formbook | 7bd15d1373432664a9bec73add2f5f810f7aa4ba1e3b5b4d0886b681fe50dc03

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 01:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Swift Copy.exe
Size

49KB
MD5

fadef7ce43e9627a752d03a41e71ee41
SHA1

f8a9907fdb73ca4b162b20a79d9384ab5277af31
SHA256

80762425adc5f24b5c7be359dd4cb7c1c657bb21f0304dcb89eb6bd6d8d8e0da
SHA512

764ddce479431043510647f95fb376be3b62bc7e6283173c9d7849130335a8daa2aad2b86e8a7693cd5c92c1b94e809cf1a0ec1ecbb2fb6c196d1764a0a9a081
SSDEEP

768:P1YSqVwQ8rD6pSg12mkQu3MyoELiym7/FDFTNxIrgBjv5VQ6:PyeQkDxtcyJm7tk0jv5VJ

Score

10^/10

formbook sr62 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

sr62

Decoy

pizzaperol.com

brooklynlearningstudio.com

legendlearningacghy.net

xtlg3i19o7czkv4.buzz

outdoorsproducts.xyz

nissanthanhhoa.com

mtviewproservices.com

tichris.com

monopolygo.llc

engagemaxmail.com

supremeinsure.com

2018b7.com

tedxkarunyauniversity.com

vaishnaviyoga.in

goddessoffetish.com

dazewu.com

844385.autos

caluxio.com

restaurantlataberna.com

charlieahunter.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/2988-4894-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/2988-4898-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/2988-4902-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2640 set thread context of 2988	2640	Swift Copy.exe	97
PID 2988 set thread context of 3424	2988	Swift Copy.exe	56
PID 2988 set thread context of 3424	2988	Swift Copy.exe	56
PID 4140 set thread context of 3424	4140	raserver.exe	56

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
2988	Swift Copy.exe
2988	Swift Copy.exe
2988	Swift Copy.exe
2988	Swift Copy.exe
2988	Swift Copy.exe
2988	Swift Copy.exe
4140	raserver.exe
4140	raserver.exe
4140	raserver.exe
4140	raserver.exe
4140	raserver.exe
4140	raserver.exe
4140	raserver.exe
4140	raserver.exe
4140	raserver.exe
4140	raserver.exe
4140	raserver.exe
4140	raserver.exe
4140	raserver.exe
4140	raserver.exe
4140	raserver.exe
4140	raserver.exe
4140	raserver.exe
4140	raserver.exe
4140	raserver.exe
4140	raserver.exe
4140	raserver.exe
4140	raserver.exe
4140	raserver.exe
4140	raserver.exe
4140	raserver.exe
4140	raserver.exe
4140	raserver.exe
4140	raserver.exe
4140	raserver.exe
4140	raserver.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
2988	Swift Copy.exe
2988	Swift Copy.exe
2988	Swift Copy.exe
2988	Swift Copy.exe
4140	raserver.exe
4140	raserver.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2640	Swift Copy.exe
Token: SeDebugPrivilege	2640	Swift Copy.exe
Token: SeDebugPrivilege	2988	Swift Copy.exe
Token: SeDebugPrivilege	4140	raserver.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3424	Explorer.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 2988	2640	Swift Copy.exe	97
PID 2640 wrote to memory of 2988	2640	Swift Copy.exe	97
PID 2640 wrote to memory of 2988	2640	Swift Copy.exe	97
PID 2640 wrote to memory of 2988	2640	Swift Copy.exe	97
PID 2640 wrote to memory of 2988	2640	Swift Copy.exe	97
PID 2640 wrote to memory of 2988	2640	Swift Copy.exe	97
PID 3424 wrote to memory of 4140	3424	Explorer.EXE	99
PID 3424 wrote to memory of 4140	3424	Explorer.EXE	99
PID 3424 wrote to memory of 4140	3424	Explorer.EXE	99
PID 4140 wrote to memory of 4568	4140	raserver.exe	100
PID 4140 wrote to memory of 4568	4140	raserver.exe	100
PID 4140 wrote to memory of 4568	4140	raserver.exe	100

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3424
- C:\Users\Admin\AppData\Local\Temp\Swift Copy.exe
  "C:\Users\Admin\AppData\Local\Temp\Swift Copy.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Users\Admin\AppData\Local\Temp\Swift Copy.exe
    "C:\Users\Admin\AppData\Local\Temp\Swift Copy.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:2988
- C:\Windows\SysWOW64\raserver.exe
  "C:\Windows\SysWOW64\raserver.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4140
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\Swift Copy.exe"
    3⤵
    PID:4568

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2640-0-0x00000000752DE000-0x00000000752DF000-memory.dmp

Filesize
4KB

Download
memory/2640-1-0x0000000000190000-0x00000000001A2000-memory.dmp

Filesize
72KB

Download
memory/2640-2-0x00000000752D0000-0x0000000075A80000-memory.dmp

Filesize
7.7MB

Download
memory/2640-3-0x0000000008040000-0x000000000827E000-memory.dmp

Filesize
2.2MB

Download
memory/2640-4-0x0000000008830000-0x0000000008DD4000-memory.dmp

Filesize
5.6MB

Download
memory/2640-5-0x0000000008320000-0x00000000083B2000-memory.dmp

Filesize
584KB

Download
memory/2640-7-0x0000000008040000-0x0000000008278000-memory.dmp

Filesize
2.2MB

Download
memory/2640-9-0x0000000008040000-0x0000000008278000-memory.dmp

Filesize
2.2MB

Download
memory/2640-21-0x0000000008040000-0x0000000008278000-memory.dmp

Filesize
2.2MB

Download
memory/2640-27-0x0000000008040000-0x0000000008278000-memory.dmp

Filesize
2.2MB

Download
memory/2640-51-0x0000000008040000-0x0000000008278000-memory.dmp

Filesize
2.2MB

Download
memory/2640-37-0x0000000008040000-0x0000000008278000-memory.dmp

Filesize
2.2MB

Download
memory/2640-35-0x0000000008040000-0x0000000008278000-memory.dmp

Filesize
2.2MB

Download
memory/2640-33-0x0000000008040000-0x0000000008278000-memory.dmp

Filesize
2.2MB

Download
memory/2640-49-0x0000000008040000-0x0000000008278000-memory.dmp

Filesize
2.2MB

Download
memory/2640-57-0x0000000008040000-0x0000000008278000-memory.dmp

Filesize
2.2MB

Download
memory/2640-63-0x0000000008040000-0x0000000008278000-memory.dmp

Filesize
2.2MB

Download
memory/2640-69-0x0000000008040000-0x0000000008278000-memory.dmp

Filesize
2.2MB

Download
memory/2640-67-0x0000000008040000-0x0000000008278000-memory.dmp

Filesize
2.2MB

Download
memory/2640-61-0x0000000008040000-0x0000000008278000-memory.dmp

Filesize
2.2MB

Download
memory/2640-55-0x0000000008040000-0x0000000008278000-memory.dmp

Filesize
2.2MB

Download
memory/2640-53-0x0000000008040000-0x0000000008278000-memory.dmp

Filesize
2.2MB

Download
memory/2640-65-0x0000000008040000-0x0000000008278000-memory.dmp

Filesize
2.2MB

Download
memory/2640-59-0x0000000008040000-0x0000000008278000-memory.dmp

Filesize
2.2MB

Download
memory/2640-47-0x0000000008040000-0x0000000008278000-memory.dmp

Filesize
2.2MB

Download
memory/2640-45-0x0000000008040000-0x0000000008278000-memory.dmp

Filesize
2.2MB

Download
memory/2640-43-0x0000000008040000-0x0000000008278000-memory.dmp

Filesize
2.2MB

Download
memory/2640-41-0x0000000008040000-0x0000000008278000-memory.dmp

Filesize
2.2MB

Download
memory/2640-39-0x0000000008040000-0x0000000008278000-memory.dmp

Filesize
2.2MB

Download
memory/2640-31-0x0000000008040000-0x0000000008278000-memory.dmp

Filesize
2.2MB

Download
memory/2640-29-0x0000000008040000-0x0000000008278000-memory.dmp

Filesize
2.2MB

Download
memory/2640-25-0x0000000008040000-0x0000000008278000-memory.dmp

Filesize
2.2MB

Download
memory/2640-23-0x0000000008040000-0x0000000008278000-memory.dmp

Filesize
2.2MB

Download
memory/2640-19-0x0000000008040000-0x0000000008278000-memory.dmp

Filesize
2.2MB

Download
memory/2640-17-0x0000000008040000-0x0000000008278000-memory.dmp

Filesize
2.2MB

Download
memory/2640-15-0x0000000008040000-0x0000000008278000-memory.dmp

Filesize
2.2MB

Download
memory/2640-14-0x0000000008040000-0x0000000008278000-memory.dmp

Filesize
2.2MB

Download
memory/2640-11-0x0000000008040000-0x0000000008278000-memory.dmp

Filesize
2.2MB

Download
memory/2640-6-0x0000000008040000-0x0000000008278000-memory.dmp

Filesize
2.2MB

Download
memory/2640-4886-0x00000000752D0000-0x0000000075A80000-memory.dmp

Filesize
7.7MB

Download
memory/2640-4887-0x00000000053D0000-0x000000000544A000-memory.dmp

Filesize
488KB

Download
memory/2640-4888-0x0000000005270000-0x00000000052BC000-memory.dmp

Filesize
304KB

Download
memory/2640-4889-0x00000000752DE000-0x00000000752DF000-memory.dmp

Filesize
4KB

Download
memory/2640-4890-0x00000000752D0000-0x0000000075A80000-memory.dmp

Filesize
7.7MB

Download
memory/2640-4891-0x0000000000790000-0x00000000007E4000-memory.dmp

Filesize
336KB

Download
memory/2640-4895-0x00000000752D0000-0x0000000075A80000-memory.dmp

Filesize
7.7MB

Download
memory/2988-4894-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2988-4896-0x0000000000EF0000-0x000000000123A000-memory.dmp

Filesize
3.3MB

Download
memory/2988-4899-0x0000000000E60000-0x0000000000E74000-memory.dmp

Filesize
80KB

Download
memory/2988-4898-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2988-4903-0x0000000002CF0000-0x0000000002D04000-memory.dmp

Filesize
80KB

Download
memory/2988-4902-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3424-4900-0x0000000006ED0000-0x0000000006FE5000-memory.dmp

Filesize
1.1MB

Download
memory/3424-4904-0x0000000008350000-0x000000000843E000-memory.dmp

Filesize
952KB

Download
memory/3424-4911-0x0000000008350000-0x000000000843E000-memory.dmp

Filesize
952KB

Download
memory/3424-4914-0x00000000085B0000-0x0000000008702000-memory.dmp

Filesize
1.3MB

Download
memory/3424-4918-0x00000000085B0000-0x0000000008702000-memory.dmp

Filesize
1.3MB

Download
memory/4140-4908-0x0000000000C70000-0x0000000000C8F000-memory.dmp

Filesize
124KB

Download