formbook | 3cadb32dafeb421b94c09ca30944385141cbd4b032589b92bac948f27c287dfd

Analysis

max time kernel
136s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29-05-2024 01:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3cadb32dafeb421b94c09ca30944385141cbd4b032589b92bac948f27c287dfd.exe
Size

591KB
MD5

c9d5f9d20dd66ef3e2329b8a26f01af8
SHA1

d28d94662a5e84ad0ae68f35979782fa3344304c
SHA256

3cadb32dafeb421b94c09ca30944385141cbd4b032589b92bac948f27c287dfd
SHA512

3d54cb4223610f8e15336101dc946a533f839ec6d0d55a8a4143a8e99bf4bf3f0e70aacad80a5dee62619f19bbda845e6a65b76f0d10ab5d52feac2bb32b7dd1
SSDEEP

12288:luarYCFd6xuo/q3dk4vD7PDFoHBQKjX2q+hS1uv4S/LNApBxO:z81xTy3i4v/DFoHBTQh+uv4S/pApBxO

Score

10^/10

formbook cr12 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

cr12

Decoy

nff1291.com

satyainfra.com

hechiceradeamores.com

jfgminimalist.com

qut68q.com

pedandmore.com

sugardefender24-usa.us

somalse.com

lotusluxecandle.com

certificadobassetpro.com

veryaroma.com

thehistoryofindia.in

33155.cc

terastudy.net

84031.vip

heilsambegegnen.com

horizon-rg.info

junongpei.website

winstons.club

henslotalt.us

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4480-11-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

3cadb32dafeb421b94c09ca30944385141cbd4b032589b92bac948f27c287dfd.exe

description	pid	process	target process
PID 700 set thread context of 4480	700	3cadb32dafeb421b94c09ca30944385141cbd4b032589b92bac948f27c287dfd.exe	3cadb32dafeb421b94c09ca30944385141cbd4b032589b92bac948f27c287dfd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

3cadb32dafeb421b94c09ca30944385141cbd4b032589b92bac948f27c287dfd.exe

pid	process
4480	3cadb32dafeb421b94c09ca30944385141cbd4b032589b92bac948f27c287dfd.exe
4480	3cadb32dafeb421b94c09ca30944385141cbd4b032589b92bac948f27c287dfd.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

3cadb32dafeb421b94c09ca30944385141cbd4b032589b92bac948f27c287dfd.exe

description	pid	process	target process
PID 700 wrote to memory of 4480	700	3cadb32dafeb421b94c09ca30944385141cbd4b032589b92bac948f27c287dfd.exe	3cadb32dafeb421b94c09ca30944385141cbd4b032589b92bac948f27c287dfd.exe
PID 700 wrote to memory of 4480	700	3cadb32dafeb421b94c09ca30944385141cbd4b032589b92bac948f27c287dfd.exe	3cadb32dafeb421b94c09ca30944385141cbd4b032589b92bac948f27c287dfd.exe
PID 700 wrote to memory of 4480	700	3cadb32dafeb421b94c09ca30944385141cbd4b032589b92bac948f27c287dfd.exe	3cadb32dafeb421b94c09ca30944385141cbd4b032589b92bac948f27c287dfd.exe
PID 700 wrote to memory of 4480	700	3cadb32dafeb421b94c09ca30944385141cbd4b032589b92bac948f27c287dfd.exe	3cadb32dafeb421b94c09ca30944385141cbd4b032589b92bac948f27c287dfd.exe
PID 700 wrote to memory of 4480	700	3cadb32dafeb421b94c09ca30944385141cbd4b032589b92bac948f27c287dfd.exe	3cadb32dafeb421b94c09ca30944385141cbd4b032589b92bac948f27c287dfd.exe
PID 700 wrote to memory of 4480	700	3cadb32dafeb421b94c09ca30944385141cbd4b032589b92bac948f27c287dfd.exe	3cadb32dafeb421b94c09ca30944385141cbd4b032589b92bac948f27c287dfd.exe

C:\Users\Admin\AppData\Local\Temp\3cadb32dafeb421b94c09ca30944385141cbd4b032589b92bac948f27c287dfd.exe
"C:\Users\Admin\AppData\Local\Temp\3cadb32dafeb421b94c09ca30944385141cbd4b032589b92bac948f27c287dfd.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:700
- C:\Users\Admin\AppData\Local\Temp\3cadb32dafeb421b94c09ca30944385141cbd4b032589b92bac948f27c287dfd.exe
  "C:\Users\Admin\AppData\Local\Temp\3cadb32dafeb421b94c09ca30944385141cbd4b032589b92bac948f27c287dfd.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4480

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/700-6-0x0000000005260000-0x0000000005276000-memory.dmp

Filesize
88KB

Download
memory/700-0-0x0000000074B4E000-0x0000000074B4F000-memory.dmp

Filesize
4KB

Download
memory/700-2-0x0000000005530000-0x0000000005AD4000-memory.dmp

Filesize
5.6MB

Download
memory/700-3-0x0000000004E80000-0x0000000004F12000-memory.dmp

Filesize
584KB

Download
memory/700-4-0x0000000004F30000-0x0000000004F3A000-memory.dmp

Filesize
40KB

Download
memory/700-5-0x0000000074B40000-0x00000000752F0000-memory.dmp

Filesize
7.7MB

Download
memory/700-1-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/700-7-0x00000000060F0000-0x00000000060FC000-memory.dmp

Filesize
48KB

Download
memory/700-10-0x0000000009FD0000-0x000000000A06C000-memory.dmp

Filesize
624KB

Download
memory/700-9-0x0000000006110000-0x0000000006186000-memory.dmp

Filesize
472KB

Download
memory/700-8-0x0000000006100000-0x0000000006110000-memory.dmp

Filesize
64KB

Download
memory/700-13-0x0000000074B40000-0x00000000752F0000-memory.dmp

Filesize
7.7MB

Download
memory/4480-11-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4480-14-0x00000000012C0000-0x000000000160A000-memory.dmp

Filesize
3.3MB

Download