formbook | 50532a2edc28f74e97ee013bfa042e435c742b8d84937344346b980ede458674

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29/12/2024, 06:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

690b0c5b2093f6bb09ab2756070951230809f4c33c2d4e5c9e17cf485bc91cfd.exe
Size

924KB
MD5

eb8618087e373bdbea9867ee7e68a338
SHA1

76a89dfa066e5de6da37be81aa25b316ccb29a48
SHA256

690b0c5b2093f6bb09ab2756070951230809f4c33c2d4e5c9e17cf485bc91cfd
SHA512

778dc244289aaf3c52c3a122ad0cc810dc37ee63f7cb85bbe4ddfa54104e9b960b5cdcdbbf54210838ea24377d062ff4c8b4b8a6d9ecb77487b796aab83e2f72
SSDEEP

12288:GhlwVl5uhW1B2kB6R3HNYAlKRAsm9IhNL8/4pDe3:G0VPv2kQNZ8rm9WL8/h3

Score

10^/10

formbook os56 discovery rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

os56

Decoy

australianhotwaterupgrades.com

vipidplus.online

kneescooterscanada.com

pesanterkini.com

madden24gameplay.com

linkbong88moinhat.net

awongtest41saletest.com

thetravellingcatcompany.com

vazxlip.xyz

bangdemcheeks.com

passengerassistance.website

cloud4global.com

prestopizzarennes.com

midlandchambertravel.com

nashwan-d.com

bellescraftkitchen.com

teamtisdale.com

allascooussaa.us

cryptobet365.xyz

cbij.education

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Formbook family
formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/2816-12-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2092 set thread context of 2816	2092	690b0c5b2093f6bb09ab2756070951230809f4c33c2d4e5c9e17cf485bc91cfd.exe	30

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	690b0c5b2093f6bb09ab2756070951230809f4c33c2d4e5c9e17cf485bc91cfd.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2816	690b0c5b2093f6bb09ab2756070951230809f4c33c2d4e5c9e17cf485bc91cfd.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2816	2092	690b0c5b2093f6bb09ab2756070951230809f4c33c2d4e5c9e17cf485bc91cfd.exe	30
PID 2092 wrote to memory of 2816	2092	690b0c5b2093f6bb09ab2756070951230809f4c33c2d4e5c9e17cf485bc91cfd.exe	30
PID 2092 wrote to memory of 2816	2092	690b0c5b2093f6bb09ab2756070951230809f4c33c2d4e5c9e17cf485bc91cfd.exe	30
PID 2092 wrote to memory of 2816	2092	690b0c5b2093f6bb09ab2756070951230809f4c33c2d4e5c9e17cf485bc91cfd.exe	30
PID 2092 wrote to memory of 2816	2092	690b0c5b2093f6bb09ab2756070951230809f4c33c2d4e5c9e17cf485bc91cfd.exe	30
PID 2092 wrote to memory of 2816	2092	690b0c5b2093f6bb09ab2756070951230809f4c33c2d4e5c9e17cf485bc91cfd.exe	30
PID 2092 wrote to memory of 2816	2092	690b0c5b2093f6bb09ab2756070951230809f4c33c2d4e5c9e17cf485bc91cfd.exe	30

C:\Users\Admin\AppData\Local\Temp\690b0c5b2093f6bb09ab2756070951230809f4c33c2d4e5c9e17cf485bc91cfd.exe
"C:\Users\Admin\AppData\Local\Temp\690b0c5b2093f6bb09ab2756070951230809f4c33c2d4e5c9e17cf485bc91cfd.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Users\Admin\AppData\Local\Temp\690b0c5b2093f6bb09ab2756070951230809f4c33c2d4e5c9e17cf485bc91cfd.exe
  "C:\Users\Admin\AppData\Local\Temp\690b0c5b2093f6bb09ab2756070951230809f4c33c2d4e5c9e17cf485bc91cfd.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2092-6-0x0000000008400000-0x000000000848E000-memory.dmp

Filesize
568KB

Download
memory/2092-13-0x0000000074B00000-0x00000000751EE000-memory.dmp

Filesize
6.9MB

Download
memory/2092-2-0x0000000074B00000-0x00000000751EE000-memory.dmp

Filesize
6.9MB

Download
memory/2092-3-0x00000000003C0000-0x00000000003DA000-memory.dmp

Filesize
104KB

Download
memory/2092-4-0x0000000074B00000-0x00000000751EE000-memory.dmp

Filesize
6.9MB

Download
memory/2092-5-0x0000000000600000-0x000000000060C000-memory.dmp

Filesize
48KB

Download
memory/2092-7-0x00000000022D0000-0x0000000002304000-memory.dmp

Filesize
208KB

Download
memory/2092-0-0x0000000074B0E000-0x0000000074B0F000-memory.dmp

Filesize
4KB

Download
memory/2092-1-0x0000000000CC0000-0x0000000000DAC000-memory.dmp

Filesize
944KB

Download
memory/2816-12-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2816-9-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2816-8-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2816-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2816-14-0x0000000000840000-0x0000000000B43000-memory.dmp

Filesize
3.0MB

Download