formbook | a397ea09777854429437e8bda2f2b0ac22d6d5dec93418b3b33ce66b33d74576

Analysis

max time kernel
132s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-05-2024 14:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Цитата.exe
Size

562KB
MD5

84144b6048277290bb6eb647bbc5ad2a
SHA1

609a26e95e4b343bfb47ab51bdd68ef9a8ef791f
SHA256

151bfa7336a9c96e65bf8a0eeb54a3d34665e612c8c5b3a7886f16a6f58277c4
SHA512

792f0c22ed8aef3766f773f4c49698e9d2d2678191c98493e83076fa90dc8a83d67cdd00fe46d7409b4eeb1539c542cd0219b4b9121d45ecbb0ec0ac3bd94baa
SSDEEP

12288:R+vLWa44/RYO83ksdpiVRkvZU08wvzTIVodNgvBqk0WFLehfK2iE3LKvmbrJ:E44/Ky7MN7LT4vBqkle1FPbKSd

Score

10^/10

formbook gy14 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

gy14

Decoy

mavbam.com

theanhedonia.com

budgetnurseries.com

buflitr.com

alqamarhotel.com

2660348.top

123bu6.shop

v72999.com

yzyz841.xyz

247fracing.com

naples.beauty

twinklethrive.com

loscaseros.com

creditspisatylegko.site

sgyy3ej2dgwesb5.com

ufocafe.net

techn9nehollywoodundead.com

truedatalab.com

alterdpxlmarketing.com

harborspringsfire.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/684-7-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

Цитата.exe

description pid process target process

PID 1056 set thread context of 684 1056 Цитата.exe csc.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2936 684 WerFault.exe csc.exe

description	pid	process	target process
PID 1056 set thread context of 684	1056	Цитата.exe	csc.exe

pid	pid_target	process	target process
2936	684	WerFault.exe	csc.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

Цитата.exe

description	pid	process	target process
PID 1056 wrote to memory of 684	1056	Цитата.exe	csc.exe
PID 1056 wrote to memory of 684	1056	Цитата.exe	csc.exe
PID 1056 wrote to memory of 684	1056	Цитата.exe	csc.exe
PID 1056 wrote to memory of 684	1056	Цитата.exe	csc.exe
PID 1056 wrote to memory of 684	1056	Цитата.exe	csc.exe
PID 1056 wrote to memory of 684	1056	Цитата.exe	csc.exe

C:\Users\Admin\AppData\Local\Temp\Цитата.exe
"C:\Users\Admin\AppData\Local\Temp\Цитата.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1056

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
2⤵
PID:684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 684 -s 12
3⤵
- Program crash
PID:2936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 684 -ip 684
1⤵
PID:2804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4008,i,5711962389779687290,1245653010537220991,262144 --variations-seed-version --mojo-platform-channel-handle=4100 /prefetch:8
1⤵
PID:5028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/684-7-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1056-0-0x00000293F3B70000-0x00000293F3B7C000-memory.dmp

Filesize
48KB

Download
memory/1056-1-0x00007FFC06943000-0x00007FFC06945000-memory.dmp

Filesize
8KB

Download
memory/1056-2-0x00000293F6A10000-0x00000293F6A86000-memory.dmp

Filesize
472KB

Download
memory/1056-3-0x00000293F6990000-0x00000293F69AE000-memory.dmp

Filesize
120KB

Download
memory/1056-4-0x00007FFC06940000-0x00007FFC07401000-memory.dmp

Filesize
10.8MB

Download
memory/1056-5-0x00000293F56D0000-0x00000293F56D6000-memory.dmp

Filesize
24KB

Download
memory/1056-6-0x00000293F6C00000-0x00000293F6C86000-memory.dmp

Filesize
536KB

Download
memory/1056-8-0x00007FFC06940000-0x00007FFC07401000-memory.dmp

Filesize
10.8MB

Download