formbook | f23b020b5a3aab42525b80bef3474df287cc7fa80dc3c13229c571e32fb99fe9

Analysis

max time kernel
139s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 08:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f23b020b5a3aab42525b80bef3474df287cc7fa80dc3c13229c571e32fb99fe9.exe
Size

658KB
MD5

cef1565654989742eaffa2cbc59947eb
SHA1

afef46a08dc6a2e1b3c8a9c6b58627677403f7b5
SHA256

f23b020b5a3aab42525b80bef3474df287cc7fa80dc3c13229c571e32fb99fe9
SHA512

53b9b0cf0d8d1c815c269e1f152ee26cda3fe18e277341f753c2d98a134e32a1c4bc6691d99cee68942e497014785087a20b2563005fd7ce4aaac9511ccfcf97
SSDEEP

12288:v0nTYdzssaVbe+32tFnbEaluZO4LjAIzlalEhq6o7i4ID3/SH:7zsscbeWaj4LjBhs6oV5H

Score

10^/10

formbook ht3d rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ht3d

Decoy

derlon.net

46gem.vip

bridal-heart-boutique.com

porarquitectura.com

durkal.online

9916k.vip

nativegarden.net

hoodjac.com

coachwunder.com

jutuowangluo.com

frankmontagna.com

jalenx.com

yhxg.net

brasserie-bro.com

whitecoatprivilege.com

sigmadriving.com

inhkipcmacau.com

freediveexperience.com

52iwin.com

aaditt.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/4152-11-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 64 set thread context of 4152	64	f23b020b5a3aab42525b80bef3474df287cc7fa80dc3c13229c571e32fb99fe9.exe	88

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4152	f23b020b5a3aab42525b80bef3474df287cc7fa80dc3c13229c571e32fb99fe9.exe
4152	f23b020b5a3aab42525b80bef3474df287cc7fa80dc3c13229c571e32fb99fe9.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 64 wrote to memory of 4152	64	f23b020b5a3aab42525b80bef3474df287cc7fa80dc3c13229c571e32fb99fe9.exe	88
PID 64 wrote to memory of 4152	64	f23b020b5a3aab42525b80bef3474df287cc7fa80dc3c13229c571e32fb99fe9.exe	88
PID 64 wrote to memory of 4152	64	f23b020b5a3aab42525b80bef3474df287cc7fa80dc3c13229c571e32fb99fe9.exe	88
PID 64 wrote to memory of 4152	64	f23b020b5a3aab42525b80bef3474df287cc7fa80dc3c13229c571e32fb99fe9.exe	88
PID 64 wrote to memory of 4152	64	f23b020b5a3aab42525b80bef3474df287cc7fa80dc3c13229c571e32fb99fe9.exe	88
PID 64 wrote to memory of 4152	64	f23b020b5a3aab42525b80bef3474df287cc7fa80dc3c13229c571e32fb99fe9.exe	88

C:\Users\Admin\AppData\Local\Temp\f23b020b5a3aab42525b80bef3474df287cc7fa80dc3c13229c571e32fb99fe9.exe
"C:\Users\Admin\AppData\Local\Temp\f23b020b5a3aab42525b80bef3474df287cc7fa80dc3c13229c571e32fb99fe9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:64
- C:\Users\Admin\AppData\Local\Temp\f23b020b5a3aab42525b80bef3474df287cc7fa80dc3c13229c571e32fb99fe9.exe
  "C:\Users\Admin\AppData\Local\Temp\f23b020b5a3aab42525b80bef3474df287cc7fa80dc3c13229c571e32fb99fe9.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4152

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/64-6-0x0000000074590000-0x0000000074D40000-memory.dmp

Filesize
7.7MB

Download
memory/64-13-0x0000000074590000-0x0000000074D40000-memory.dmp

Filesize
7.7MB

Download
memory/64-2-0x00000000051B0000-0x0000000005754000-memory.dmp

Filesize
5.6MB

Download
memory/64-3-0x0000000004CA0000-0x0000000004D32000-memory.dmp

Filesize
584KB

Download
memory/64-4-0x0000000004D40000-0x0000000004D4A000-memory.dmp

Filesize
40KB

Download
memory/64-5-0x0000000004E30000-0x0000000004ECC000-memory.dmp

Filesize
624KB

Download
memory/64-8-0x0000000005180000-0x000000000518E000-memory.dmp

Filesize
56KB

Download
memory/64-0-0x000000007459E000-0x000000007459F000-memory.dmp

Filesize
4KB

Download
memory/64-1-0x0000000000330000-0x00000000003DA000-memory.dmp

Filesize
680KB

Download
memory/64-9-0x0000000006060000-0x0000000006076000-memory.dmp

Filesize
88KB

Download
memory/64-10-0x0000000006450000-0x00000000064C6000-memory.dmp

Filesize
472KB

Download
memory/64-7-0x0000000005150000-0x000000000516C000-memory.dmp

Filesize
112KB

Download
memory/4152-11-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4152-14-0x00000000017A0000-0x0000000001AEA000-memory.dmp

Filesize
3.3MB

Download