formbook | 2768-46-0x0000000000400000-0x0000000000581000-memory[.]dmp

General

Target

2768-46-0x0000000000400000-0x0000000000581000-memory.dmp
Size

1.5MB
MD5

52975a0eaec542999f3ce3d2a6669674
SHA1

0de50b83f7f667534ba38da4ab99e2b2f462f18e
SHA256

c33d102baf552ceedb2bad0aa7f76a3930e188d666dbe80407b08131e062460b
SHA512

f5e3d3894e59d3a35070f5f70ecfe5c0034fd399de4c6759d820e4a8333d5e14306354ab0898d78e43f87e64ddfa14b8cc7bb46009c5d73f4c89e0dd1bd32fda
SSDEEP

3072:PLrEeAebeDqI32CBuDxFqwp41eF6wgQy5bRMqL1g1evI8:jgWG2VDXqwp41ele5tL1uQ

Score

10^/10

rat tt15 formbook

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

tt15

Decoy

wholeplant.online

pornimmersive.site

gelcreativecollabs.com

novanewsbrasil.com

prefabhomes2024th.space

stelautosrl.online

wellnessmindfulhealth.com

qhgly.lol

thefutureshub.com

compk5l.info

insurance-offers.com

de-solarroof.today

pn-pasarwajo.com

rachelelice.com

inkninsight.com

innoviewclinical.com

austrofoods.com

mayanlanguagesaccess.co

ablaiserver.com

staffcanteencook200.buzz

Signatures

Formbook family
formbook
Formbook payload 1 IoCs
rat

Processes:

resource yara_rule

sample formbook

resource	yara_rule
sample	formbook

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
2768-46-0x0000000000400000-0x0000000000581000-memory.dmp

Files

2768-46-0x0000000000400000-0x0000000000581000-memory.dmp
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 180KB - Virtual size: 180KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 180KB - Virtual size: 180KB

.text
Size: 180KB - Virtual size: 180KB