formbook | 9bbfeec581efea4224c9b936410dda83bcc3fb10e2064d1719a69311b7ca8800

Analysis

max time kernel
97s
max time network
207s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26-09-2024 03:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEW PROJECT OFFER - 216.exe
Size

1.6MB
MD5

360d18d8a47c264c2e03cc8e06bbab7a
SHA1

59183b9e4b41c8f90ce2f0dee4ee3e6e4e1bc2fe
SHA256

94610e74b5926d5c7b4429915a41cef2434b364be578958b8a597a74dd5c7d7d
SHA512

ae20f9bc3b19a88fd960a44151ead5a1f7e7eb3b6d1ae8382aa9eed584a6f090295fec7a75c4a76d4b4ad072e47b223acc036bdce249a4c75e9af2d734d4e8ec
SSDEEP

49152:4AodtaG9kS2U84B+FLan9k5TRM9zloVjJOk6m:o/B1Ud

Score

10^/10

formbook md02 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

md02

Decoy

onsen1508.com

partymaxclubmen36.click

texasshelvingwarehouse.com

tiantiying.com

taxcredits-pr.com

33mgbet.com

equipoleiremnacional.com

andrewghita.com

zbbnp.xyz

englandbreaking.com

a1b5v.xyz

vizamag.com

h0lg3.rest

ux-design-courses-17184.bond

of84.top

qqkartel88v1.com

avalynkate.com

cpuk-finance.com

yeslabs.xyz

webuyandsellpa.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/3676-0-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1644 set thread context of 3676	1644	NEW PROJECT OFFER - 216.exe	83

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4124	3676	WerFault.exe	83

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1644	NEW PROJECT OFFER - 216.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 3676	1644	NEW PROJECT OFFER - 216.exe	83
PID 1644 wrote to memory of 3676	1644	NEW PROJECT OFFER - 216.exe	83
PID 1644 wrote to memory of 3676	1644	NEW PROJECT OFFER - 216.exe	83
PID 1644 wrote to memory of 3676	1644	NEW PROJECT OFFER - 216.exe	83
PID 1644 wrote to memory of 3676	1644	NEW PROJECT OFFER - 216.exe	83
PID 1644 wrote to memory of 3676	1644	NEW PROJECT OFFER - 216.exe	83

C:\Users\Admin\AppData\Local\Temp\NEW PROJECT OFFER - 216.exe
"C:\Users\Admin\AppData\Local\Temp\NEW PROJECT OFFER - 216.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
  2⤵
  PID:3676
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 20
    3⤵
    - Program crash
    PID:4124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3676 -ip 3676
1⤵
PID:3196

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3676-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download