formbook | ee7d4eabf89c595d1adfc55c618777216b987729e02381381c82ca50a890c3a2

Analysis

max time kernel
144s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
09-01-2024 18:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e853e750421f951ae0a6bd231e0bd5b0.exe
Size

1.0MB
MD5

e853e750421f951ae0a6bd231e0bd5b0
SHA1

0f7eb114f22705449e4069484aeb77e4fa88387f
SHA256

ee7d4eabf89c595d1adfc55c618777216b987729e02381381c82ca50a890c3a2
SHA512

53d0ecd97c862a6c920ee0113ed64f11121d611593da12caca53e933328e55b8c8315173410fa024989688124143bb75c55bfba15b0c68118e1773e677613028
SSDEEP

12288:EvbSopg3ip6aBOjNP5/d3XSAHoRoDoyoNo0K2znyuSzr2VsJursi/UYPydyAJa:IdYA6ac15/d3n64Jac2ezPti/UYPE

Score

10^/10

formbook pm7s rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

pm7s

Decoy

angrypeacocks.site

theindependentartlable.com

coachingforthewin.com

localbizsc.com

drive-a-supercar.com

mewsette.com

scinuh.com

gurugramaffordablehomes.com

riamedefarm.com

richfitzfashions.com

u9j1o.info

dife-rent.com

talesfromthequadrat.com

dandfmotors.com

springtexasdentist.com

gobakala.store

earlyeducationglobal.com

sdrxsb.site

dreamlifebiz.com

theurbancaveshop.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

Processes:

resource	yara_rule
behavioral2/memory/1092-8-0x0000000005780000-0x0000000005792000-memory.dmp	CustAttr

Formbook payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/852-13-0x0000000000400000-0x000000000042E000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

e853e750421f951ae0a6bd231e0bd5b0.exe

description pid process target process

PID 1092 set thread context of 852 1092 e853e750421f951ae0a6bd231e0bd5b0.exe e853e750421f951ae0a6bd231e0bd5b0.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

e853e750421f951ae0a6bd231e0bd5b0.exe

pid process

852 e853e750421f951ae0a6bd231e0bd5b0.exe
852 e853e750421f951ae0a6bd231e0bd5b0.exe
852 e853e750421f951ae0a6bd231e0bd5b0.exe

description	pid	process	target process
PID 1092 set thread context of 852	1092	e853e750421f951ae0a6bd231e0bd5b0.exe	e853e750421f951ae0a6bd231e0bd5b0.exe

pid	process
852	e853e750421f951ae0a6bd231e0bd5b0.exe
852	e853e750421f951ae0a6bd231e0bd5b0.exe
852	e853e750421f951ae0a6bd231e0bd5b0.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

e853e750421f951ae0a6bd231e0bd5b0.exe

description	pid	process	target process
PID 1092 wrote to memory of 852	1092	e853e750421f951ae0a6bd231e0bd5b0.exe	e853e750421f951ae0a6bd231e0bd5b0.exe
PID 1092 wrote to memory of 852	1092	e853e750421f951ae0a6bd231e0bd5b0.exe	e853e750421f951ae0a6bd231e0bd5b0.exe
PID 1092 wrote to memory of 852	1092	e853e750421f951ae0a6bd231e0bd5b0.exe	e853e750421f951ae0a6bd231e0bd5b0.exe
PID 1092 wrote to memory of 852	1092	e853e750421f951ae0a6bd231e0bd5b0.exe	e853e750421f951ae0a6bd231e0bd5b0.exe
PID 1092 wrote to memory of 852	1092	e853e750421f951ae0a6bd231e0bd5b0.exe	e853e750421f951ae0a6bd231e0bd5b0.exe
PID 1092 wrote to memory of 852	1092	e853e750421f951ae0a6bd231e0bd5b0.exe	e853e750421f951ae0a6bd231e0bd5b0.exe

C:\Users\Admin\AppData\Local\Temp\e853e750421f951ae0a6bd231e0bd5b0.exe
"C:\Users\Admin\AppData\Local\Temp\e853e750421f951ae0a6bd231e0bd5b0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1092

C:\Users\Admin\AppData\Local\Temp\e853e750421f951ae0a6bd231e0bd5b0.exe
"C:\Users\Admin\AppData\Local\Temp\e853e750421f951ae0a6bd231e0bd5b0.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:852

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/852-13-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/852-17-0x0000000001670000-0x00000000019BA000-memory.dmp

Filesize
3.3MB

Download
memory/852-16-0x0000000001670000-0x00000000019BA000-memory.dmp

Filesize
3.3MB

Download
memory/1092-0-0x0000000074A10000-0x00000000751C0000-memory.dmp

Filesize
7.7MB

Download
memory/1092-10-0x0000000005360000-0x0000000005370000-memory.dmp

Filesize
64KB

Download
memory/1092-5-0x0000000005360000-0x0000000005370000-memory.dmp

Filesize
64KB

Download
memory/1092-7-0x0000000005680000-0x00000000056D6000-memory.dmp

Filesize
344KB

Download
memory/1092-6-0x00000000053C0000-0x00000000053CA000-memory.dmp

Filesize
40KB

Download
memory/1092-8-0x0000000005780000-0x0000000005792000-memory.dmp

Filesize
72KB

Download
memory/1092-9-0x0000000074A10000-0x00000000751C0000-memory.dmp

Filesize
7.7MB

Download
memory/1092-2-0x00000000053F0000-0x000000000548C000-memory.dmp

Filesize
624KB

Download
memory/1092-11-0x0000000006CE0000-0x0000000006D5C000-memory.dmp

Filesize
496KB

Download
memory/1092-1-0x00000000008A0000-0x00000000009B2000-memory.dmp

Filesize
1.1MB

Download
memory/1092-15-0x0000000074A10000-0x00000000751C0000-memory.dmp

Filesize
7.7MB

Download
memory/1092-4-0x0000000005490000-0x0000000005522000-memory.dmp

Filesize
584KB

Download
memory/1092-12-0x0000000006D90000-0x0000000006DC4000-memory.dmp

Filesize
208KB

Download
memory/1092-3-0x0000000005A40000-0x0000000005FE4000-memory.dmp

Filesize
5.6MB

Download