formbook | 6980c552a8fccf4806027dc577cb1be5dd3e12612053494ce81ba528667ddd9f

Analysis

max time kernel
138s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
08/06/2023, 11:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6980c552a8fccf4806027dc577cb1be5dd3e12612053494ce81ba528667ddd9f.exe
Size 732KB
Sample230608-n456psfa94
SHA256 6980c552a8fccf4806027dc577cb1be5dd3e12612053494ce81ba528667ddd9f
MD5 bf3e18325565c43290cb7c4df1e13e85
SHA1 044f88248c883fcab57cd2e5fb7ca6766e22d6ff
SHA512 736b8fd57ff5274ce22ba27efff483133a5bcd4bca44a2daa72654e205d514559e984eb217d7ffab42c785f3fc166dcafca369deac3dd65ec9f672665459a98b
SSDEEP 12288:xHkmFx2iqNhujGjUThA2LiXvBCK5HpVkp5gSsRcn6idjiEG4YubxtEk38:xEmFxUojiXv0sVjtkji4YkxL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook ca82 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

ca82

Decoy

idunresearch.com
loiioo1.site
aimobilify.com
limousineswebdesign.com
darshan-enterprises.online
javad.top
dd-spy.com
metamysme.co.uk
earticlesdirect.com
ldkj78v.vip
dariusevory.com
bestyoutubepromoter.com
dogcoinacademy.com
mestredosexo.net
mrnofree.africa
plan.rsvp
hoangnam.site
cadcamperform.com
091888.net
artwaylogistics.com
bigsky1roofing.net
kr-eats.com
millenniumtutors.africa
clarebushire.com
amazonnews.top
farmacoachdigital.com
lasmeralda.net
baochuanlp.com
golf-break100again.com
kgconstrucoes.com
anamaciasdeharo.com
callgaryz.com
dbfsolutely.net
193yz96.xyz
yetcox.online
bet168.plus
lobbyspace.net
kui693.com
athm-consulting.com
warrenlee.africa
kellnovaglobalfood.info
premierpath.net
floffly.art
alaiatech.net
motherpearl.africa
daxiangya.com
mandytelecoms.africa
mbtglobal.africa
dazzleexchange.com
jacksontcpsettlement.com
gadjet1111.com
indiciacompany.com
artistpu.com
colonbroom-reviews.com
leaptrainings.com
harataka.com
athma.xyz
id6w.xyz
hakilakingllc.com
getripay.africa
comedyescape.show
lieblingsmusik.events
bridgerenvm.com
allard-electrical.com
kode-promo.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/1368-140-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4644 set thread context of 1368	4644	6980c552a8fccf4806027dc577cb1be5dd3e12612053494ce81ba528667ddd9f.exe	90

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1368	6980c552a8fccf4806027dc577cb1be5dd3e12612053494ce81ba528667ddd9f.exe
1368	6980c552a8fccf4806027dc577cb1be5dd3e12612053494ce81ba528667ddd9f.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 1368	4644	6980c552a8fccf4806027dc577cb1be5dd3e12612053494ce81ba528667ddd9f.exe	90
PID 4644 wrote to memory of 1368	4644	6980c552a8fccf4806027dc577cb1be5dd3e12612053494ce81ba528667ddd9f.exe	90
PID 4644 wrote to memory of 1368	4644	6980c552a8fccf4806027dc577cb1be5dd3e12612053494ce81ba528667ddd9f.exe	90
PID 4644 wrote to memory of 1368	4644	6980c552a8fccf4806027dc577cb1be5dd3e12612053494ce81ba528667ddd9f.exe	90
PID 4644 wrote to memory of 1368	4644	6980c552a8fccf4806027dc577cb1be5dd3e12612053494ce81ba528667ddd9f.exe	90
PID 4644 wrote to memory of 1368	4644	6980c552a8fccf4806027dc577cb1be5dd3e12612053494ce81ba528667ddd9f.exe	90

C:\Users\Admin\AppData\Local\Temp\6980c552a8fccf4806027dc577cb1be5dd3e12612053494ce81ba528667ddd9f.exe
"C:\Users\Admin\AppData\Local\Temp\6980c552a8fccf4806027dc577cb1be5dd3e12612053494ce81ba528667ddd9f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Users\Admin\AppData\Local\Temp\6980c552a8fccf4806027dc577cb1be5dd3e12612053494ce81ba528667ddd9f.exe
  "C:\Users\Admin\AppData\Local\Temp\6980c552a8fccf4806027dc577cb1be5dd3e12612053494ce81ba528667ddd9f.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1368-140-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1368-142-0x0000000001440000-0x000000000178A000-memory.dmp

Download

memory/4644-133-0x00000000006F0000-0x00000000007AC000-memory.dmp

Download

memory/4644-134-0x0000000005840000-0x0000000005DE4000-memory.dmp

Download

memory/4644-135-0x0000000005180000-0x0000000005212000-memory.dmp

Download

memory/4644-136-0x0000000002D10000-0x0000000002D1A000-memory.dmp

Download

memory/4644-137-0x0000000002CB0000-0x0000000002CC0000-memory.dmp

Download

memory/4644-138-0x0000000002CB0000-0x0000000002CC0000-memory.dmp

Download

memory/4644-139-0x0000000007100000-0x000000000719C000-memory.dmp

Download