formbook | c9c2270688cf2f657dc16c1399cfbebadb1ae1d9a14c575a8f0c9d4c1ee3f38d

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04/01/2024, 14:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

410f4617026b9c0bc7296999d4028a86.exe
Size

1.3MB
MD5

410f4617026b9c0bc7296999d4028a86
SHA1

6f558885e1901d89a067619c5e46e642fdd29a7c
SHA256

c9c2270688cf2f657dc16c1399cfbebadb1ae1d9a14c575a8f0c9d4c1ee3f38d
SHA512

09cb0893935fbd733f40d86fc76420cc7292758887e8f1e37e01eb032741bb94394158cdfda9ac7142c24f39c2c79ea405cd921f02d94f712eac623117c853d9
SSDEEP

24576:2RS/d3NKzksGkszrBpGSDTZSK2Z/dgrBEvqQy8jhMN6ZNZZ:TKYlnTZSK2ZSS3CN6ZNZ

Score

10^/10

formbook rh0s rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

rh0s

Decoy

operatethekitchen.com

albaturkvatifbank.com

buzduganjr.com

binnsmotorinn.com

slotz789.com

bbwelldrilling.com

ldygqr.com

copyrightrules-ig.com

grabnsnatch.net

snowboardworldcup2009.com

mkstarz.com

flattoplakehomesforsale.com

tradinglife123.net

cafearabicanj.com

thekozow.com

wii2review26.club

youcanpassusmle.com

tydevelops.com

fashionwatchesstore.com

peeleasubo.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

resource	yara_rule
behavioral2/memory/4144-7-0x0000000005A40000-0x0000000005A52000-memory.dmp	CustAttr

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/4848-11-0x0000000000400000-0x000000000042E000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4144 set thread context of 4848	4144	410f4617026b9c0bc7296999d4028a86.exe	103

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4144	410f4617026b9c0bc7296999d4028a86.exe
4144	410f4617026b9c0bc7296999d4028a86.exe
4848	410f4617026b9c0bc7296999d4028a86.exe
4848	410f4617026b9c0bc7296999d4028a86.exe
4848	410f4617026b9c0bc7296999d4028a86.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4144	410f4617026b9c0bc7296999d4028a86.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4144 wrote to memory of 2888	4144	410f4617026b9c0bc7296999d4028a86.exe	102
PID 4144 wrote to memory of 2888	4144	410f4617026b9c0bc7296999d4028a86.exe	102
PID 4144 wrote to memory of 2888	4144	410f4617026b9c0bc7296999d4028a86.exe	102
PID 4144 wrote to memory of 4848	4144	410f4617026b9c0bc7296999d4028a86.exe	103
PID 4144 wrote to memory of 4848	4144	410f4617026b9c0bc7296999d4028a86.exe	103
PID 4144 wrote to memory of 4848	4144	410f4617026b9c0bc7296999d4028a86.exe	103
PID 4144 wrote to memory of 4848	4144	410f4617026b9c0bc7296999d4028a86.exe	103
PID 4144 wrote to memory of 4848	4144	410f4617026b9c0bc7296999d4028a86.exe	103
PID 4144 wrote to memory of 4848	4144	410f4617026b9c0bc7296999d4028a86.exe	103

C:\Users\Admin\AppData\Local\Temp\410f4617026b9c0bc7296999d4028a86.exe
"C:\Users\Admin\AppData\Local\Temp\410f4617026b9c0bc7296999d4028a86.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4144
- C:\Users\Admin\AppData\Local\Temp\410f4617026b9c0bc7296999d4028a86.exe
  "C:\Users\Admin\AppData\Local\Temp\410f4617026b9c0bc7296999d4028a86.exe"
  2⤵
  PID:2888
- C:\Users\Admin\AppData\Local\Temp\410f4617026b9c0bc7296999d4028a86.exe
  "C:\Users\Admin\AppData\Local\Temp\410f4617026b9c0bc7296999d4028a86.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4144-5-0x00000000059E0000-0x00000000059EA000-memory.dmp

Filesize
40KB

Download
memory/4144-10-0x0000000006730000-0x0000000006764000-memory.dmp

Filesize
208KB

Download
memory/4144-2-0x0000000005F80000-0x0000000006524000-memory.dmp

Filesize
5.6MB

Download
memory/4144-3-0x0000000005A70000-0x0000000005B02000-memory.dmp

Filesize
584KB

Download
memory/4144-4-0x0000000005BE0000-0x0000000005BF0000-memory.dmp

Filesize
64KB

Download
memory/4144-6-0x0000000005D50000-0x0000000005DEC000-memory.dmp

Filesize
624KB

Download
memory/4144-1-0x0000000000E90000-0x0000000000FDA000-memory.dmp

Filesize
1.3MB

Download
memory/4144-8-0x0000000074500000-0x0000000074CB0000-memory.dmp

Filesize
7.7MB

Download
memory/4144-0-0x0000000074500000-0x0000000074CB0000-memory.dmp

Filesize
7.7MB

Download
memory/4144-9-0x0000000006A70000-0x0000000006B12000-memory.dmp

Filesize
648KB

Download
memory/4144-7-0x0000000005A40000-0x0000000005A52000-memory.dmp

Filesize
72KB

Download
memory/4144-13-0x0000000074500000-0x0000000074CB0000-memory.dmp

Filesize
7.7MB

Download
memory/4848-11-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4848-14-0x0000000001350000-0x000000000169A000-memory.dmp

Filesize
3.3MB

Download
memory/4848-15-0x0000000001350000-0x000000000169A000-memory.dmp

Filesize
3.3MB

Download