formbook | d8e193aec8210406a34dad992d1f4a7add68a7c31bad8a70196801affff1d8a4

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
17-04-2024 14:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4c8efb2c7d2516b6253a3008e5f4dd5a0efb6b9752c76642491d9f6bfd9df6d9.exe
Size

721KB
MD5

dfafc703ba16fa2dd6989169eea78527
SHA1

80af23bb93aac46677909f7275d0afe05af2ed57
SHA256

4c8efb2c7d2516b6253a3008e5f4dd5a0efb6b9752c76642491d9f6bfd9df6d9
SHA512

5c60b5033df256b8e6627d1313e606435a74daeae8cd449131df6293ba2f12da1ef6358257165bc470f29fc8b6004dbe963131584ab17e73d1378f4faec7cb92
SSDEEP

12288:lOJ67iJqP9XRz+5EJqOYu0iQVROhjuAZsKelXXex87+2LzBh3:lOJ67iJqPpRz+yJqK0bVwhjuBFex8i2P

Score

10^/10

formbook he2a rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

he2a

Decoy

connectioncompass.store

zekicharge.com

dp77.shop

guninfo.guru

mamaeconomics.net

narcisme.coach

redtopassociates.com

ezezn.com

theoregondog.com

pagosmultired.online

emsculptcenterofne.com

meet-friends.online

pf326.com

wealthjigsaw.xyz

arsajib.com

kickassholdings.online

avaturre.biz

dtslogs.com

lb92.tech

pittalam.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2464-13-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

4c8efb2c7d2516b6253a3008e5f4dd5a0efb6b9752c76642491d9f6bfd9df6d9.exe

description	pid	process	target process
PID 1624 set thread context of 2464	1624	4c8efb2c7d2516b6253a3008e5f4dd5a0efb6b9752c76642491d9f6bfd9df6d9.exe	4c8efb2c7d2516b6253a3008e5f4dd5a0efb6b9752c76642491d9f6bfd9df6d9.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

4c8efb2c7d2516b6253a3008e5f4dd5a0efb6b9752c76642491d9f6bfd9df6d9.exe

pid process

2464 4c8efb2c7d2516b6253a3008e5f4dd5a0efb6b9752c76642491d9f6bfd9df6d9.exe

pid	process
2464	4c8efb2c7d2516b6253a3008e5f4dd5a0efb6b9752c76642491d9f6bfd9df6d9.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

4c8efb2c7d2516b6253a3008e5f4dd5a0efb6b9752c76642491d9f6bfd9df6d9.exe

description	pid	process	target process
PID 1624 wrote to memory of 2464	1624	4c8efb2c7d2516b6253a3008e5f4dd5a0efb6b9752c76642491d9f6bfd9df6d9.exe	4c8efb2c7d2516b6253a3008e5f4dd5a0efb6b9752c76642491d9f6bfd9df6d9.exe
PID 1624 wrote to memory of 2464	1624	4c8efb2c7d2516b6253a3008e5f4dd5a0efb6b9752c76642491d9f6bfd9df6d9.exe	4c8efb2c7d2516b6253a3008e5f4dd5a0efb6b9752c76642491d9f6bfd9df6d9.exe
PID 1624 wrote to memory of 2464	1624	4c8efb2c7d2516b6253a3008e5f4dd5a0efb6b9752c76642491d9f6bfd9df6d9.exe	4c8efb2c7d2516b6253a3008e5f4dd5a0efb6b9752c76642491d9f6bfd9df6d9.exe
PID 1624 wrote to memory of 2464	1624	4c8efb2c7d2516b6253a3008e5f4dd5a0efb6b9752c76642491d9f6bfd9df6d9.exe	4c8efb2c7d2516b6253a3008e5f4dd5a0efb6b9752c76642491d9f6bfd9df6d9.exe
PID 1624 wrote to memory of 2464	1624	4c8efb2c7d2516b6253a3008e5f4dd5a0efb6b9752c76642491d9f6bfd9df6d9.exe	4c8efb2c7d2516b6253a3008e5f4dd5a0efb6b9752c76642491d9f6bfd9df6d9.exe
PID 1624 wrote to memory of 2464	1624	4c8efb2c7d2516b6253a3008e5f4dd5a0efb6b9752c76642491d9f6bfd9df6d9.exe	4c8efb2c7d2516b6253a3008e5f4dd5a0efb6b9752c76642491d9f6bfd9df6d9.exe
PID 1624 wrote to memory of 2464	1624	4c8efb2c7d2516b6253a3008e5f4dd5a0efb6b9752c76642491d9f6bfd9df6d9.exe	4c8efb2c7d2516b6253a3008e5f4dd5a0efb6b9752c76642491d9f6bfd9df6d9.exe

C:\Users\Admin\AppData\Local\Temp\4c8efb2c7d2516b6253a3008e5f4dd5a0efb6b9752c76642491d9f6bfd9df6d9.exe
"C:\Users\Admin\AppData\Local\Temp\4c8efb2c7d2516b6253a3008e5f4dd5a0efb6b9752c76642491d9f6bfd9df6d9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1624

C:\Users\Admin\AppData\Local\Temp\4c8efb2c7d2516b6253a3008e5f4dd5a0efb6b9752c76642491d9f6bfd9df6d9.exe
"C:\Users\Admin\AppData\Local\Temp\4c8efb2c7d2516b6253a3008e5f4dd5a0efb6b9752c76642491d9f6bfd9df6d9.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2464

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1624-6-0x00000000052E0000-0x0000000005356000-memory.dmp

Filesize
472KB

Download
memory/1624-1-0x0000000074930000-0x000000007501E000-memory.dmp

Filesize
6.9MB

Download
memory/1624-2-0x00000000005E0000-0x0000000000620000-memory.dmp

Filesize
256KB

Download
memory/1624-3-0x0000000000670000-0x0000000000690000-memory.dmp

Filesize
128KB

Download
memory/1624-4-0x0000000000590000-0x000000000059E000-memory.dmp

Filesize
56KB

Download
memory/1624-5-0x0000000000620000-0x0000000000632000-memory.dmp

Filesize
72KB

Download
memory/1624-0-0x0000000001160000-0x000000000121A000-memory.dmp

Filesize
744KB

Download
memory/1624-14-0x0000000074930000-0x000000007501E000-memory.dmp

Filesize
6.9MB

Download
memory/2464-7-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2464-9-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2464-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2464-13-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2464-15-0x0000000000AE0000-0x0000000000DE3000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads