formbook | 352-21-0x0000000000400000-0x000000000042A000-memory[.]dmp

Sharing

Copy URL Twitter E-mail

General

Target
352-21-0x0000000000400000-0x000000000042A000-memory.dmp
Size 168KB
Sample240725-dtwt6svgrp
SHA256 416d47cae8553f65b0a304ad2414f6d6dec0b9dd273ca56c84967b624c7b57e8
MD5 ea1f87d884f7e1725703253f44421685
SHA1 149fc6aab754a3b0b9aaabc622b551f6535367e0
SHA512 4f23fc415f33e6f1124494fe464f4031d3c749c1b84c1ed01c0b6c513e1068e22c3de93673067524623f90abf122afa0fab8bde789f49f25af4728d989c7d7b0
SSDEEP 3072:uira2cYeBwABNWkLVU8CmXVgG+g4aLkOpK//u1eURptjvrZKrxUuB/tZyJ:utAeBthU8BXVgzg4aLU+7V6xbB/tZyJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat ow formbook

Malware Config

Extracted

Family

formbook

Version

Campaign

Decoy

piavecaffe.com
jlxkqg.men
lifesavingfoundation.net
karadasama.net
michaeltraolach-macsweeney.com
thunderwatches.com
serviciocasawhirlpool.biz
c-cap.online
itparksolution.com
clarityhearingkw.com
wpgrosiri.date
colemarshalcambell.com
webperffest.com
adjusterforirma.info
buildersqq.com
spiritualwisdominindia.com
111222333.net
traditionalarabicdishes.com
hmlifi.com
receive-our-info-heredaily.info
whitecoins.info
woodiesrattlers.com
www8458l.com
fifanie.com
xn--qrq721bqkkzt3b.net
mesquiteleaffarm.com
xn--30-yo3c105l5jn.com
imaginaryfair.com
dawnanddusted.com
youeronline.com
alyssabrandonportfolio.com
winhealthalert.info
fithappenseveryday.com
3dreplicant.net
exiaomaipu.com
billsmockupdomain.com
radicalmiddleusa.com
fatblastingsupplements.com
okvidaoapp.com
1024eees.info
gdbaisu.com
soluciones-libres.com
guansaidingzhi.com
francesca-lynagh.com
airbodycare.com
atlutes.com
learningtolaughintherain.com
zology-tek.com
bjlmzk.com
watchinglass.com
belltowerhealthcare.com
gaetvr.men
xn--j7q21wggj81l.net
photos4lyfe.net
paisaghat.com
repairextend.win
lifesciencescareers.com
bazar-199.com
timepieceluxury.com
wizeater.com
itdui.com
johnshookgp.com
lesderniers.com
goodsystemforupdates.review
cybep.com

Signatures

Formbook family
formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
sample	formbook

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
352-21-0x0000000000400000-0x000000000042A000-memory.dmp

File Explorer

352-21-0x0000000000400000-0x000000000042A000-memory.dmp

.exe 168KB

352-21-0x0000000000400000-0x000000000042A000-memory.dmp

SHA256 416d47cae8553f65b0a304ad2414f6d6dec0b9dd273ca56c84967b624c7b57e8
MD5 ea1f87d884f7e1725703253f44421685
SHA1 149fc6aab754a3b0b9aaabc622b551f6535367e0
SHA512 4f23fc415f33e6f1124494fe464f4031d3c749c1b84c1ed01c0b6c513e1068e22c3de93673067524623f90abf122afa0fab8bde789f49f25af4728d989c7d7b0
SSDEEP 3072:uira2cYeBwABNWkLVU8CmXVgG+g4aLkOpK//u1eURptjvrZKrxUuB/tZyJ:utAeBthU8BXVgzg4aLU+7V6xbB/tZyJ
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Formbook payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

112256

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths