formbook | 6ed8801868c8baadf89c50bff443e9c29002e0db951ee456ffba50bca1812d6d

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
30/09/2023, 12:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6ed8801868c8baadf89c50bff443e9c29002e0db951ee456ffba50bca1812d6d_JC.exe
Size

650KB
MD5

e189c425869e466d842c472d895035d7
SHA1

e50796539a9fd5c50f6569c00c2d01709bf203db
SHA256

6ed8801868c8baadf89c50bff443e9c29002e0db951ee456ffba50bca1812d6d
SHA512

49c10e95d653531d4f92c3377f351c5639971fb58513aac23c803bb4ba930de101c20dd77649e1dd7bb207e6ba64150af2c99deb174bb7a5d62fe948b6d308f1
SSDEEP

12288:VcrAckjQ5bLSqHcGdDY30I3lYPiICl45mLPKNDOvNvttVZeDh1:OkabLjcIc0I3l4wlBLCm7V

Score

10^/10

formbook 4hc5 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

4hc5

Decoy

amandaastburyillustration.com

7141999.com

showshoe.info

sagemarlin.com

lithuaniandreamtime.com

therenixgroupllc.com

avalialooks.shop

vurporn.com

lemmy.systems

2816goldfinch.com

pacersun.com

checktrace.com

loadtransfer.site

matsuri-jujutsukaisen.com

iontrapper.science

5108010.com

beidixi.com

21305599.com

peakvitality.fitness

osisfeelingfee.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/2384-13-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3024 set thread context of 2384	3024	6ed8801868c8baadf89c50bff443e9c29002e0db951ee456ffba50bca1812d6d_JC.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2384	6ed8801868c8baadf89c50bff443e9c29002e0db951ee456ffba50bca1812d6d_JC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2384	3024	6ed8801868c8baadf89c50bff443e9c29002e0db951ee456ffba50bca1812d6d_JC.exe	28
PID 3024 wrote to memory of 2384	3024	6ed8801868c8baadf89c50bff443e9c29002e0db951ee456ffba50bca1812d6d_JC.exe	28
PID 3024 wrote to memory of 2384	3024	6ed8801868c8baadf89c50bff443e9c29002e0db951ee456ffba50bca1812d6d_JC.exe	28
PID 3024 wrote to memory of 2384	3024	6ed8801868c8baadf89c50bff443e9c29002e0db951ee456ffba50bca1812d6d_JC.exe	28
PID 3024 wrote to memory of 2384	3024	6ed8801868c8baadf89c50bff443e9c29002e0db951ee456ffba50bca1812d6d_JC.exe	28
PID 3024 wrote to memory of 2384	3024	6ed8801868c8baadf89c50bff443e9c29002e0db951ee456ffba50bca1812d6d_JC.exe	28
PID 3024 wrote to memory of 2384	3024	6ed8801868c8baadf89c50bff443e9c29002e0db951ee456ffba50bca1812d6d_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\6ed8801868c8baadf89c50bff443e9c29002e0db951ee456ffba50bca1812d6d_JC.exe
"C:\Users\Admin\AppData\Local\Temp\6ed8801868c8baadf89c50bff443e9c29002e0db951ee456ffba50bca1812d6d_JC.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Users\Admin\AppData\Local\Temp\6ed8801868c8baadf89c50bff443e9c29002e0db951ee456ffba50bca1812d6d_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\6ed8801868c8baadf89c50bff443e9c29002e0db951ee456ffba50bca1812d6d_JC.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2384

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2384-9-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2384-15-0x00000000008F0000-0x0000000000BF3000-memory.dmp

Filesize
3.0MB

Download
memory/2384-13-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2384-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2384-10-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3024-3-0x0000000000820000-0x0000000000836000-memory.dmp

Filesize
88KB

Download
memory/3024-6-0x00000000004E0000-0x00000000004EA000-memory.dmp

Filesize
40KB

Download
memory/3024-7-0x0000000000580000-0x000000000058C000-memory.dmp

Filesize
48KB

Download
memory/3024-8-0x0000000005710000-0x000000000577E000-memory.dmp

Filesize
440KB

Download
memory/3024-5-0x0000000004BE0000-0x0000000004C20000-memory.dmp

Filesize
256KB

Download
memory/3024-4-0x0000000074AC0000-0x00000000751AE000-memory.dmp

Filesize
6.9MB

Download
memory/3024-0-0x0000000000EF0000-0x0000000000F98000-memory.dmp

Filesize
672KB

Download
memory/3024-2-0x0000000004BE0000-0x0000000004C20000-memory.dmp

Filesize
256KB

Download
memory/3024-14-0x0000000074AC0000-0x00000000751AE000-memory.dmp

Filesize
6.9MB

Download
memory/3024-1-0x0000000074AC0000-0x00000000751AE000-memory.dmp

Filesize
6.9MB

Download