formbook | fdcd11dcd6a96d4ddfefaef7a186277e84c147fa7e33c0994b2deb384e8d0487

Analysis

max time kernel
105s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
25/03/2025, 20:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

vstdlib_s64.dll
Size

10.0MB
MD5

897e2193493cfd989d82f6a559bf1b2a
SHA1

df837bc19bf863ce466588ca3121fed884922b90
SHA256

92958c2e2d940de78a7f5352b00890f291d568816a8fe1b2bf8c572941644ec0
SHA512

761d12c8ebf7df3bbdc7cddf1220065a4e13780057c99b2e43bd653f1c00154ad9e1c8f2236373d54c985ee710c8847813223d244ad170c678593b3ce8e97996
SSDEEP

98304:nt/DDvVWLvBmmZCPPSVHxySAknm58mQzKSawKlhW1TS28kvGGp:t1WLvBzCSVHxySAknm58mHw6hKVGGp

Score

10^/10

formbook gt23 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

gt23

Decoy

awkeyesunspotsunfire.top

valbardrc.store

idadari29nice.makeup

haymu.shop

hybf2025.sbs

obbiny.xyz

dlecore.xyz

rabbeat.live

irelily.vip

oahnyn.shop

om-massfadq.top

lizalyn.work

irlo.shop

hostsolver.store

ylastpics.info

adfgt.xyz

cis.club

iskol.fun

riceflashradarlab.xyz

enovhojecnhi.shop

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Formbook family
formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral6/memory/672-0-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5872 set thread context of 672	5872	rundll32.exe	88

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5508	672	WerFault.exe	88

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5872	rundll32.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5872 wrote to memory of 3716	5872	rundll32.exe	87
PID 5872 wrote to memory of 3716	5872	rundll32.exe	87
PID 5872 wrote to memory of 3716	5872	rundll32.exe	87
PID 5872 wrote to memory of 672	5872	rundll32.exe	88
PID 5872 wrote to memory of 672	5872	rundll32.exe	88
PID 5872 wrote to memory of 672	5872	rundll32.exe	88
PID 5872 wrote to memory of 672	5872	rundll32.exe	88
PID 5872 wrote to memory of 672	5872	rundll32.exe	88
PID 5872 wrote to memory of 672	5872	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vstdlib_s64.dll,#1
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5872
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
  2⤵
  PID:3716
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
  2⤵
  PID:672
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 672 -s 12
    3⤵
    - Program crash
    PID:5508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 672 -ip 672
1⤵
PID:836

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/672-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download