formbook | 681b4fb5d374583fa961ba8ad171585c0ba9d2e346c5fbb6fce92392a10a2d16

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
22/08/2023, 15:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

681b4fb5d374583fa961ba8ad171585c0ba9d2e346c5fbb6fce92392a10a2d16_JC.exe
Size

637KB
MD5

bb712012e3d293f7b3fb208b7601be7b
SHA1

c6a1f7ec74df5f2b938afbd628ebf026000fac8f
SHA256

681b4fb5d374583fa961ba8ad171585c0ba9d2e346c5fbb6fce92392a10a2d16
SHA512

87a390327fd3260075470ffbf9ec36379f70fc3ffe06905bca354c5eba44987d2b77df5b00fea9fb2cdeefc2caeb1bee174def75d3e34e5344ffcd2613757537
SSDEEP

12288:vcaa4lrrE7cAakbrkpvv0hqjyPuiGYprf:vcz4lXEg3dvMojQSYpj

Score

10^/10

formbook oy30 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

oy30

Decoy

rfc234.top

danielcavalari.com

elperegrinocabo.com

aryor.info

surelistening.com

premium-numero-telf.buzz

orlynyml.click

tennislovers-ro.com

holdmytracker.com

eewapay.com

jaimesinstallglass.com

damactrade.net

swapspecialities.com

perfumesrffd.today

salesfactory.pro

supportive-solutions.com

naiol.com

khoyr.com

kalendeargpt44.com

web-tech-spb.store

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/2444-68-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1028 set thread context of 2444	1028	681b4fb5d374583fa961ba8ad171585c0ba9d2e346c5fbb6fce92392a10a2d16_JC.exe	30

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2444	681b4fb5d374583fa961ba8ad171585c0ba9d2e346c5fbb6fce92392a10a2d16_JC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1028 wrote to memory of 2444	1028	681b4fb5d374583fa961ba8ad171585c0ba9d2e346c5fbb6fce92392a10a2d16_JC.exe	30
PID 1028 wrote to memory of 2444	1028	681b4fb5d374583fa961ba8ad171585c0ba9d2e346c5fbb6fce92392a10a2d16_JC.exe	30
PID 1028 wrote to memory of 2444	1028	681b4fb5d374583fa961ba8ad171585c0ba9d2e346c5fbb6fce92392a10a2d16_JC.exe	30
PID 1028 wrote to memory of 2444	1028	681b4fb5d374583fa961ba8ad171585c0ba9d2e346c5fbb6fce92392a10a2d16_JC.exe	30
PID 1028 wrote to memory of 2444	1028	681b4fb5d374583fa961ba8ad171585c0ba9d2e346c5fbb6fce92392a10a2d16_JC.exe	30
PID 1028 wrote to memory of 2444	1028	681b4fb5d374583fa961ba8ad171585c0ba9d2e346c5fbb6fce92392a10a2d16_JC.exe	30
PID 1028 wrote to memory of 2444	1028	681b4fb5d374583fa961ba8ad171585c0ba9d2e346c5fbb6fce92392a10a2d16_JC.exe	30

C:\Users\Admin\AppData\Local\Temp\681b4fb5d374583fa961ba8ad171585c0ba9d2e346c5fbb6fce92392a10a2d16_JC.exe
"C:\Users\Admin\AppData\Local\Temp\681b4fb5d374583fa961ba8ad171585c0ba9d2e346c5fbb6fce92392a10a2d16_JC.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Users\Admin\AppData\Local\Temp\681b4fb5d374583fa961ba8ad171585c0ba9d2e346c5fbb6fce92392a10a2d16_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\681b4fb5d374583fa961ba8ad171585c0ba9d2e346c5fbb6fce92392a10a2d16_JC.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2444

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1028-60-0x0000000001F80000-0x0000000001F8E000-memory.dmp

Filesize
56KB

Download
memory/1028-69-0x0000000074690000-0x0000000074D7E000-memory.dmp

Filesize
6.9MB

Download
memory/1028-56-0x0000000004680000-0x00000000046C0000-memory.dmp

Filesize
256KB

Download
memory/1028-57-0x0000000001F30000-0x0000000001F40000-memory.dmp

Filesize
64KB

Download
memory/1028-58-0x0000000074690000-0x0000000074D7E000-memory.dmp

Filesize
6.9MB

Download
memory/1028-59-0x0000000004680000-0x00000000046C0000-memory.dmp

Filesize
256KB

Download
memory/1028-61-0x0000000005BF0000-0x0000000005C5E000-memory.dmp

Filesize
440KB

Download
memory/1028-54-0x0000000000180000-0x0000000000226000-memory.dmp

Filesize
664KB

Download
memory/1028-55-0x0000000074690000-0x0000000074D7E000-memory.dmp

Filesize
6.9MB

Download
memory/2444-64-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2444-66-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2444-68-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2444-62-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2444-70-0x0000000000930000-0x0000000000C33000-memory.dmp

Filesize
3.0MB

Download