formbook | 2608-23-0x0000000000400000-0x000000000042F000-memory[.]dmp

General

Target

2608-23-0x0000000000400000-0x000000000042F000-memory.dmp
Size

188KB
MD5

8a363e58e6637b332b0c8904eab9b358
SHA1

1748f9ae89b64ad90ac11f2235023c1882d29561
SHA256

bf51c122c6183786bd16ab7d56ca4beb26deb1019b1f2031542acca1de4cf6fc
SHA512

69b67bbff9d9f6313fbe4d3da8949249153a3d6aec79a457770bb5444d74ee5ce600bc2d9474f348e169d1d76f34044f4fc65c54838b38337352722b83e7f674
SSDEEP

3072:it4ehkdFMvLvM83SHkMUgLWrfAaw9of2BlHGFnZptWgAWIo:4mXySEMVqrfxw9of2TuZptWPWI

Score

10^/10

rat dd20 formbook

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dd20

Decoy

unblurd.com

docu-zign.com

randijpaulsen.com

angsabet.com

sedatelynx.com

opiumcore.store

thelordismysaviormerch.com

mindstudio.support

waterbygraceteam.com

furnitureinspiredbythesea.com

amablanca.com

hespelerdental.com

arcalid.net

balajinursingbureau.online

caixias.shop

solingen-buergerstiftung.com

194916.top

6travel-insurance.xyz

xn--fiqp9b17y.xn--czr694b

syntixi.trade

Signatures

Formbook family
formbook
Formbook payload 1 IoCs
rat

Processes:

resource yara_rule

sample formbook

resource	yara_rule
sample	formbook

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
2608-23-0x0000000000400000-0x000000000042F000-memory.dmp

Files

2608-23-0x0000000000400000-0x000000000042F000-memory.dmp
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 181KB - Virtual size: 180KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 181KB - Virtual size: 180KB

.text
Size: 181KB - Virtual size: 180KB