formbook | 9bbfeec581efea4224c9b936410dda83bcc3fb10e2064d1719a69311b7ca8800

Analysis

max time kernel
97s
max time network
207s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26/09/2024, 03:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NEW PROJECT OFFER - 216.exe
Size 1.6MB
Sample240926-ebryyayfjg
SHA256 94610e74b5926d5c7b4429915a41cef2434b364be578958b8a597a74dd5c7d7d
MD5 360d18d8a47c264c2e03cc8e06bbab7a
SHA1 59183b9e4b41c8f90ce2f0dee4ee3e6e4e1bc2fe
SHA512 ae20f9bc3b19a88fd960a44151ead5a1f7e7eb3b6d1ae8382aa9eed584a6f090295fec7a75c4a76d4b4ad072e47b223acc036bdce249a4c75e9af2d734d4e8ec
SSDEEP 49152:4AodtaG9kS2U84B+FLan9k5TRM9zloVjJOk6m:o/B1Ud
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook md02 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

md02

Decoy

onsen1508.com
partymaxclubmen36.click
texasshelvingwarehouse.com
tiantiying.com
taxcredits-pr.com
33mgbet.com
equipoleiremnacional.com
andrewghita.com
zbbnp.xyz
englandbreaking.com
a1b5v.xyz
vizamag.com
h0lg3.rest
ux-design-courses-17184.bond
of84.top
qqkartel88v1.com
avalynkate.com
cpuk-finance.com
yeslabs.xyz
webuyandsellpa.com
barnesassetrecovery.store
hecxion.xyz
theopencomputeproject.net
breezyvw.christmas
mumazyl.com
woby.xyz
jalaios10.vip
lynxpire.com
sparkbpo.com
333689z.com
rslotrank.win
adscendmfmarketing.com
detroitreels.com
xojiliv1.com
mzhhxxff.xyz
hitcomply.com
piedge-taiko.net
chiri.lat
bookmygaddi.com
hjemfinesse.shop
zruypj169g.top
solarfundis.com
pittsparking.com
teplo-invest.com
j3k7n.xyz
coloradoskinwellness.com
z8ggd.com
coinbureau.xyz
mamasprinkleofjoy.com
xotj7a.xyz
nijssenadventures.com
ysa-cn.com
tigajco69.fun
localhomeservicesadvisor.com
attorney-services-8344642.zone
rnwaifu.xyz
nyverian.com
family-lawyers-7009103.world
117myw.com
kingdom66.lat
tdshomesolution.com
momof2filiricans.com
saeutah.com
rakring.com
upcyclecharms.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/3676-0-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1644 set thread context of 3676	1644	NEW PROJECT OFFER - 216.exe	83

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4124	3676	WerFault.exe	83

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1644	NEW PROJECT OFFER - 216.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 3676	1644	NEW PROJECT OFFER - 216.exe	83
PID 1644 wrote to memory of 3676	1644	NEW PROJECT OFFER - 216.exe	83
PID 1644 wrote to memory of 3676	1644	NEW PROJECT OFFER - 216.exe	83
PID 1644 wrote to memory of 3676	1644	NEW PROJECT OFFER - 216.exe	83
PID 1644 wrote to memory of 3676	1644	NEW PROJECT OFFER - 216.exe	83
PID 1644 wrote to memory of 3676	1644	NEW PROJECT OFFER - 216.exe	83

C:\Users\Admin\AppData\Local\Temp\NEW PROJECT OFFER - 216.exe
"C:\Users\Admin\AppData\Local\Temp\NEW PROJECT OFFER - 216.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
  2⤵
  PID:3676
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 20
    3⤵
    - Program crash
    PID:4124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3676 -ip 3676
1⤵
PID:3196

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3676-0-0x0000000000400000-0x000000000042F000-memory.dmp

Download