formbook | 5f811c57872e95387829dbd3addf6e27bbf3bcbcc388354ea19d41ed1b5bd8de

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 06:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Quotation.exe
Size

696KB
MD5

1701c039722e0ba1cc8876b22bc371f7
SHA1

4b0827c74ec83a5c5db429d36d095d3f7d14d8a5
SHA256

5f811c57872e95387829dbd3addf6e27bbf3bcbcc388354ea19d41ed1b5bd8de
SHA512

baa1cb4fea71fea989998b40c7fc61df73e967d3eae4af3000143a51bd195659b1295c9573a2ce4b7f1bf7810907305dd5e2826dd3fad887b7103546c224d5ce
SSDEEP

12288:u7kpO8mUKNr+uf5Z3g7Gj1/TTwYmbHNbAHUkZJ1bfQ+Ruf0MTGLjcTb:G82Cuf5ZQ7GjpTTwAJhQ+RFeZ

Score

10^/10

formbook mw62 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

mw62

Decoy

abpdainik.in

luxuryprojectmalad.co.in

cajunbellebeauty.com

fpmfstudios.com

spedyz.shop

wilddogphotographics.com

apollomoda1.com

evrimciftciportfolio.com

99977bet.com

inefavel.com

mf85.com

online-doctor-nl-1.bond

zqi2lv.vip

thewebdesignhub.co

botwitter.com

18comic-palwoeld.club

loveweldpermanentjewelry.com

l3er39pc-gaywn6kv-d7fs4t7u.cc

31yoyogamestudio.com

yhvh.cloud

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/4336-12-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/4336-17-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/1884-22-0x0000000000C70000-0x0000000000C9F000-memory.dmp	formbook

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4464 set thread context of 4336	4464	Quotation.exe	89
PID 4336 set thread context of 3516	4336	Quotation.exe	56
PID 1884 set thread context of 3516	1884	cmmon32.exe	56

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
4336	Quotation.exe
4336	Quotation.exe
4336	Quotation.exe
4336	Quotation.exe
1884	cmmon32.exe
1884	cmmon32.exe
1884	cmmon32.exe
1884	cmmon32.exe
1884	cmmon32.exe
1884	cmmon32.exe
1884	cmmon32.exe
1884	cmmon32.exe
1884	cmmon32.exe
1884	cmmon32.exe
1884	cmmon32.exe
1884	cmmon32.exe
1884	cmmon32.exe
1884	cmmon32.exe
1884	cmmon32.exe
1884	cmmon32.exe
1884	cmmon32.exe
1884	cmmon32.exe
1884	cmmon32.exe
1884	cmmon32.exe
1884	cmmon32.exe
1884	cmmon32.exe
1884	cmmon32.exe
1884	cmmon32.exe
1884	cmmon32.exe
1884	cmmon32.exe
1884	cmmon32.exe
1884	cmmon32.exe
1884	cmmon32.exe
1884	cmmon32.exe
1884	cmmon32.exe
1884	cmmon32.exe
1884	cmmon32.exe
1884	cmmon32.exe
1884	cmmon32.exe
1884	cmmon32.exe
1884	cmmon32.exe
1884	cmmon32.exe
1884	cmmon32.exe
1884	cmmon32.exe
1884	cmmon32.exe
1884	cmmon32.exe
1884	cmmon32.exe
1884	cmmon32.exe
1884	cmmon32.exe
1884	cmmon32.exe
1884	cmmon32.exe
1884	cmmon32.exe
1884	cmmon32.exe
1884	cmmon32.exe
1884	cmmon32.exe
1884	cmmon32.exe
1884	cmmon32.exe
1884	cmmon32.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
4336	Quotation.exe
4336	Quotation.exe
4336	Quotation.exe
1884	cmmon32.exe
1884	cmmon32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4336	Quotation.exe
Token: SeDebugPrivilege	1884	cmmon32.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 4336	4464	Quotation.exe	89
PID 4464 wrote to memory of 4336	4464	Quotation.exe	89
PID 4464 wrote to memory of 4336	4464	Quotation.exe	89
PID 4464 wrote to memory of 4336	4464	Quotation.exe	89
PID 4464 wrote to memory of 4336	4464	Quotation.exe	89
PID 4464 wrote to memory of 4336	4464	Quotation.exe	89
PID 3516 wrote to memory of 1884	3516	Explorer.EXE	90
PID 3516 wrote to memory of 1884	3516	Explorer.EXE	90
PID 3516 wrote to memory of 1884	3516	Explorer.EXE	90
PID 1884 wrote to memory of 1428	1884	cmmon32.exe	91
PID 1884 wrote to memory of 1428	1884	cmmon32.exe	91
PID 1884 wrote to memory of 1428	1884	cmmon32.exe	91

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:3516
- C:\Users\Admin\AppData\Local\Temp\Quotation.exe
  "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4464
- - C:\Users\Admin\AppData\Local\Temp\Quotation.exe
    "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:4336
- C:\Windows\SysWOW64\cmmon32.exe
  "C:\Windows\SysWOW64\cmmon32.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1884
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
    3⤵
    PID:1428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1884-22-0x0000000000C70000-0x0000000000C9F000-memory.dmp

Filesize
188KB

Download
memory/1884-20-0x0000000000880000-0x000000000088C000-memory.dmp

Filesize
48KB

Download
memory/1884-21-0x0000000000880000-0x000000000088C000-memory.dmp

Filesize
48KB

Download
memory/3516-19-0x00000000026D0000-0x00000000027B6000-memory.dmp

Filesize
920KB

Download
memory/3516-31-0x0000000008420000-0x0000000008550000-memory.dmp

Filesize
1.2MB

Download
memory/3516-28-0x0000000008420000-0x0000000008550000-memory.dmp

Filesize
1.2MB

Download
memory/3516-27-0x0000000008420000-0x0000000008550000-memory.dmp

Filesize
1.2MB

Download
memory/3516-24-0x00000000026D0000-0x00000000027B6000-memory.dmp

Filesize
920KB

Download
memory/4336-12-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4336-15-0x0000000001710000-0x0000000001A5A000-memory.dmp

Filesize
3.3MB

Download
memory/4336-18-0x0000000001240000-0x0000000001254000-memory.dmp

Filesize
80KB

Download
memory/4336-17-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4464-8-0x0000000006A80000-0x0000000006A8E000-memory.dmp

Filesize
56KB

Download
memory/4464-14-0x00000000744A0000-0x0000000074C50000-memory.dmp

Filesize
7.7MB

Download
memory/4464-0-0x00000000744AE000-0x00000000744AF000-memory.dmp

Filesize
4KB

Download
memory/4464-11-0x00000000091A0000-0x000000000923C000-memory.dmp

Filesize
624KB

Download
memory/4464-10-0x0000000006AA0000-0x0000000006B16000-memory.dmp

Filesize
472KB

Download
memory/4464-9-0x0000000006A90000-0x0000000006AA0000-memory.dmp

Filesize
64KB

Download
memory/4464-7-0x0000000005430000-0x0000000005446000-memory.dmp

Filesize
88KB

Download
memory/4464-6-0x00000000059F0000-0x0000000005D44000-memory.dmp

Filesize
3.3MB

Download
memory/4464-5-0x00000000744A0000-0x0000000074C50000-memory.dmp

Filesize
7.7MB

Download
memory/4464-4-0x00000000050F0000-0x00000000050FA000-memory.dmp

Filesize
40KB

Download
memory/4464-3-0x0000000004F30000-0x0000000004FC2000-memory.dmp

Filesize
584KB

Download
memory/4464-2-0x0000000005440000-0x00000000059E4000-memory.dmp

Filesize
5.6MB

Download
memory/4464-1-0x0000000000490000-0x000000000053E000-memory.dmp

Filesize
696KB

Download