formbook | 9022ec12d1c63779111d34993afd7aa58f7a7ed7087271c52f2300dee80c7f89

Analysis

max time kernel
150s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11-07-2024 20:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MalwareBazaar.exe
Size

760KB
MD5

c9101fc66be35a3746ffea8e448c5119
SHA1

453297f427c9c7a9b0e3a79fe4885d5d7c12af98
SHA256

9022ec12d1c63779111d34993afd7aa58f7a7ed7087271c52f2300dee80c7f89
SHA512

76efa88ad4a8d82b0b10abdc4dbb91db659e7ed4e9a9e4df6be8942f4235ad11ca27492907892da4cc82321be54056401b7caa1725a953784cab5bd1744bbdad
SSDEEP

12288:ICc0CBN2iN/ougr+OAnK3Uv4ybDHpT4fN6AhDALgVWTsY/sQj14GB:ICc0CBN1F7tOcK3Uv4yB4dhcMgAAJ

Score

10^/10

formbook dy13 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dy13

Decoy

manga-house.com

kjsdhklssk51.xyz

b0ba138.xyz

bt365033.com

ccbsinc.net

mrwine.xyz

nrxkrd527o.xyz

hoshi.social

1912ai.com

serco2020.com

byfchfyr.xyz

imuschestvostorgov.online

austinheafey.com

mrdfa.club

883106.photos

profitablefxmarkets.com

taini00.net

brye.top

ginsm.com

sportglid.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/2716-11-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/2716-16-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/528-22-0x00000000004F0000-0x000000000051F000-memory.dmp	formbook

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1028 set thread context of 2716	1028	MalwareBazaar.exe	86
PID 2716 set thread context of 3520	2716	MalwareBazaar.exe	56
PID 528 set thread context of 3520	528	WWAHost.exe	56

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
2716	MalwareBazaar.exe
2716	MalwareBazaar.exe
2716	MalwareBazaar.exe
2716	MalwareBazaar.exe
528	WWAHost.exe
528	WWAHost.exe
528	WWAHost.exe
528	WWAHost.exe
528	WWAHost.exe
528	WWAHost.exe
528	WWAHost.exe
528	WWAHost.exe
528	WWAHost.exe
528	WWAHost.exe
528	WWAHost.exe
528	WWAHost.exe
528	WWAHost.exe
528	WWAHost.exe
528	WWAHost.exe
528	WWAHost.exe
528	WWAHost.exe
528	WWAHost.exe
528	WWAHost.exe
528	WWAHost.exe
528	WWAHost.exe
528	WWAHost.exe
528	WWAHost.exe
528	WWAHost.exe
528	WWAHost.exe
528	WWAHost.exe
528	WWAHost.exe
528	WWAHost.exe
528	WWAHost.exe
528	WWAHost.exe
528	WWAHost.exe
528	WWAHost.exe
528	WWAHost.exe
528	WWAHost.exe
528	WWAHost.exe
528	WWAHost.exe
528	WWAHost.exe
528	WWAHost.exe
528	WWAHost.exe
528	WWAHost.exe
528	WWAHost.exe
528	WWAHost.exe
528	WWAHost.exe
528	WWAHost.exe
528	WWAHost.exe
528	WWAHost.exe
528	WWAHost.exe
528	WWAHost.exe
528	WWAHost.exe
528	WWAHost.exe
528	WWAHost.exe
528	WWAHost.exe
528	WWAHost.exe
528	WWAHost.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
2716	MalwareBazaar.exe
2716	MalwareBazaar.exe
2716	MalwareBazaar.exe
528	WWAHost.exe
528	WWAHost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2716	MalwareBazaar.exe
Token: SeDebugPrivilege	528	WWAHost.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3520	Explorer.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1028 wrote to memory of 2716	1028	MalwareBazaar.exe	86
PID 1028 wrote to memory of 2716	1028	MalwareBazaar.exe	86
PID 1028 wrote to memory of 2716	1028	MalwareBazaar.exe	86
PID 1028 wrote to memory of 2716	1028	MalwareBazaar.exe	86
PID 1028 wrote to memory of 2716	1028	MalwareBazaar.exe	86
PID 1028 wrote to memory of 2716	1028	MalwareBazaar.exe	86
PID 3520 wrote to memory of 528	3520	Explorer.EXE	87
PID 3520 wrote to memory of 528	3520	Explorer.EXE	87
PID 3520 wrote to memory of 528	3520	Explorer.EXE	87
PID 528 wrote to memory of 5088	528	WWAHost.exe	88
PID 528 wrote to memory of 5088	528	WWAHost.exe	88
PID 528 wrote to memory of 5088	528	WWAHost.exe	88

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3520
- C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe
  "C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1028
- - C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe
    "C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:2716
- C:\Windows\SysWOW64\WWAHost.exe
  "C:\Windows\SysWOW64\WWAHost.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:528
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"
    3⤵
    PID:5088

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/528-19-0x00000000005A0000-0x000000000067C000-memory.dmp

Filesize
880KB

Download
memory/528-22-0x00000000004F0000-0x000000000051F000-memory.dmp

Filesize
188KB

Download
memory/528-21-0x00000000005A0000-0x000000000067C000-memory.dmp

Filesize
880KB

Download
memory/1028-6-0x00000000050E0000-0x00000000050F2000-memory.dmp

Filesize
72KB

Download
memory/1028-1-0x00000000004D0000-0x0000000000594000-memory.dmp

Filesize
784KB

Download
memory/1028-5-0x0000000074710000-0x0000000074EC0000-memory.dmp

Filesize
7.7MB

Download
memory/1028-0-0x000000007471E000-0x000000007471F000-memory.dmp

Filesize
4KB

Download
memory/1028-7-0x0000000006140000-0x0000000006148000-memory.dmp

Filesize
32KB

Download
memory/1028-8-0x0000000006150000-0x000000000615E000-memory.dmp

Filesize
56KB

Download
memory/1028-9-0x0000000006170000-0x00000000061E6000-memory.dmp

Filesize
472KB

Download
memory/1028-10-0x000000000A1D0000-0x000000000A26C000-memory.dmp

Filesize
624KB

Download
memory/1028-4-0x0000000005010000-0x000000000501A000-memory.dmp

Filesize
40KB

Download
memory/1028-13-0x0000000074710000-0x0000000074EC0000-memory.dmp

Filesize
7.7MB

Download
memory/1028-2-0x0000000005380000-0x0000000005924000-memory.dmp

Filesize
5.6MB

Download
memory/1028-3-0x0000000004E70000-0x0000000004F02000-memory.dmp

Filesize
584KB

Download
memory/2716-16-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2716-17-0x0000000000EF0000-0x0000000000F05000-memory.dmp

Filesize
84KB

Download
memory/2716-14-0x0000000001030000-0x000000000137A000-memory.dmp

Filesize
3.3MB

Download
memory/2716-11-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3520-18-0x0000000007CE0000-0x0000000007E86000-memory.dmp

Filesize
1.6MB

Download
memory/3520-24-0x0000000007CE0000-0x0000000007E86000-memory.dmp

Filesize
1.6MB

Download
memory/3520-27-0x0000000007E90000-0x0000000007F5C000-memory.dmp

Filesize
816KB

Download
memory/3520-28-0x0000000007E90000-0x0000000007F5C000-memory.dmp

Filesize
816KB

Download
memory/3520-31-0x0000000007E90000-0x0000000007F5C000-memory.dmp

Filesize
816KB

Download