formbook | 6ed8801868c8baadf89c50bff443e9c29002e0db951ee456ffba50bca1812d6d

Analysis

max time kernel
155s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
30-09-2023 12:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6ed8801868c8baadf89c50bff443e9c29002e0db951ee456ffba50bca1812d6d_JC.exe
Size

650KB
MD5

e189c425869e466d842c472d895035d7
SHA1

e50796539a9fd5c50f6569c00c2d01709bf203db
SHA256

6ed8801868c8baadf89c50bff443e9c29002e0db951ee456ffba50bca1812d6d
SHA512

49c10e95d653531d4f92c3377f351c5639971fb58513aac23c803bb4ba930de101c20dd77649e1dd7bb207e6ba64150af2c99deb174bb7a5d62fe948b6d308f1
SSDEEP

12288:VcrAckjQ5bLSqHcGdDY30I3lYPiICl45mLPKNDOvNvttVZeDh1:OkabLjcIc0I3l4wlBLCm7V

Score

10^/10

formbook 4hc5 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

4hc5

Decoy

amandaastburyillustration.com

7141999.com

showshoe.info

sagemarlin.com

lithuaniandreamtime.com

therenixgroupllc.com

avalialooks.shop

vurporn.com

lemmy.systems

2816goldfinch.com

pacersun.com

checktrace.com

loadtransfer.site

matsuri-jujutsukaisen.com

iontrapper.science

5108010.com

beidixi.com

21305599.com

peakvitality.fitness

osisfeelingfee.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/1268-13-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 328 set thread context of 1268	328	6ed8801868c8baadf89c50bff443e9c29002e0db951ee456ffba50bca1812d6d_JC.exe	98

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1268	6ed8801868c8baadf89c50bff443e9c29002e0db951ee456ffba50bca1812d6d_JC.exe
1268	6ed8801868c8baadf89c50bff443e9c29002e0db951ee456ffba50bca1812d6d_JC.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 328 wrote to memory of 1268	328	6ed8801868c8baadf89c50bff443e9c29002e0db951ee456ffba50bca1812d6d_JC.exe	98
PID 328 wrote to memory of 1268	328	6ed8801868c8baadf89c50bff443e9c29002e0db951ee456ffba50bca1812d6d_JC.exe	98
PID 328 wrote to memory of 1268	328	6ed8801868c8baadf89c50bff443e9c29002e0db951ee456ffba50bca1812d6d_JC.exe	98
PID 328 wrote to memory of 1268	328	6ed8801868c8baadf89c50bff443e9c29002e0db951ee456ffba50bca1812d6d_JC.exe	98
PID 328 wrote to memory of 1268	328	6ed8801868c8baadf89c50bff443e9c29002e0db951ee456ffba50bca1812d6d_JC.exe	98
PID 328 wrote to memory of 1268	328	6ed8801868c8baadf89c50bff443e9c29002e0db951ee456ffba50bca1812d6d_JC.exe	98

C:\Users\Admin\AppData\Local\Temp\6ed8801868c8baadf89c50bff443e9c29002e0db951ee456ffba50bca1812d6d_JC.exe
"C:\Users\Admin\AppData\Local\Temp\6ed8801868c8baadf89c50bff443e9c29002e0db951ee456ffba50bca1812d6d_JC.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:328
- C:\Users\Admin\AppData\Local\Temp\6ed8801868c8baadf89c50bff443e9c29002e0db951ee456ffba50bca1812d6d_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\6ed8801868c8baadf89c50bff443e9c29002e0db951ee456ffba50bca1812d6d_JC.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1268

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/328-8-0x0000000004E90000-0x0000000004EA0000-memory.dmp

Filesize
64KB

Download
memory/328-6-0x0000000006860000-0x0000000006876000-memory.dmp

Filesize
88KB

Download
memory/328-2-0x00000000053A0000-0x0000000005944000-memory.dmp

Filesize
5.6MB

Download
memory/328-3-0x0000000004ED0000-0x0000000004F62000-memory.dmp

Filesize
584KB

Download
memory/328-0-0x0000000000430000-0x00000000004D8000-memory.dmp

Filesize
672KB

Download
memory/328-5-0x0000000005080000-0x000000000508A000-memory.dmp

Filesize
40KB

Download
memory/328-1-0x00000000749B0000-0x0000000075160000-memory.dmp

Filesize
7.7MB

Download
memory/328-7-0x00000000749B0000-0x0000000075160000-memory.dmp

Filesize
7.7MB

Download
memory/328-4-0x0000000004E90000-0x0000000004EA0000-memory.dmp

Filesize
64KB

Download
memory/328-9-0x0000000006B10000-0x0000000006B1A000-memory.dmp

Filesize
40KB

Download
memory/328-10-0x0000000006B20000-0x0000000006B2C000-memory.dmp

Filesize
48KB

Download
memory/328-11-0x0000000006DC0000-0x0000000006E2E000-memory.dmp

Filesize
440KB

Download
memory/328-12-0x00000000094A0000-0x000000000953C000-memory.dmp

Filesize
624KB

Download
memory/328-15-0x00000000749B0000-0x0000000075160000-memory.dmp

Filesize
7.7MB

Download
memory/1268-13-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1268-16-0x0000000001430000-0x000000000177A000-memory.dmp

Filesize
3.3MB

Download