formbook | 8ac8568934d1a0ab9a9923449bf11c0d44d97abca0bcabd60b94348642f046ac

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/08/2024, 14:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3d93ad3d9374e100842fc9a5c683d86b.exe
Size

2.1MB
MD5

3d93ad3d9374e100842fc9a5c683d86b
SHA1

6d84040392c2b071dd1546a85ce7c8f527d7e1b3
SHA256

8ac8568934d1a0ab9a9923449bf11c0d44d97abca0bcabd60b94348642f046ac
SHA512

d87baae4c95e41bf82c60c705638d010e3e6e7aa66a95adb9e4280ab2f9acf8b6f633c919f9ef4bc69bac0d700f010c2d72643aacffac4878e7855b3528e40f1
SSDEEP

12288:LB9rRHQ435jKIJE/yGcn5k9BTFE1ksbRz0A7JFVTr/EJ:d9rpQ4BGcATFokMT/n8

Score

10^/10

formbook oi12 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

oi12

Decoy

exobello.bio

boinga.xyz

animasriversurf.com

gamesflashg.com

hayatbagievleri.online

washington-living.com

july7.store

x-pod-technologies.com

farmhouseflaire.com

qb52aa.top

datasynthing.xyz

5v28n.rest

legacycommerceltd.com

mundodelosjuguetes.com

wjblades.com

z9b6g8.com

eskimotech.net

dreziuy.xyz

bestsolarcompanies.services

vertemisconsulting.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/4820-5-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4968 set thread context of 4820	4968	3d93ad3d9374e100842fc9a5c683d86b.exe	90

Program crash 1 IoCs

pid	pid_target	Process	procid_target
668	4820	WerFault.exe	90

Runs regedit.exe 1 IoCs

pid	Process
4308	regedit.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 2068	4968	3d93ad3d9374e100842fc9a5c683d86b.exe	87
PID 4968 wrote to memory of 2068	4968	3d93ad3d9374e100842fc9a5c683d86b.exe	87
PID 4968 wrote to memory of 2068	4968	3d93ad3d9374e100842fc9a5c683d86b.exe	87
PID 4968 wrote to memory of 2068	4968	3d93ad3d9374e100842fc9a5c683d86b.exe	87
PID 4968 wrote to memory of 4308	4968	3d93ad3d9374e100842fc9a5c683d86b.exe	88
PID 4968 wrote to memory of 4308	4968	3d93ad3d9374e100842fc9a5c683d86b.exe	88
PID 4968 wrote to memory of 4308	4968	3d93ad3d9374e100842fc9a5c683d86b.exe	88
PID 4968 wrote to memory of 4308	4968	3d93ad3d9374e100842fc9a5c683d86b.exe	88
PID 4968 wrote to memory of 3028	4968	3d93ad3d9374e100842fc9a5c683d86b.exe	89
PID 4968 wrote to memory of 3028	4968	3d93ad3d9374e100842fc9a5c683d86b.exe	89
PID 4968 wrote to memory of 3028	4968	3d93ad3d9374e100842fc9a5c683d86b.exe	89
PID 4968 wrote to memory of 3028	4968	3d93ad3d9374e100842fc9a5c683d86b.exe	89
PID 4968 wrote to memory of 4820	4968	3d93ad3d9374e100842fc9a5c683d86b.exe	90
PID 4968 wrote to memory of 4820	4968	3d93ad3d9374e100842fc9a5c683d86b.exe	90
PID 4968 wrote to memory of 4820	4968	3d93ad3d9374e100842fc9a5c683d86b.exe	90
PID 4968 wrote to memory of 4820	4968	3d93ad3d9374e100842fc9a5c683d86b.exe	90
PID 4968 wrote to memory of 4820	4968	3d93ad3d9374e100842fc9a5c683d86b.exe	90
PID 4968 wrote to memory of 4820	4968	3d93ad3d9374e100842fc9a5c683d86b.exe	90
PID 4968 wrote to memory of 2192	4968	3d93ad3d9374e100842fc9a5c683d86b.exe	91
PID 4968 wrote to memory of 2192	4968	3d93ad3d9374e100842fc9a5c683d86b.exe	91
PID 4968 wrote to memory of 2192	4968	3d93ad3d9374e100842fc9a5c683d86b.exe	91

C:\Users\Admin\AppData\Local\Temp\3d93ad3d9374e100842fc9a5c683d86b.exe
"C:\Users\Admin\AppData\Local\Temp\3d93ad3d9374e100842fc9a5c683d86b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:2068
- C:\Windows\regedit.exe
  "C:\Windows\regedit.exe"
  2⤵
  - Runs regedit.exe
  PID:4308
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3028
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
  2⤵
  PID:4820
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 20
    3⤵
    - Program crash
    PID:668
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
  2⤵
  PID:2192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4820 -ip 4820
1⤵
PID:228

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4820-5-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4968-0-0x00007FF8A7753000-0x00007FF8A7755000-memory.dmp

Filesize
8KB

Download
memory/4968-1-0x000001DA74CD0000-0x000001DA74CDA000-memory.dmp

Filesize
40KB

Download
memory/4968-2-0x000001DA75080000-0x000001DA75086000-memory.dmp

Filesize
24KB

Download
memory/4968-3-0x00007FF8A7750000-0x00007FF8A8211000-memory.dmp

Filesize
10.8MB

Download
memory/4968-4-0x000001DA768A0000-0x000001DA76926000-memory.dmp

Filesize
536KB

Download
memory/4968-6-0x00007FF8A7750000-0x00007FF8A8211000-memory.dmp

Filesize
10.8MB

Download