0x00000000007B0000-0x00000000007BA000-memory.dmp

Download

memory/748-59-0x0000000005840000-0x00000000058EA000-memory.dmp

Download

memory/748-60-0x00000000054D0000-0x0000000005544000-memory.dmp

Download

memory/1112-61-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1112-62-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1112-64-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1112-63-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/1112-65-0x0000000000BA0000-0x0000000000EA3000-memory.dmp

Download