formbook | 02971b038e3224fb89a5aa824cd4388ab3108e86571312d127e32b6a59b1b3ec

Analysis

max time kernel
122s
max time network
142s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11/10/2023, 11:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

02971b038e3224fb89a5aa824cd4388ab3108e86571312d127e32b6a59b1b3ec_JC.exe
Size

642KB
MD5

2673a176c9729737316a6e6d660f0f79
SHA1

f3466f9e8e6d1c9e9d22e6fe9e2ee601d9c22788
SHA256

02971b038e3224fb89a5aa824cd4388ab3108e86571312d127e32b6a59b1b3ec
SHA512

9e6d7703c8993e27b86bc5d4549e224db18176034e6d4331ab483dc187c77c543084cef2468a368a1dd48b0d678dc8f509ababb185b97d7756c426948442e958
SSDEEP

12288:KayccWwjCUqEupAtlUpQSkHBkiyrhKwAKNdI0U+VRslA7jbA:0CdEupkl4RmkvyeI0TR17j

Score

10^/10

formbook sn26 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

sn26

Decoy

resenha10.bet

gulshan-rajput.com

xbus.tech

z813my.cfd

wlxzjlny.cfd

auntengotiempo.com

canada-reservation.com

thegiftcompany.shop

esthersilveirapropiedades.com

1wapws.top

ymjblnvo.cfd

termokimik.net

kushiro-artist-school.com

bmmboo.com

caceresconstructionservices.com

kentuckywalkabout.com

bringyourcart.com

miamiwinetour.com

bobcatsocial.site

thirdmind.network

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/2212-14-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 748 set thread context of 2212	748	02971b038e3224fb89a5aa824cd4388ab3108e86571312d127e32b6a59b1b3ec_JC.exe	30

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2212	02971b038e3224fb89a5aa824cd4388ab3108e86571312d127e32b6a59b1b3ec_JC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 748 wrote to memory of 2212	748	02971b038e3224fb89a5aa824cd4388ab3108e86571312d127e32b6a59b1b3ec_JC.exe	30
PID 748 wrote to memory of 2212	748	02971b038e3224fb89a5aa824cd4388ab3108e86571312d127e32b6a59b1b3ec_JC.exe	30
PID 748 wrote to memory of 2212	748	02971b038e3224fb89a5aa824cd4388ab3108e86571312d127e32b6a59b1b3ec_JC.exe	30
PID 748 wrote to memory of 2212	748	02971b038e3224fb89a5aa824cd4388ab3108e86571312d127e32b6a59b1b3ec_JC.exe	30
PID 748 wrote to memory of 2212	748	02971b038e3224fb89a5aa824cd4388ab3108e86571312d127e32b6a59b1b3ec_JC.exe	30
PID 748 wrote to memory of 2212	748	02971b038e3224fb89a5aa824cd4388ab3108e86571312d127e32b6a59b1b3ec_JC.exe	30
PID 748 wrote to memory of 2212	748	02971b038e3224fb89a5aa824cd4388ab3108e86571312d127e32b6a59b1b3ec_JC.exe	30

C:\Users\Admin\AppData\Local\Temp\02971b038e3224fb89a5aa824cd4388ab3108e86571312d127e32b6a59b1b3ec_JC.exe
"C:\Users\Admin\AppData\Local\Temp\02971b038e3224fb89a5aa824cd4388ab3108e86571312d127e32b6a59b1b3ec_JC.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:748
- C:\Users\Admin\AppData\Local\Temp\02971b038e3224fb89a5aa824cd4388ab3108e86571312d127e32b6a59b1b3ec_JC.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2212

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/748-6-0x0000000005C10000-0x0000000005CAA000-memory.dmp

Filesize
616KB

Download
memory/748-15-0x00000000744F0000-0x0000000074BDE000-memory.dmp

Filesize
6.9MB

Download
memory/748-2-0x0000000004CE0000-0x0000000004D20000-memory.dmp

Filesize
256KB

Download
memory/748-3-0x0000000000920000-0x000000000092C000-memory.dmp

Filesize
48KB

Download
memory/748-4-0x00000000744F0000-0x0000000074BDE000-memory.dmp

Filesize
6.9MB

Download
memory/748-5-0x0000000004CE0000-0x0000000004D20000-memory.dmp

Filesize
256KB

Download
memory/748-7-0x0000000000C50000-0x0000000000C98000-memory.dmp

Filesize
288KB

Download
memory/748-0-0x00000000744F0000-0x0000000074BDE000-memory.dmp

Filesize
6.9MB

Download
memory/748-1-0x00000000012D0000-0x0000000001376000-memory.dmp

Filesize
664KB

Download
memory/2212-10-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2212-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2212-14-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2212-8-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2212-16-0x0000000000A20000-0x0000000000D23000-memory.dmp

Filesize
3.0MB

Download