formbook | 8ac8568934d1a0ab9a9923449bf11c0d44d97abca0bcabd60b94348642f046ac

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09/08/2024, 09:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PAYMENT ERROR.exe
Size

2.1MB
MD5

3d93ad3d9374e100842fc9a5c683d86b
SHA1

6d84040392c2b071dd1546a85ce7c8f527d7e1b3
SHA256

8ac8568934d1a0ab9a9923449bf11c0d44d97abca0bcabd60b94348642f046ac
SHA512

d87baae4c95e41bf82c60c705638d010e3e6e7aa66a95adb9e4280ab2f9acf8b6f633c919f9ef4bc69bac0d700f010c2d72643aacffac4878e7855b3528e40f1
SSDEEP

12288:LB9rRHQ435jKIJE/yGcn5k9BTFE1ksbRz0A7JFVTr/EJ:d9rpQ4BGcATFokMT/n8

Score

10^/10

formbook oi12 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

oi12

Decoy

exobello.bio

boinga.xyz

animasriversurf.com

gamesflashg.com

hayatbagievleri.online

washington-living.com

july7.store

x-pod-technologies.com

farmhouseflaire.com

qb52aa.top

datasynthing.xyz

5v28n.rest

legacycommerceltd.com

mundodelosjuguetes.com

wjblades.com

z9b6g8.com

eskimotech.net

dreziuy.xyz

bestsolarcompanies.services

vertemisconsulting.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/2704-17-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1020 set thread context of 2704	1020	PAYMENT ERROR.exe	34

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 1020 wrote to memory of 2448	1020	PAYMENT ERROR.exe	30
PID 1020 wrote to memory of 2448	1020	PAYMENT ERROR.exe	30
PID 1020 wrote to memory of 2448	1020	PAYMENT ERROR.exe	30
PID 1020 wrote to memory of 2448	1020	PAYMENT ERROR.exe	30
PID 1020 wrote to memory of 2448	1020	PAYMENT ERROR.exe	30
PID 1020 wrote to memory of 2508	1020	PAYMENT ERROR.exe	31
PID 1020 wrote to memory of 2508	1020	PAYMENT ERROR.exe	31
PID 1020 wrote to memory of 2508	1020	PAYMENT ERROR.exe	31
PID 1020 wrote to memory of 2508	1020	PAYMENT ERROR.exe	31
PID 1020 wrote to memory of 2664	1020	PAYMENT ERROR.exe	32
PID 1020 wrote to memory of 2664	1020	PAYMENT ERROR.exe	32
PID 1020 wrote to memory of 2664	1020	PAYMENT ERROR.exe	32
PID 1020 wrote to memory of 2664	1020	PAYMENT ERROR.exe	32
PID 1020 wrote to memory of 2664	1020	PAYMENT ERROR.exe	32
PID 1020 wrote to memory of 2664	1020	PAYMENT ERROR.exe	32
PID 1020 wrote to memory of 2336	1020	PAYMENT ERROR.exe	33
PID 1020 wrote to memory of 2336	1020	PAYMENT ERROR.exe	33
PID 1020 wrote to memory of 2336	1020	PAYMENT ERROR.exe	33
PID 1020 wrote to memory of 2336	1020	PAYMENT ERROR.exe	33
PID 1020 wrote to memory of 2336	1020	PAYMENT ERROR.exe	33
PID 1020 wrote to memory of 2704	1020	PAYMENT ERROR.exe	34
PID 1020 wrote to memory of 2704	1020	PAYMENT ERROR.exe	34
PID 1020 wrote to memory of 2704	1020	PAYMENT ERROR.exe	34
PID 1020 wrote to memory of 2704	1020	PAYMENT ERROR.exe	34
PID 1020 wrote to memory of 2704	1020	PAYMENT ERROR.exe	34
PID 1020 wrote to memory of 2704	1020	PAYMENT ERROR.exe	34
PID 1020 wrote to memory of 2704	1020	PAYMENT ERROR.exe	34
PID 1020 wrote to memory of 2768	1020	PAYMENT ERROR.exe	35
PID 1020 wrote to memory of 2768	1020	PAYMENT ERROR.exe	35
PID 1020 wrote to memory of 2768	1020	PAYMENT ERROR.exe	35
PID 1020 wrote to memory of 2768	1020	PAYMENT ERROR.exe	35

C:\Users\Admin\AppData\Local\Temp\PAYMENT ERROR.exe
"C:\Users\Admin\AppData\Local\Temp\PAYMENT ERROR.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1020
- C:\Windows\System32\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:2448
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
  2⤵
  PID:2508
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
  2⤵
  PID:2664
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:2336
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
  2⤵
  PID:2704
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
  2⤵
  PID:2768

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1020-0-0x000007FEF5713000-0x000007FEF5714000-memory.dmp

Filesize
4KB

Download
memory/1020-1-0x0000000000A20000-0x0000000000A2A000-memory.dmp

Filesize
40KB

Download
memory/1020-2-0x0000000000020000-0x0000000000026000-memory.dmp

Filesize
24KB

Download
memory/1020-3-0x000007FEF5710000-0x000007FEF60FC000-memory.dmp

Filesize
9.9MB

Download
memory/1020-4-0x0000000000250000-0x00000000002D6000-memory.dmp

Filesize
536KB

Download
memory/1020-18-0x000007FEF5710000-0x000007FEF60FC000-memory.dmp

Filesize
9.9MB

Download
memory/2448-7-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2448-5-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2704-17-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download