formbook | 8eade02ff3abef532d9070a1e3ea6f8df6c213748bce1c0f55b75686706a53c4

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2024, 06:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PO TRO-1075 - TRO-1076 904504608468.pdf.exe
Size 1.1MB
Sample240607-he7qcacf23
SHA256 8eade02ff3abef532d9070a1e3ea6f8df6c213748bce1c0f55b75686706a53c4
MD5 0c6407d325d33ae44fe0ea0fc5f85711
SHA1 fe4a8ecf4a0f744bd9550824daf199af03920821
SHA512 6876d67f36b301704b86a6b3843c2a7c2a4520fdc67b93a4556090b4941c217540a0d0d4bf1ceba791152c4d9a083cce8b9e6190ed8ac2284b96dc95cc87bad3
SSDEEP 24576:KAHnh+eWsN3skA4RV1Hom2KXMmHahnQdptU/Nmvvv+zrVV7Dip5:dh+ZkldoPK8YahQdp0geVV7Q
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook rn94 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

rn94

Decoy

st68v.xyz
conciergenotary.net
qwechaotk.top
rtpdonatoto29.xyz
8ad.xyz
powermove.top
cameras-30514.bond
vanguardcoffee.shop
umoe53fxc1bsujv.buzz
consultoriamax.net
hplxx.com
ndu.wtf
yzh478c.xyz
bigbrown999.site
xiake07.asia
resdai.xyz
the35678.shop
ba6rf.rest
ceo688.com
phimxhot.xyz
010101-11122-2222.cloud
champion-casino-skw.buzz
laku77.bar
popumail.net
stargazerastrology.click
beauty.university
t460.top
sparkyos.app
day2go.net
minrungis.shop
cognigrid.com
abandoned-houses-39863.bond
liderparti.store
hinet.tech
moviemax.live
business-printer-22001.bond
yakintv.pro
longmaosol.xyz
hello4d.dev
vestircool.store
surpriseinside.net
betflixfan.asia
ln2m1.shop
5302mcavt.website
conf-contact.online
31140.ooo
bdkasinoxox.xyz
nicoleb.tech
mainz-cruise-deals.today
run-run.tokyo
practicalfranchises.info
usmanovbanki-uz.space
superlottery.top
zabbet911.bet
ambassadorshipvottings.click
sangforln.tech
expertoffersusa.lat
plong.cloud
cryptoautomata.dev
dq33xa.xyz
handtools-16660.bond
24763wbk.hair
sportswear-30530.bond
lusuidnx.shop
laske.xyz

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/3620-28-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/3620-31-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/1084-37-0x0000000000DB0000-0x0000000000DDF000-memory.dmp	formbook

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs	name.exe

Executes dropped EXE 1 IoCs

pid	Process
4064	name.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000a0000000233de-14.dat	autoit_exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4064 set thread context of 3620	4064	name.exe	85
PID 3620 set thread context of 3604	3620	svchost.exe	56
PID 1084 set thread context of 3604	1084	svchost.exe	56

Suspicious behavior: EnumeratesProcesses 62 IoCs

pid	Process
3620	svchost.exe
3620	svchost.exe
3620	svchost.exe
3620	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe
1084	svchost.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
4064	name.exe
3620	svchost.exe
3620	svchost.exe
3620	svchost.exe
1084	svchost.exe
1084	svchost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3620	svchost.exe
Token: SeDebugPrivilege	1084	svchost.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
1828	PO TRO-1075 - TRO-1076 904504608468.pdf.exe
1828	PO TRO-1075 - TRO-1076 904504608468.pdf.exe
4064	name.exe
4064	name.exe
3604	Explorer.EXE
3604	Explorer.EXE

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1828	PO TRO-1075 - TRO-1076 904504608468.pdf.exe
1828	PO TRO-1075 - TRO-1076 904504608468.pdf.exe
4064	name.exe
4064	name.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3604	Explorer.EXE

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1828 wrote to memory of 4064	1828	PO TRO-1075 - TRO-1076 904504608468.pdf.exe	84
PID 1828 wrote to memory of 4064	1828	PO TRO-1075 - TRO-1076 904504608468.pdf.exe	84
PID 1828 wrote to memory of 4064	1828	PO TRO-1075 - TRO-1076 904504608468.pdf.exe	84
PID 4064 wrote to memory of 3620	4064	name.exe	85
PID 4064 wrote to memory of 3620	4064	name.exe	85
PID 4064 wrote to memory of 3620	4064	name.exe	85
PID 4064 wrote to memory of 3620	4064	name.exe	85
PID 3604 wrote to memory of 1084	3604	Explorer.EXE	86
PID 3604 wrote to memory of 1084	3604	Explorer.EXE	86
PID 3604 wrote to memory of 1084	3604	Explorer.EXE	86
PID 1084 wrote to memory of 3160	1084	svchost.exe	87
PID 1084 wrote to memory of 3160	1084	svchost.exe	87
PID 1084 wrote to memory of 3160	1084	svchost.exe	87

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3604
- C:\Users\Admin\AppData\Local\Temp\PO TRO-1075 - TRO-1076 904504608468.pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\PO TRO-1075 - TRO-1076 904504608468.pdf.exe"
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1828
- - C:\Users\Admin\AppData\Local\directory\name.exe
    "C:\Users\Admin\AppData\Local\Temp\PO TRO-1075 - TRO-1076 904504608468.pdf.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4064
  - - C:\Windows\SysWOW64\svchost.exe
      "C:\Users\Admin\AppData\Local\Temp\PO TRO-1075 - TRO-1076 904504608468.pdf.exe"
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:3620
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\SysWOW64\svchost.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1084
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Windows\SysWOW64\svchost.exe"
    3⤵
    PID:3160

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

name.exe

Path C:\Users\Admin\AppData\Local\directory\name.exe
Size 1.1MB
SHA256 8eade02ff3abef532d9070a1e3ea6f8df6c213748bce1c0f55b75686706a53c4
MD5 0c6407d325d33ae44fe0ea0fc5f85711
SHA1 fe4a8ecf4a0f744bd9550824daf199af03920821
SHA512 6876d67f36b301704b86a6b3843c2a7c2a4520fdc67b93a4556090b4941c217540a0d0d4bf1ceba791152c4d9a083cce8b9e6190ed8ac2284b96dc95cc87bad3
SSDEEP 24576:KAHnh+eWsN3skA4RV1Hom2KXMmHahnQdptU/Nmvvv+zrVV7Dip5:dh+ZkldoPK8YahQdp0geVV7Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1084-36-0x0000000000820000-0x000000000082E000-memory.dmp

Download

memory/1084-34-0x0000000000820000-0x000000000082E000-memory.dmp

Download

memory/1084-37-0x0000000000DB0000-0x0000000000DDF000-memory.dmp

Download

memory/1828-10-0x0000000001870000-0x0000000001874000-memory.dmp

Download

memory/3604-39-0x00000000083A0000-0x00000000084E8000-memory.dmp

Download

memory/3604-33-0x0000000008120000-0x0000000008206000-memory.dmp

Download

memory/3604-44-0x00000000083A0000-0x00000000084E8000-memory.dmp

Download

memory/3604-41-0x0000000008120000-0x0000000008206000-memory.dmp

Download

memory/3604-40-0x00000000083A0000-0x00000000084E8000-memory.dmp

Download

memory/3620-28-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3620-29-0x0000000001600000-0x000000000194A000-memory.dmp

Download

memory/3620-31-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3620-32-0x00000000013B0000-0x00000000013C5000-memory.dmp

Download