formbook | dfe96798a6065c99050d1cb964200874b40e3916f90e3caed35df9ace3dc3198

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
16-01-2024 03:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5ee375628c34cd0aa0833e24bc31087a.exe
Size

1.2MB
MD5

5ee375628c34cd0aa0833e24bc31087a
SHA1

1d8c406871a1969850fd31883f23b56cb0bf0380
SHA256

dfe96798a6065c99050d1cb964200874b40e3916f90e3caed35df9ace3dc3198
SHA512

8b2d3401ebdb16d0ccfd7daa80344e1c0970720da2b12899af6482828ab7fc353b462b3b252dc7b0177a320b1a75bb537c439b64ea7c683e299e7a2e48873b70
SSDEEP

24576:0NHIFYVblhB4Y2K4DzXmg87g17/QonXK74sufqV:1yF14DPOUwcsKqV

Score

10^/10

formbook kzk9 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

kzk9

Decoy

tianconghuo.club

1996-page.com

ourtownmax.net

conservativetreehose.com

synth.repair

donnachicacreperia.com

tentfull.com

weapp.download

surfersink.com

gattlebusinessservices.com

sebastian249.com

anhphuc.company

betternatureproducts.net

defroplate.com

seattlesquidsquad.com

polarjob.com

lendingadvantage.com

angelsondope.com

goportjitney.com

tiendagrupojagr.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2464-12-0x0000000000400000-0x000000000042E000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

5ee375628c34cd0aa0833e24bc31087a.exe

description pid process target process

PID 2964 set thread context of 2464 2964 5ee375628c34cd0aa0833e24bc31087a.exe 5ee375628c34cd0aa0833e24bc31087a.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

5ee375628c34cd0aa0833e24bc31087a.exe5ee375628c34cd0aa0833e24bc31087a.exe

pid process

2964 5ee375628c34cd0aa0833e24bc31087a.exe
2464 5ee375628c34cd0aa0833e24bc31087a.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

5ee375628c34cd0aa0833e24bc31087a.exe

description pid process

Token: SeDebugPrivilege 2964 5ee375628c34cd0aa0833e24bc31087a.exe

description	pid	process	target process
PID 2964 set thread context of 2464	2964	5ee375628c34cd0aa0833e24bc31087a.exe	5ee375628c34cd0aa0833e24bc31087a.exe

pid	process
2964	5ee375628c34cd0aa0833e24bc31087a.exe
2464	5ee375628c34cd0aa0833e24bc31087a.exe

description	pid	process
Token: SeDebugPrivilege	2964	5ee375628c34cd0aa0833e24bc31087a.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

5ee375628c34cd0aa0833e24bc31087a.exe

description	pid	process	target process
PID 2964 wrote to memory of 2464	2964	5ee375628c34cd0aa0833e24bc31087a.exe	5ee375628c34cd0aa0833e24bc31087a.exe
PID 2964 wrote to memory of 2464	2964	5ee375628c34cd0aa0833e24bc31087a.exe	5ee375628c34cd0aa0833e24bc31087a.exe
PID 2964 wrote to memory of 2464	2964	5ee375628c34cd0aa0833e24bc31087a.exe	5ee375628c34cd0aa0833e24bc31087a.exe
PID 2964 wrote to memory of 2464	2964	5ee375628c34cd0aa0833e24bc31087a.exe	5ee375628c34cd0aa0833e24bc31087a.exe
PID 2964 wrote to memory of 2464	2964	5ee375628c34cd0aa0833e24bc31087a.exe	5ee375628c34cd0aa0833e24bc31087a.exe
PID 2964 wrote to memory of 2464	2964	5ee375628c34cd0aa0833e24bc31087a.exe	5ee375628c34cd0aa0833e24bc31087a.exe
PID 2964 wrote to memory of 2464	2964	5ee375628c34cd0aa0833e24bc31087a.exe	5ee375628c34cd0aa0833e24bc31087a.exe

C:\Users\Admin\AppData\Local\Temp\5ee375628c34cd0aa0833e24bc31087a.exe
"C:\Users\Admin\AppData\Local\Temp\5ee375628c34cd0aa0833e24bc31087a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2964

C:\Users\Admin\AppData\Local\Temp\5ee375628c34cd0aa0833e24bc31087a.exe
"C:\Users\Admin\AppData\Local\Temp\5ee375628c34cd0aa0833e24bc31087a.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2464

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2464-8-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2464-14-0x0000000000870000-0x0000000000B73000-memory.dmp

Filesize
3.0MB

Download
memory/2464-12-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2464-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2464-9-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2964-3-0x0000000000B00000-0x0000000000B18000-memory.dmp

Filesize
96KB

Download
memory/2964-6-0x00000000082C0000-0x0000000008362000-memory.dmp

Filesize
648KB

Download
memory/2964-7-0x0000000000D40000-0x0000000000D74000-memory.dmp

Filesize
208KB

Download
memory/2964-5-0x0000000000350000-0x0000000000390000-memory.dmp

Filesize
256KB

Download
memory/2964-4-0x0000000074B40000-0x000000007522E000-memory.dmp

Filesize
6.9MB

Download
memory/2964-1-0x0000000074B40000-0x000000007522E000-memory.dmp

Filesize
6.9MB

Download
memory/2964-2-0x0000000000350000-0x0000000000390000-memory.dmp

Filesize
256KB

Download
memory/2964-13-0x0000000074B40000-0x000000007522E000-memory.dmp

Filesize
6.9MB

Download
memory/2964-0-0x0000000001020000-0x0000000001152000-memory.dmp

Filesize
1.2MB

Download