formbook | e54350487bda76835619ccc44ff79db38db5183f544efbf33159cfd707bcdb75

Analysis

max time kernel
147s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/03/2024, 08:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
iU3WGoA77BdiFdA.exe
Size 758KB
Sample240318-kapp3scc24
SHA256 e54350487bda76835619ccc44ff79db38db5183f544efbf33159cfd707bcdb75
MD5 842ad1d1101392fc2d7ce158f3ebaec7
SHA1 219f9b72379ce21250351c9d8ee628fc157f740f
SHA512 1a2d22a4c30c4d4765636390931ed4d0490996845d6d095d630dbcb4c7fc833741930f674ee5b9cf7f55e8122eddb0c475d627dcf9e4626e496dafade2e1b6be
SSDEEP 12288:cip5ELUDK2tTinH9uLE3gX01+/A8dUQ0JFSFB2eLdtZQP0eXrkR:ci3k4bs9/3gE1+/xUQ0JF8taPdu
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook ns03 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

ns03

Decoy

dipity.tech
agathis.fun
ekaterinai.store
elizabethsbookshelf.com
smilesustainably.com
tapeworm.xyz
beatricesswarthout.xyz
nsrpackersandpackers.in
yedxec.xyz
gildedbeautyaesthitics.com
hanibalbechar.com
fichaphuman.net
adilosk.shop
geezaran.com
ventasemail.com
phonecasesdirect.store
rctjuc.shop
sukimossmanagement.com
caller-id.today
kft07.vip
mahbubamaahi.com
tcindustrie.net
ng-stl.com
vb4n53g4fh354gf5jh.top
repair-services.today
fonbnk.pro
olivabelle.com
pqeomjr.cc
elevatedblanks.net
ambiatec.solutions
quantumaster.online
pocket-option.tech
circly.net
focus2c.com
armacao-de-oculos.com
bmcj365.com
maxhealthunity.com
taifengtechnologyservice.com
zerolethal.com
dramaqu.guru
kukrejaassociates.in
jamesjenner.com
signature-perfect.com
fbaparadise.com
yandada.us
rcpbooks.site
celonstore.fun
dailynewarker.com
594545.xyz
chuanruhaomen.com
planetpost.lol
kinovod130424.pro
lavanced.com
leclandesparents.com
childnchestcare.com
taiyuanbaoyang.com
engagenotrage.com
halffullliving.com
scheuermannworks.com
oengpalworld.store
derech-hamagah.com
clintomator.com
velvetgloveseasonings.store
pkclubc.site
grupooceanique.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 4 IoCs

rat

resource	yara_rule
behavioral1/memory/2552-13-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/2552-17-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/2584-23-0x00000000000C0000-0x00000000000EF000-memory.dmp	formbook
behavioral1/memory/2584-25-0x00000000000C0000-0x00000000000EF000-memory.dmp	formbook

Deletes itself 1 IoCs

pid	Process
2460	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1208 set thread context of 2552	1208	iU3WGoA77BdiFdA.exe	28
PID 2552 set thread context of 1240	2552	iU3WGoA77BdiFdA.exe	21
PID 2584 set thread context of 1240	2584	cmd.exe	21

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
2552	iU3WGoA77BdiFdA.exe
2552	iU3WGoA77BdiFdA.exe
2584	cmd.exe
2584	cmd.exe
2584	cmd.exe
2584	cmd.exe
2584	cmd.exe
2584	cmd.exe
2584	cmd.exe
2584	cmd.exe
2584	cmd.exe
2584	cmd.exe
2584	cmd.exe
2584	cmd.exe
2584	cmd.exe
2584	cmd.exe
2584	cmd.exe
2584	cmd.exe
2584	cmd.exe
2584	cmd.exe
2584	cmd.exe
2584	cmd.exe
2584	cmd.exe
2584	cmd.exe
2584	cmd.exe
2584	cmd.exe
2584	cmd.exe
2584	cmd.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
2552	iU3WGoA77BdiFdA.exe
2552	iU3WGoA77BdiFdA.exe
2552	iU3WGoA77BdiFdA.exe
2584	cmd.exe
2584	cmd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2552	iU3WGoA77BdiFdA.exe
Token: SeDebugPrivilege	2584	cmd.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 2552	1208	iU3WGoA77BdiFdA.exe	28
PID 1208 wrote to memory of 2552	1208	iU3WGoA77BdiFdA.exe	28
PID 1208 wrote to memory of 2552	1208	iU3WGoA77BdiFdA.exe	28
PID 1208 wrote to memory of 2552	1208	iU3WGoA77BdiFdA.exe	28
PID 1208 wrote to memory of 2552	1208	iU3WGoA77BdiFdA.exe	28
PID 1208 wrote to memory of 2552	1208	iU3WGoA77BdiFdA.exe	28
PID 1208 wrote to memory of 2552	1208	iU3WGoA77BdiFdA.exe	28
PID 1240 wrote to memory of 2584	1240	Explorer.EXE	42
PID 1240 wrote to memory of 2584	1240	Explorer.EXE	42
PID 1240 wrote to memory of 2584	1240	Explorer.EXE	42
PID 1240 wrote to memory of 2584	1240	Explorer.EXE	42
PID 2584 wrote to memory of 2460	2584	cmd.exe	43
PID 2584 wrote to memory of 2460	2584	cmd.exe	43
PID 2584 wrote to memory of 2460	2584	cmd.exe	43
PID 2584 wrote to memory of 2460	2584	cmd.exe	43

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Users\Admin\AppData\Local\Temp\iU3WGoA77BdiFdA.exe
  "C:\Users\Admin\AppData\Local\Temp\iU3WGoA77BdiFdA.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1208
- - C:\Users\Admin\AppData\Local\Temp\iU3WGoA77BdiFdA.exe
    "C:\Users\Admin\AppData\Local\Temp\iU3WGoA77BdiFdA.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:2552
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:2652
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:2656
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:2420
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:2072
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:2840
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:2528
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:2572
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:2448
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:2796
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:2784
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:2440
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:2636
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:2992
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\SysWOW64\cmd.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\iU3WGoA77BdiFdA.exe"
    3⤵
    - Deletes itself
    PID:2460

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1208-14-0x00000000747F0000-0x0000000074EDE000-memory.dmp

Download

memory/1208-1-0x00000000747F0000-0x0000000074EDE000-memory.dmp

Download

memory/1208-2-0x0000000005130000-0x0000000005170000-memory.dmp

Download

memory/1208-3-0x0000000000310000-0x0000000000326000-memory.dmp

Download

memory/1208-4-0x0000000000340000-0x000000000034C000-memory.dmp

Download

memory/1208-5-0x0000000000350000-0x000000000035E000-memory.dmp

Download

memory/1208-6-0x00000000048E0000-0x0000000004956000-memory.dmp

Download

memory/1208-0-0x0000000000CD0000-0x0000000000D90000-memory.dmp

Download

memory/1240-28-0x0000000008B00000-0x0000000008CA8000-memory.dmp

Download

memory/1240-20-0x0000000008B00000-0x0000000008CA8000-memory.dmp

Download

memory/1240-19-0x0000000003990000-0x0000000003A90000-memory.dmp

Download

memory/2552-15-0x0000000000D90000-0x0000000001093000-memory.dmp

Download

memory/2552-13-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2552-17-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2552-18-0x0000000000140000-0x0000000000154000-memory.dmp

Download

memory/2552-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2552-9-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2552-7-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2584-21-0x0000000049D60000-0x0000000049DAC000-memory.dmp

Download

memory/2584-22-0x0000000049D60000-0x0000000049DAC000-memory.dmp

Download

memory/2584-23-0x00000000000C0000-0x00000000000EF000-memory.dmp

Download

memory/2584-24-0x0000000001FA0000-0x00000000022A3000-memory.dmp

Download

memory/2584-25-0x00000000000C0000-0x00000000000EF000-memory.dmp

Download

memory/2584-27-0x0000000001EC0000-0x0000000001F53000-memory.dmp

Download