formbook | f65770d8401d9c854fa78d70ab859a6f01fd25c96bad20bf41503aaff36e192b

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19-12-2023 21:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a200e354efd4baed46ae6e1ca2b72897.exe
Size

403KB
MD5

a200e354efd4baed46ae6e1ca2b72897
SHA1

56c60650aee4b183ee7f02c1d320dc038f96a9cd
SHA256

f65770d8401d9c854fa78d70ab859a6f01fd25c96bad20bf41503aaff36e192b
SHA512

eba1ffd2aeee0a878304b97e325c4463651505f7d490744cd44237597f614810a452cdeaffb0bf594f4c8849df3b8f3f87fec75cd9cd7e168409e7cbeaa0ff41
SSDEEP

6144:kcRKUL2Vk841Stjm66L2Fc/LqurUUAMbfg1UIqJL6UXbkIpOOhxxdeTr/ekIt:/kUa14wtjmxj/LqruL6UbkINzxd6L+

Score

10^/10

formbook dn7r rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dn7r

Decoy

eventphotographerdfw.com

thehalalcoinstaking.com

philipfaziofineart.com

intercoh.com

gaiaseyephotography.com

chatbotforrealestate.com

lovelancemg.com

marlieskasberger.com

elcongoenespanol.info

lepirecredit.com

distribution-concept.com

e99game.com

exit11festival.com

twodollartoothbrushclub.com

cocktailsandlawn.com

performimprove.network

24horas-telefono-11840.com

cosmossify.com

kellenleote.com

perovskite.energy

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1464-3-0x0000000000400000-0x0000000000471000-memory.dmp	formbook
behavioral1/memory/1464-2-0x0000000000220000-0x000000000024F000-memory.dmp	formbook

C:\Users\Admin\AppData\Local\Temp\a200e354efd4baed46ae6e1ca2b72897.exe
"C:\Users\Admin\AppData\Local\Temp\a200e354efd4baed46ae6e1ca2b72897.exe"
1⤵
PID:1464

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1464-1-0x0000000000600000-0x0000000000700000-memory.dmp

Filesize
1024KB

Download
memory/1464-3-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1464-2-0x0000000000220000-0x000000000024F000-memory.dmp

Filesize
188KB

Download
memory/1464-4-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download