formbook | 8eade02ff3abef532d9070a1e3ea6f8df6c213748bce1c0f55b75686706a53c4

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/06/2024, 08:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8eade02ff3abef532d9070a1e3ea6f8df6c213748bce1c0f55b75686706a53c4.exe
Size 1.1MB
Sample240608-j8er4abd26
SHA256 8eade02ff3abef532d9070a1e3ea6f8df6c213748bce1c0f55b75686706a53c4
MD5 0c6407d325d33ae44fe0ea0fc5f85711
SHA1 fe4a8ecf4a0f744bd9550824daf199af03920821
SHA512 6876d67f36b301704b86a6b3843c2a7c2a4520fdc67b93a4556090b4941c217540a0d0d4bf1ceba791152c4d9a083cce8b9e6190ed8ac2284b96dc95cc87bad3
SSDEEP 24576:KAHnh+eWsN3skA4RV1Hom2KXMmHahnQdptU/Nmvvv+zrVV7Dip5:dh+ZkldoPK8YahQdp0geVV7Q
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook rn94 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

rn94

Decoy

st68v.xyz
conciergenotary.net
qwechaotk.top
rtpdonatoto29.xyz
8ad.xyz
powermove.top
cameras-30514.bond
vanguardcoffee.shop
umoe53fxc1bsujv.buzz
consultoriamax.net
hplxx.com
ndu.wtf
yzh478c.xyz
bigbrown999.site
xiake07.asia
resdai.xyz
the35678.shop
ba6rf.rest
ceo688.com
phimxhot.xyz
010101-11122-2222.cloud
champion-casino-skw.buzz
laku77.bar
popumail.net
stargazerastrology.click
beauty.university
t460.top
sparkyos.app
day2go.net
minrungis.shop
cognigrid.com
abandoned-houses-39863.bond
liderparti.store
hinet.tech
moviemax.live
business-printer-22001.bond
yakintv.pro
longmaosol.xyz
hello4d.dev
vestircool.store
surpriseinside.net
betflixfan.asia
ln2m1.shop
5302mcavt.website
conf-contact.online
31140.ooo
bdkasinoxox.xyz
nicoleb.tech
mainz-cruise-deals.today
run-run.tokyo
practicalfranchises.info
usmanovbanki-uz.space
superlottery.top
zabbet911.bet
ambassadorshipvottings.click
sangforln.tech
expertoffersusa.lat
plong.cloud
cryptoautomata.dev
dq33xa.xyz
handtools-16660.bond
24763wbk.hair
sportswear-30530.bond
lusuidnx.shop
laske.xyz

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/2144-28-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/2144-31-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/3232-38-0x0000000000800000-0x000000000082F000-memory.dmp	formbook

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs	name.exe

Executes dropped EXE 1 IoCs

pid	Process
1104	name.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000700000002323f-13.dat	autoit_exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1104 set thread context of 2144	1104	name.exe	91
PID 2144 set thread context of 3240	2144	svchost.exe	56
PID 3232 set thread context of 3240	3232	svchost.exe	56

Suspicious behavior: EnumeratesProcesses 61 IoCs

pid	Process
2144	svchost.exe
2144	svchost.exe
2144	svchost.exe
2144	svchost.exe
3232	svchost.exe
3232	svchost.exe
3232	svchost.exe
3232	svchost.exe
3232	svchost.exe
3232	svchost.exe
3232	svchost.exe
3232	svchost.exe
3232	svchost.exe
3232	svchost.exe
3232	svchost.exe
3232	svchost.exe
3232	svchost.exe
3232	svchost.exe
3232	svchost.exe
3232	svchost.exe
3232	svchost.exe
3232	svchost.exe
3232	svchost.exe
3232	svchost.exe
3232	svchost.exe
3232	svchost.exe
3232	svchost.exe
3232	svchost.exe
3232	svchost.exe
3232	svchost.exe
3232	svchost.exe
3232	svchost.exe
3232	svchost.exe
3232	svchost.exe
3232	svchost.exe
3232	svchost.exe
3232	svchost.exe
3232	svchost.exe
3232	svchost.exe
3232	svchost.exe
3232	svchost.exe
3232	svchost.exe
3232	svchost.exe
3232	svchost.exe
3232	svchost.exe
3232	svchost.exe
3232	svchost.exe
3232	svchost.exe
3232	svchost.exe
3232	svchost.exe
3232	svchost.exe
3232	svchost.exe
3232	svchost.exe
3232	svchost.exe
3232	svchost.exe
3232	svchost.exe
3232	svchost.exe
3232	svchost.exe
3232	svchost.exe
3232	svchost.exe
3232	svchost.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
1104	name.exe
2144	svchost.exe
2144	svchost.exe
2144	svchost.exe
3232	svchost.exe
3232	svchost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2144	svchost.exe
Token: SeDebugPrivilege	3232	svchost.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
3968	8eade02ff3abef532d9070a1e3ea6f8df6c213748bce1c0f55b75686706a53c4.exe
3968	8eade02ff3abef532d9070a1e3ea6f8df6c213748bce1c0f55b75686706a53c4.exe
1104	name.exe
1104	name.exe
3240	Explorer.EXE
3240	Explorer.EXE

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
3968	8eade02ff3abef532d9070a1e3ea6f8df6c213748bce1c0f55b75686706a53c4.exe
3968	8eade02ff3abef532d9070a1e3ea6f8df6c213748bce1c0f55b75686706a53c4.exe
1104	name.exe
1104	name.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3968 wrote to memory of 1104	3968	8eade02ff3abef532d9070a1e3ea6f8df6c213748bce1c0f55b75686706a53c4.exe	90
PID 3968 wrote to memory of 1104	3968	8eade02ff3abef532d9070a1e3ea6f8df6c213748bce1c0f55b75686706a53c4.exe	90
PID 3968 wrote to memory of 1104	3968	8eade02ff3abef532d9070a1e3ea6f8df6c213748bce1c0f55b75686706a53c4.exe	90
PID 1104 wrote to memory of 2144	1104	name.exe	91
PID 1104 wrote to memory of 2144	1104	name.exe	91
PID 1104 wrote to memory of 2144	1104	name.exe	91
PID 1104 wrote to memory of 2144	1104	name.exe	91
PID 3240 wrote to memory of 3232	3240	Explorer.EXE	92
PID 3240 wrote to memory of 3232	3240	Explorer.EXE	92
PID 3240 wrote to memory of 3232	3240	Explorer.EXE	92
PID 3232 wrote to memory of 4604	3232	svchost.exe	93
PID 3232 wrote to memory of 4604	3232	svchost.exe	93
PID 3232 wrote to memory of 4604	3232	svchost.exe	93

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3240
- C:\Users\Admin\AppData\Local\Temp\8eade02ff3abef532d9070a1e3ea6f8df6c213748bce1c0f55b75686706a53c4.exe
  "C:\Users\Admin\AppData\Local\Temp\8eade02ff3abef532d9070a1e3ea6f8df6c213748bce1c0f55b75686706a53c4.exe"
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3968
- - C:\Users\Admin\AppData\Local\directory\name.exe
    "C:\Users\Admin\AppData\Local\Temp\8eade02ff3abef532d9070a1e3ea6f8df6c213748bce1c0f55b75686706a53c4.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1104
  - - C:\Windows\SysWOW64\svchost.exe
      "C:\Users\Admin\AppData\Local\Temp\8eade02ff3abef532d9070a1e3ea6f8df6c213748bce1c0f55b75686706a53c4.exe"
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:2144
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\SysWOW64\svchost.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3232
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Windows\SysWOW64\svchost.exe"
    3⤵
    PID:4604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4076 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:4524

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

biopsies

Path C:\Users\Admin\AppData\Local\Temp\biopsies
Size 28KB
SHA256 4392549d97f9eed84f606b3e39767702d8c394d524578bd85ac868821f9228fe
MD5 93539ca4f277d10b079052b96465d096
SHA1 542edab9599e3589407ef215337806b7f101a920
SHA512 5d4f6df33778dec60b0bc962e61404133e3e3f481d5d7c36a8b66ae03532784213b800825cc607e6e26b90c4245dca85a9d32619fb2045dbef9160c67f2819e9
SSDEEP 768:WiTZ+2QoioGRk6ZklputwjpjBkCiw2RuJ3nXKUrvzjsNbJ+IIm54vfF3if6gyyNQ:WiTZ+2QoioGRk6ZklputwjpjBkCiw2Rm
MD5 SHA1 SHA512 SSDEEP

Submit Download

name.exe

Path C:\Users\Admin\AppData\Local\directory\name.exe
Size 1.1MB
SHA256 8eade02ff3abef532d9070a1e3ea6f8df6c213748bce1c0f55b75686706a53c4
MD5 0c6407d325d33ae44fe0ea0fc5f85711
SHA1 fe4a8ecf4a0f744bd9550824daf199af03920821
SHA512 6876d67f36b301704b86a6b3843c2a7c2a4520fdc67b93a4556090b4941c217540a0d0d4bf1ceba791152c4d9a083cce8b9e6190ed8ac2284b96dc95cc87bad3
SSDEEP 24576:KAHnh+eWsN3skA4RV1Hom2KXMmHahnQdptU/Nmvvv+zrVV7Dip5:dh+ZkldoPK8YahQdp0geVV7Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2144-28-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2144-29-0x0000000000E00000-0x000000000114A000-memory.dmp

Download

memory/2144-31-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2144-32-0x0000000001240000-0x0000000001255000-memory.dmp

Download

memory/3232-37-0x00000000005B0000-0x00000000005BE000-memory.dmp

Download

memory/3232-38-0x0000000000800000-0x000000000082F000-memory.dmp

Download

memory/3232-34-0x00000000005B0000-0x00000000005BE000-memory.dmp

Download

memory/3240-33-0x0000000002AD0000-0x0000000002BB8000-memory.dmp

Download

memory/3240-40-0x0000000007D00000-0x0000000007DAC000-memory.dmp

Download

memory/3240-41-0x0000000002AD0000-0x0000000002BB8000-memory.dmp

Download

memory/3240-42-0x0000000007D00000-0x0000000007DAC000-memory.dmp

Download

memory/3240-45-0x0000000007D00000-0x0000000007DAC000-memory.dmp

Download

memory/3968-10-0x0000000001DF0000-0x0000000001DF4000-memory.dmp

Download