formbook | 681b4fb5d374583fa961ba8ad171585c0ba9d2e346c5fbb6fce92392a10a2d16

Analysis

max time kernel
143s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
22-08-2023 15:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

681b4fb5d374583fa961ba8ad171585c0ba9d2e346c5fbb6fce92392a10a2d16_JC.exe
Size

637KB
MD5

bb712012e3d293f7b3fb208b7601be7b
SHA1

c6a1f7ec74df5f2b938afbd628ebf026000fac8f
SHA256

681b4fb5d374583fa961ba8ad171585c0ba9d2e346c5fbb6fce92392a10a2d16
SHA512

87a390327fd3260075470ffbf9ec36379f70fc3ffe06905bca354c5eba44987d2b77df5b00fea9fb2cdeefc2caeb1bee174def75d3e34e5344ffcd2613757537
SSDEEP

12288:vcaa4lrrE7cAakbrkpvv0hqjyPuiGYprf:vcz4lXEg3dvMojQSYpj

Score

10^/10

formbook oy30 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

oy30

Decoy

rfc234.top

danielcavalari.com

elperegrinocabo.com

aryor.info

surelistening.com

premium-numero-telf.buzz

orlynyml.click

tennislovers-ro.com

holdmytracker.com

eewapay.com

jaimesinstallglass.com

damactrade.net

swapspecialities.com

perfumesrffd.today

salesfactory.pro

supportive-solutions.com

naiol.com

khoyr.com

kalendeargpt44.com

web-tech-spb.store

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/4464-142-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3436 set thread context of 4464	3436	681b4fb5d374583fa961ba8ad171585c0ba9d2e346c5fbb6fce92392a10a2d16_JC.exe	89

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4464	681b4fb5d374583fa961ba8ad171585c0ba9d2e346c5fbb6fce92392a10a2d16_JC.exe
4464	681b4fb5d374583fa961ba8ad171585c0ba9d2e346c5fbb6fce92392a10a2d16_JC.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3436 wrote to memory of 4464	3436	681b4fb5d374583fa961ba8ad171585c0ba9d2e346c5fbb6fce92392a10a2d16_JC.exe	89
PID 3436 wrote to memory of 4464	3436	681b4fb5d374583fa961ba8ad171585c0ba9d2e346c5fbb6fce92392a10a2d16_JC.exe	89
PID 3436 wrote to memory of 4464	3436	681b4fb5d374583fa961ba8ad171585c0ba9d2e346c5fbb6fce92392a10a2d16_JC.exe	89
PID 3436 wrote to memory of 4464	3436	681b4fb5d374583fa961ba8ad171585c0ba9d2e346c5fbb6fce92392a10a2d16_JC.exe	89
PID 3436 wrote to memory of 4464	3436	681b4fb5d374583fa961ba8ad171585c0ba9d2e346c5fbb6fce92392a10a2d16_JC.exe	89
PID 3436 wrote to memory of 4464	3436	681b4fb5d374583fa961ba8ad171585c0ba9d2e346c5fbb6fce92392a10a2d16_JC.exe	89

C:\Users\Admin\AppData\Local\Temp\681b4fb5d374583fa961ba8ad171585c0ba9d2e346c5fbb6fce92392a10a2d16_JC.exe
"C:\Users\Admin\AppData\Local\Temp\681b4fb5d374583fa961ba8ad171585c0ba9d2e346c5fbb6fce92392a10a2d16_JC.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3436
- C:\Users\Admin\AppData\Local\Temp\681b4fb5d374583fa961ba8ad171585c0ba9d2e346c5fbb6fce92392a10a2d16_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\681b4fb5d374583fa961ba8ad171585c0ba9d2e346c5fbb6fce92392a10a2d16_JC.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4464

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3436-134-0x0000000074E60000-0x0000000075610000-memory.dmp

Filesize
7.7MB

Download
memory/3436-133-0x00000000007D0000-0x0000000000876000-memory.dmp

Filesize
664KB

Download
memory/3436-135-0x0000000005820000-0x0000000005DC4000-memory.dmp

Filesize
5.6MB

Download
memory/3436-136-0x0000000005270000-0x0000000005302000-memory.dmp

Filesize
584KB

Download
memory/3436-137-0x0000000005480000-0x0000000005490000-memory.dmp

Filesize
64KB

Download
memory/3436-138-0x0000000005410000-0x000000000541A000-memory.dmp

Filesize
40KB

Download
memory/3436-139-0x0000000074E60000-0x0000000075610000-memory.dmp

Filesize
7.7MB

Download
memory/3436-140-0x0000000005480000-0x0000000005490000-memory.dmp

Filesize
64KB

Download
memory/3436-141-0x000000000AB10000-0x000000000ABAC000-memory.dmp

Filesize
624KB

Download
memory/3436-144-0x0000000074E60000-0x0000000075610000-memory.dmp

Filesize
7.7MB

Download
memory/4464-142-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4464-145-0x0000000001030000-0x000000000137A000-memory.dmp

Filesize
3.3MB

Download