formbook | c751b1369af3d6c58b101c6605dee97559f910f23c009cc41ddff70c0ab06a0f

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
23-06-2023 06:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ORDER#KG23AG007_JUNE2023_SHYAM_GRSOUP_IND.exe
Size

318KB
MD5

7747a48635cb9f24aebd42ad05fcde93
SHA1

165a095cdb3c9b0591d04efb2ab8caecebbc667a
SHA256

c751b1369af3d6c58b101c6605dee97559f910f23c009cc41ddff70c0ab06a0f
SHA512

72942bebb56793385b73e22b3e870b1db40231792b5142d6b2098b6b5067b8e451e113b010b595a704d633f4cd246adf98f653529956db5ad18d0269bbc8610b
SSDEEP

6144:BYa6xMRpovPU7YD0MPQGndKuRFXro+r9LLR8uKB5Wgp2:BY7wKt0MBdlrt5nRHKB5R2

Score

10^/10

formbook ng04 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ng04

Decoy

christinegnigler.com

shukydeco.com

yuncaibg.com

eikjjs.cloud

cautamhouri.xyz

furtkagrsets.xyz

zhaoshang0197.shop

maraduncan.autos

aircleanlimited.com

simplificandotdah.com

ggs-1126.cyou

6848us.com

g1fx2.xyz

earnmoneyhelper.com

mbh123.xyz

1803734.com

blur-x-proof.xyz

dfwbusinessconnection.com

clubbeyyresorthotel.com

iittzz.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/364-61-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Loads dropped DLL 1 IoCs

Processes:

ORDER#KG23AG007_JUNE2023_SHYAM_GRSOUP_IND.exe

pid process

1664 ORDER#KG23AG007_JUNE2023_SHYAM_GRSOUP_IND.exe

pid	process
1664	ORDER#KG23AG007_JUNE2023_SHYAM_GRSOUP_IND.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

ORDER#KG23AG007_JUNE2023_SHYAM_GRSOUP_IND.exe

description	pid	process	target process
PID 1664 set thread context of 364	1664	ORDER#KG23AG007_JUNE2023_SHYAM_GRSOUP_IND.exe	ORDER#KG23AG007_JUNE2023_SHYAM_GRSOUP_IND.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

ORDER#KG23AG007_JUNE2023_SHYAM_GRSOUP_IND.exe

pid process

364 ORDER#KG23AG007_JUNE2023_SHYAM_GRSOUP_IND.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

ORDER#KG23AG007_JUNE2023_SHYAM_GRSOUP_IND.exe

pid process

1664 ORDER#KG23AG007_JUNE2023_SHYAM_GRSOUP_IND.exe

pid	process
364	ORDER#KG23AG007_JUNE2023_SHYAM_GRSOUP_IND.exe

pid	process
1664	ORDER#KG23AG007_JUNE2023_SHYAM_GRSOUP_IND.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

ORDER#KG23AG007_JUNE2023_SHYAM_GRSOUP_IND.exe

description	pid	process	target process
PID 1664 wrote to memory of 364	1664	ORDER#KG23AG007_JUNE2023_SHYAM_GRSOUP_IND.exe	ORDER#KG23AG007_JUNE2023_SHYAM_GRSOUP_IND.exe
PID 1664 wrote to memory of 364	1664	ORDER#KG23AG007_JUNE2023_SHYAM_GRSOUP_IND.exe	ORDER#KG23AG007_JUNE2023_SHYAM_GRSOUP_IND.exe
PID 1664 wrote to memory of 364	1664	ORDER#KG23AG007_JUNE2023_SHYAM_GRSOUP_IND.exe	ORDER#KG23AG007_JUNE2023_SHYAM_GRSOUP_IND.exe
PID 1664 wrote to memory of 364	1664	ORDER#KG23AG007_JUNE2023_SHYAM_GRSOUP_IND.exe	ORDER#KG23AG007_JUNE2023_SHYAM_GRSOUP_IND.exe
PID 1664 wrote to memory of 364	1664	ORDER#KG23AG007_JUNE2023_SHYAM_GRSOUP_IND.exe	ORDER#KG23AG007_JUNE2023_SHYAM_GRSOUP_IND.exe

C:\Users\Admin\AppData\Local\Temp\ORDER#KG23AG007_JUNE2023_SHYAM_GRSOUP_IND.exe
"C:\Users\Admin\AppData\Local\Temp\ORDER#KG23AG007_JUNE2023_SHYAM_GRSOUP_IND.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1664

C:\Users\Admin\AppData\Local\Temp\ORDER#KG23AG007_JUNE2023_SHYAM_GRSOUP_IND.exe
"C:\Users\Admin\AppData\Local\Temp\ORDER#KG23AG007_JUNE2023_SHYAM_GRSOUP_IND.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:364

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nso35E.tmp\vwoslw.dll
Filesize
41KB

MD5
a71d9f8347f763684d8df1027d95b805

SHA1
f2a1089da9d3caad65d68ee94948dd9278c40e31

SHA256
94ddf37c0bf60b116a9fbc3d59943035a89fba7ff3b85306f3753f04a677c184

SHA512
0a69c7d14b385d763e0ae9462f9348102cd9715302e5b92e38cd11acce05629df12202519a089fa633b241e0256cf9b131beae47f5d78371cddef2c42b08ef7b

Download Submit
memory/364-61-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/364-64-0x00000000008B0000-0x0000000000BB3000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads