formbook | 8ca372bae777f7250c22113f1312b38955555f48c0b1ed2aaf0c9326abe06001

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02/02/2024, 17:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8a23748bd6538bc7f349639d7b100260.exe
Size

820KB
MD5

8a23748bd6538bc7f349639d7b100260
SHA1

892aef662cff782d478615ab5e3631c0e9ad5d13
SHA256

8ca372bae777f7250c22113f1312b38955555f48c0b1ed2aaf0c9326abe06001
SHA512

059e16d0fa1aad6c87699b5a41041ec969c9d1832708a4186faff724921527c1d97d9c19f6f1ce43ca99f3352933d68102846e71920a2292c166d1f9de36df57
SSDEEP

12288:254GgfHiwrENcmH/nOLQ9+SboQY3Sa1Zen1hbzM/2iN:25jsHXrENcIOL6HU91ZOk/1

Score

10^/10

formbook wz6a rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

wz6a

Decoy

commonebisu.com

onlinedatingforyou.com

nomoreink.com

directcare.doctor

protego1.com

buvettechamonix.com

dissertationshelp.net

theawakenedmother.life

leonwickham.com

renaultstoreiran.com

lsxwsj.com

uniontattoosupply.com

herfitnessandbeauty.com

jesselynleephotography.com

imaginebyccp.com

athomeproductive.com

laratome.com

smoothsailingexpress.com

freedrumlessons4u.com

easylivego.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/2644-14-0x0000000000400000-0x000000000042E000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2516 set thread context of 2644	2516	8a23748bd6538bc7f349639d7b100260.exe	30

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2644	8a23748bd6538bc7f349639d7b100260.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 2644	2516	8a23748bd6538bc7f349639d7b100260.exe	30
PID 2516 wrote to memory of 2644	2516	8a23748bd6538bc7f349639d7b100260.exe	30
PID 2516 wrote to memory of 2644	2516	8a23748bd6538bc7f349639d7b100260.exe	30
PID 2516 wrote to memory of 2644	2516	8a23748bd6538bc7f349639d7b100260.exe	30
PID 2516 wrote to memory of 2644	2516	8a23748bd6538bc7f349639d7b100260.exe	30
PID 2516 wrote to memory of 2644	2516	8a23748bd6538bc7f349639d7b100260.exe	30
PID 2516 wrote to memory of 2644	2516	8a23748bd6538bc7f349639d7b100260.exe	30

C:\Users\Admin\AppData\Local\Temp\8a23748bd6538bc7f349639d7b100260.exe
"C:\Users\Admin\AppData\Local\Temp\8a23748bd6538bc7f349639d7b100260.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Users\Admin\AppData\Local\Temp\8a23748bd6538bc7f349639d7b100260.exe
  "C:\Users\Admin\AppData\Local\Temp\8a23748bd6538bc7f349639d7b100260.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2516-6-0x0000000005590000-0x0000000005636000-memory.dmp

Filesize
664KB

Download
memory/2516-15-0x0000000074690000-0x0000000074D7E000-memory.dmp

Filesize
6.9MB

Download
memory/2516-2-0x0000000004CA0000-0x0000000004CE0000-memory.dmp

Filesize
256KB

Download
memory/2516-3-0x00000000003E0000-0x00000000003F2000-memory.dmp

Filesize
72KB

Download
memory/2516-4-0x0000000074690000-0x0000000074D7E000-memory.dmp

Filesize
6.9MB

Download
memory/2516-5-0x0000000004CA0000-0x0000000004CE0000-memory.dmp

Filesize
256KB

Download
memory/2516-7-0x0000000000520000-0x0000000000556000-memory.dmp

Filesize
216KB

Download
memory/2516-1-0x0000000074690000-0x0000000074D7E000-memory.dmp

Filesize
6.9MB

Download
memory/2516-0-0x0000000000AE0000-0x0000000000BB4000-memory.dmp

Filesize
848KB

Download
memory/2644-10-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2644-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2644-14-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2644-8-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2644-16-0x0000000000BC0000-0x0000000000EC3000-memory.dmp

Filesize
3.0MB

Download