formbook | 9867dc4c4aad89a47aa9fcdc726b5296dac1a3150520140e6d7da4836448d970

Analysis

max time kernel
54s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
08/06/2023, 10:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9867dc4c4aad89a47aa9fcdc726b5296dac1a3150520140e6d7da4836448d970.exe
Size 968KB
Sample230608-mxtcwsed99
SHA256 9867dc4c4aad89a47aa9fcdc726b5296dac1a3150520140e6d7da4836448d970
MD5 31b4c9a8410d02e19dfd38ac81944b90
SHA1 3196a4fa70bae053fa9c4aabb34eef6d6c8d1516
SHA512 8b15ecce9f6efb4c22a34cf4d0b58b2da3b25f73e3ec0794959c111582902f1386de73eb01bc84ae83fdee195600f1f5363a4e711e230dcd8fa11acd07a0c541
SSDEEP 24576:ddeb8P0iW3NMWVp+0w1Nj2dglxwmEgwF96fk:rP0iAiWP+0wDggsmEgmqk
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook gg04 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

gg04

Decoy

clothandsoulfabricllc.com
kx1336.com
4638.global
fixlaunchcredtunionmemb.online
indivexport.com
betuluzun.online
colossusboutique.com
hgcst.com
authorizer.online
hong-travel.com
globalwealthstrategiesco.com
fobberq.com
tribally.net
cook-a.com
todipjane.africa
membershipexams.africa
3dseal.online
abris-spb.ru
mkkkkk.net
chargecentral.store
chaudhrytraders.com
kooperatifemlak.com
cutematxhy.com
kasoraenterprises.com
juicydisco.app
bryconbenefits.com
kaleebet955.xyz
gfxadeel.tech
hanyawiki.xyz
vineuse.co.uk
dgoguincho.net
kngm-metall.ru
anime-room.com
clients-web.com
freeadmissiontickets.com
ctxlab.online
ds85.top
glossaryfashions.com
threesome.africa
invictusbr.online
dinyu001.com
cilumer.com
internationalfreight.tech
choicetricker.com
lukasladistores.africa
data-analyticsdegree.com
downloadtemplate.site
acebit.xyz
sunliftathleisure.com
socialunites.org.uk
4483.uk
aboutmeclothes.online
lovetext.africa
luieshop.com
xn--opoderosodogo-7eb.app
buggsfurniture.com
fanslylove.com
estockuk.co.uk
linkonweb.com
customscubadiving.com
sxcontu.xyz
thetobacconist.africa
africansinuk.co.uk
havenadvisorypartners.net
coquitoweek.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/2236-140-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4360 set thread context of 2236	4360	9867dc4c4aad89a47aa9fcdc726b5296dac1a3150520140e6d7da4836448d970.exe	89

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2236	9867dc4c4aad89a47aa9fcdc726b5296dac1a3150520140e6d7da4836448d970.exe
2236	9867dc4c4aad89a47aa9fcdc726b5296dac1a3150520140e6d7da4836448d970.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4360 wrote to memory of 2236	4360	9867dc4c4aad89a47aa9fcdc726b5296dac1a3150520140e6d7da4836448d970.exe	89
PID 4360 wrote to memory of 2236	4360	9867dc4c4aad89a47aa9fcdc726b5296dac1a3150520140e6d7da4836448d970.exe	89
PID 4360 wrote to memory of 2236	4360	9867dc4c4aad89a47aa9fcdc726b5296dac1a3150520140e6d7da4836448d970.exe	89
PID 4360 wrote to memory of 2236	4360	9867dc4c4aad89a47aa9fcdc726b5296dac1a3150520140e6d7da4836448d970.exe	89
PID 4360 wrote to memory of 2236	4360	9867dc4c4aad89a47aa9fcdc726b5296dac1a3150520140e6d7da4836448d970.exe	89
PID 4360 wrote to memory of 2236	4360	9867dc4c4aad89a47aa9fcdc726b5296dac1a3150520140e6d7da4836448d970.exe	89

C:\Users\Admin\AppData\Local\Temp\9867dc4c4aad89a47aa9fcdc726b5296dac1a3150520140e6d7da4836448d970.exe
"C:\Users\Admin\AppData\Local\Temp\9867dc4c4aad89a47aa9fcdc726b5296dac1a3150520140e6d7da4836448d970.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4360
- C:\Users\Admin\AppData\Local\Temp\9867dc4c4aad89a47aa9fcdc726b5296dac1a3150520140e6d7da4836448d970.exe
  "C:\Users\Admin\AppData\Local\Temp\9867dc4c4aad89a47aa9fcdc726b5296dac1a3150520140e6d7da4836448d970.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2236

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2236-140-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2236-142-0x0000000001400000-0x000000000174A000-memory.dmp

Download

memory/4360-133-0x0000000000140000-0x0000000000238000-memory.dmp

Download

memory/4360-134-0x0000000005260000-0x0000000005804000-memory.dmp

Download

memory/4360-135-0x0000000004BE0000-0x0000000004C72000-memory.dmp

Download

memory/4360-136-0x0000000004C90000-0x0000000004C9A000-memory.dmp

Download

memory/4360-137-0x0000000004D30000-0x0000000004D40000-memory.dmp

Download

memory/4360-138-0x0000000004D30000-0x0000000004D40000-memory.dmp

Download

memory/4360-139-0x00000000066D0000-0x000000000676C000-memory.dmp

Download