formbook | e8daa9482a4d8379e8a1d3dea17ccb16746dc786522acfe79da2b833c525a9b6

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2023 13:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e8daa9482a4d8379e8a1d3dea17ccb16746dc786522acfe79da2b833c525a9b6.exe
Size

670KB
MD5

63d2a92b555fca71818d466c3f901b1c
SHA1

e8aa60ba1257726d74bc0f7664a3e854ce971c26
SHA256

e8daa9482a4d8379e8a1d3dea17ccb16746dc786522acfe79da2b833c525a9b6
SHA512

d415d26c953fdca8ccafc7170539f655323cd5a88d8bc449f1cd70ea765344ac29e8cc0d24cb6bdd4f3964862fe30b898c52ad895dd1f84f33305aec28d94edc
SSDEEP

12288:ZIswfJw1UDXxpkUK74GC3O+H15a6yPhH82g4vdhDz4Gf3Ol9:gBwQdK1i1iPRvnDzV

Score

10^/10

formbook ro12 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ro12

Decoy

start399.com

decyfincoin.com

binguozhijiaok.com

one45.vip

55dy5s.top

regmt.pro

2ahxgaafifl.com

xn--6rtp2flvfc2h.com

justinmburns.com

los3.online

fleshaaikensdivinegiven7llc.com

servicedelv.services

apexcaryhomesforsale.com

shuraop.xyz

sagetotal.com

gratitude-et-compagnie.com

riderarea.com

digitalserviceact.online

contentbyc.com

agenda-digital-planner.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/3824-15-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4768 set thread context of 3824	4768	e8daa9482a4d8379e8a1d3dea17ccb16746dc786522acfe79da2b833c525a9b6.exe	91

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4768	e8daa9482a4d8379e8a1d3dea17ccb16746dc786522acfe79da2b833c525a9b6.exe
4768	e8daa9482a4d8379e8a1d3dea17ccb16746dc786522acfe79da2b833c525a9b6.exe
4768	e8daa9482a4d8379e8a1d3dea17ccb16746dc786522acfe79da2b833c525a9b6.exe
4768	e8daa9482a4d8379e8a1d3dea17ccb16746dc786522acfe79da2b833c525a9b6.exe
4768	e8daa9482a4d8379e8a1d3dea17ccb16746dc786522acfe79da2b833c525a9b6.exe
4768	e8daa9482a4d8379e8a1d3dea17ccb16746dc786522acfe79da2b833c525a9b6.exe
3824	e8daa9482a4d8379e8a1d3dea17ccb16746dc786522acfe79da2b833c525a9b6.exe
3824	e8daa9482a4d8379e8a1d3dea17ccb16746dc786522acfe79da2b833c525a9b6.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4768	e8daa9482a4d8379e8a1d3dea17ccb16746dc786522acfe79da2b833c525a9b6.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 3824	4768	e8daa9482a4d8379e8a1d3dea17ccb16746dc786522acfe79da2b833c525a9b6.exe	91
PID 4768 wrote to memory of 3824	4768	e8daa9482a4d8379e8a1d3dea17ccb16746dc786522acfe79da2b833c525a9b6.exe	91
PID 4768 wrote to memory of 3824	4768	e8daa9482a4d8379e8a1d3dea17ccb16746dc786522acfe79da2b833c525a9b6.exe	91
PID 4768 wrote to memory of 3824	4768	e8daa9482a4d8379e8a1d3dea17ccb16746dc786522acfe79da2b833c525a9b6.exe	91
PID 4768 wrote to memory of 3824	4768	e8daa9482a4d8379e8a1d3dea17ccb16746dc786522acfe79da2b833c525a9b6.exe	91
PID 4768 wrote to memory of 3824	4768	e8daa9482a4d8379e8a1d3dea17ccb16746dc786522acfe79da2b833c525a9b6.exe	91

C:\Users\Admin\AppData\Local\Temp\e8daa9482a4d8379e8a1d3dea17ccb16746dc786522acfe79da2b833c525a9b6.exe
"C:\Users\Admin\AppData\Local\Temp\e8daa9482a4d8379e8a1d3dea17ccb16746dc786522acfe79da2b833c525a9b6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Users\Admin\AppData\Local\Temp\e8daa9482a4d8379e8a1d3dea17ccb16746dc786522acfe79da2b833c525a9b6.exe
  "C:\Users\Admin\AppData\Local\Temp\e8daa9482a4d8379e8a1d3dea17ccb16746dc786522acfe79da2b833c525a9b6.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3824

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3824-15-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3824-18-0x00000000016D0000-0x0000000001A1A000-memory.dmp

Filesize
3.3MB

Download
memory/4768-8-0x00000000054D0000-0x00000000054E2000-memory.dmp

Filesize
72KB

Download
memory/4768-9-0x00000000060F0000-0x0000000006112000-memory.dmp

Filesize
136KB

Download
memory/4768-4-0x0000000005510000-0x0000000005520000-memory.dmp

Filesize
64KB

Download
memory/4768-5-0x0000000005370000-0x000000000537A000-memory.dmp

Filesize
40KB

Download
memory/4768-6-0x0000000005610000-0x0000000005964000-memory.dmp

Filesize
3.3MB

Download
memory/4768-7-0x0000000005F20000-0x0000000005FBC000-memory.dmp

Filesize
624KB

Download
memory/4768-1-0x0000000000840000-0x00000000008EC000-memory.dmp

Filesize
688KB

Download
memory/4768-3-0x00000000052C0000-0x0000000005352000-memory.dmp

Filesize
584KB

Download
memory/4768-10-0x0000000006140000-0x0000000006158000-memory.dmp

Filesize
96KB

Download
memory/4768-11-0x0000000074B50000-0x0000000075300000-memory.dmp

Filesize
7.7MB

Download
memory/4768-12-0x0000000005510000-0x0000000005520000-memory.dmp

Filesize
64KB

Download
memory/4768-13-0x0000000006CE0000-0x0000000006CEA000-memory.dmp

Filesize
40KB

Download
memory/4768-14-0x0000000009750000-0x00000000097BE000-memory.dmp

Filesize
440KB

Download
memory/4768-2-0x0000000005970000-0x0000000005F14000-memory.dmp

Filesize
5.6MB

Download
memory/4768-17-0x0000000074B50000-0x0000000075300000-memory.dmp

Filesize
7.7MB

Download
memory/4768-0-0x0000000074B50000-0x0000000075300000-memory.dmp

Filesize
7.7MB

Download