formbook | 52dea1b2d1343335780111e30a42ae6477cd2f95dc797a66d99dae14d68687f5

Analysis

max time kernel
146s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
14-06-2024 22:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Dograr Intl. Co. Ref PO_DG-251106001-2240613.pdf.exe
Size

517KB
MD5

22dfcea6b9a1cb6690a49b39be8eb18f
SHA1

7c55b5acc2b63c984b44d56d7ab071da98dd31bc
SHA256

a10740d29e2893feeb045ffc024317447b7bd06ccdb76e33da08ff97f1a9c48e
SHA512

b457da101cf88ea6e847970b20f1ecf6ddd7f9bfe5699010621acebbf9edc97de3a32e338ed9e3e2ce2ca68f9122f31bdbe7eef2f2607cd523fbee013738ac76
SSDEEP

12288:Q7JYXh0JJro3lFqXjumzt2RavD7R5GDYG2ucI:yih0JJrovcIGxGV

Score

10^/10

formbook na10 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

na10

Decoy

tetheus.com

ventlikeyoumeanit.com

tintbliss.com

rinabet357.com

sapphireboutiqueusa.com

abc8bet6.com

xzcn3i7jb13cqei.buzz

pinktravelsnagpur.com

bt365038.com

rtpbossujang303.shop

osthirmaker.com

thelonelyteacup.com

rlc2019.com

couverture-charpente.com

productivagc.com

defendercarcare.com

abcentixdigital.com

petco.ltd

oypivh.top

micro.guru

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2616-12-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/2616-17-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/2616-22-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/3000-28-0x0000000000080000-0x00000000000AF000-memory.dmp	formbook

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2496 cmd.exe

pid	process
2496	cmd.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

Dograr Intl. Co. Ref PO_DG-251106001-2240613.pdf.exeDograr Intl. Co. Ref PO_DG-251106001-2240613.pdf.exewlanext.exe

description	pid	process	target process
PID 1700 set thread context of 2616	1700	Dograr Intl. Co. Ref PO_DG-251106001-2240613.pdf.exe	Dograr Intl. Co. Ref PO_DG-251106001-2240613.pdf.exe
PID 2616 set thread context of 1220	2616	Dograr Intl. Co. Ref PO_DG-251106001-2240613.pdf.exe	Explorer.EXE
PID 2616 set thread context of 1220	2616	Dograr Intl. Co. Ref PO_DG-251106001-2240613.pdf.exe	Explorer.EXE
PID 3000 set thread context of 1220	3000	wlanext.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 25 IoCs

Processes:

Dograr Intl. Co. Ref PO_DG-251106001-2240613.pdf.exeDograr Intl. Co. Ref PO_DG-251106001-2240613.pdf.exewlanext.exe

pid	process
1700	Dograr Intl. Co. Ref PO_DG-251106001-2240613.pdf.exe
1700	Dograr Intl. Co. Ref PO_DG-251106001-2240613.pdf.exe
2616	Dograr Intl. Co. Ref PO_DG-251106001-2240613.pdf.exe
2616	Dograr Intl. Co. Ref PO_DG-251106001-2240613.pdf.exe
2616	Dograr Intl. Co. Ref PO_DG-251106001-2240613.pdf.exe
3000	wlanext.exe
3000	wlanext.exe
3000	wlanext.exe
3000	wlanext.exe
3000	wlanext.exe
3000	wlanext.exe
3000	wlanext.exe
3000	wlanext.exe
3000	wlanext.exe
3000	wlanext.exe
3000	wlanext.exe
3000	wlanext.exe
3000	wlanext.exe
3000	wlanext.exe
3000	wlanext.exe
3000	wlanext.exe
3000	wlanext.exe
3000	wlanext.exe
3000	wlanext.exe
3000	wlanext.exe

Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

Dograr Intl. Co. Ref PO_DG-251106001-2240613.pdf.exewlanext.exe

pid	process
2616	Dograr Intl. Co. Ref PO_DG-251106001-2240613.pdf.exe
2616	Dograr Intl. Co. Ref PO_DG-251106001-2240613.pdf.exe
2616	Dograr Intl. Co. Ref PO_DG-251106001-2240613.pdf.exe
2616	Dograr Intl. Co. Ref PO_DG-251106001-2240613.pdf.exe
3000	wlanext.exe
3000	wlanext.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

Dograr Intl. Co. Ref PO_DG-251106001-2240613.pdf.exeDograr Intl. Co. Ref PO_DG-251106001-2240613.pdf.exewlanext.exe

description	pid	process
Token: SeDebugPrivilege	1700	Dograr Intl. Co. Ref PO_DG-251106001-2240613.pdf.exe
Token: SeDebugPrivilege	2616	Dograr Intl. Co. Ref PO_DG-251106001-2240613.pdf.exe
Token: SeDebugPrivilege	3000	wlanext.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

Dograr Intl. Co. Ref PO_DG-251106001-2240613.pdf.exeExplorer.EXEwlanext.exe

description	pid	process	target process
PID 1700 wrote to memory of 2616	1700	Dograr Intl. Co. Ref PO_DG-251106001-2240613.pdf.exe	Dograr Intl. Co. Ref PO_DG-251106001-2240613.pdf.exe
PID 1700 wrote to memory of 2616	1700	Dograr Intl. Co. Ref PO_DG-251106001-2240613.pdf.exe	Dograr Intl. Co. Ref PO_DG-251106001-2240613.pdf.exe
PID 1700 wrote to memory of 2616	1700	Dograr Intl. Co. Ref PO_DG-251106001-2240613.pdf.exe	Dograr Intl. Co. Ref PO_DG-251106001-2240613.pdf.exe
PID 1700 wrote to memory of 2616	1700	Dograr Intl. Co. Ref PO_DG-251106001-2240613.pdf.exe	Dograr Intl. Co. Ref PO_DG-251106001-2240613.pdf.exe
PID 1700 wrote to memory of 2616	1700	Dograr Intl. Co. Ref PO_DG-251106001-2240613.pdf.exe	Dograr Intl. Co. Ref PO_DG-251106001-2240613.pdf.exe
PID 1700 wrote to memory of 2616	1700	Dograr Intl. Co. Ref PO_DG-251106001-2240613.pdf.exe	Dograr Intl. Co. Ref PO_DG-251106001-2240613.pdf.exe
PID 1700 wrote to memory of 2616	1700	Dograr Intl. Co. Ref PO_DG-251106001-2240613.pdf.exe	Dograr Intl. Co. Ref PO_DG-251106001-2240613.pdf.exe
PID 1220 wrote to memory of 3000	1220	Explorer.EXE	wlanext.exe
PID 1220 wrote to memory of 3000	1220	Explorer.EXE	wlanext.exe
PID 1220 wrote to memory of 3000	1220	Explorer.EXE	wlanext.exe
PID 1220 wrote to memory of 3000	1220	Explorer.EXE	wlanext.exe
PID 3000 wrote to memory of 2496	3000	wlanext.exe	cmd.exe
PID 3000 wrote to memory of 2496	3000	wlanext.exe	cmd.exe
PID 3000 wrote to memory of 2496	3000	wlanext.exe	cmd.exe
PID 3000 wrote to memory of 2496	3000	wlanext.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:1220

C:\Users\Admin\AppData\Local\Temp\Dograr Intl. Co. Ref PO_DG-251106001-2240613.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Dograr Intl. Co. Ref PO_DG-251106001-2240613.pdf.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1700

C:\Users\Admin\AppData\Local\Temp\Dograr Intl. Co. Ref PO_DG-251106001-2240613.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Dograr Intl. Co. Ref PO_DG-251106001-2240613.pdf.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2616

C:\Windows\SysWOW64\wlanext.exe
"C:\Windows\SysWOW64\wlanext.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3000

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\Dograr Intl. Co. Ref PO_DG-251106001-2240613.pdf.exe"
3⤵
- Deletes itself
PID:2496

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1220-19-0x0000000004D30000-0x0000000004E08000-memory.dmp

Filesize
864KB

Download
memory/1220-30-0x0000000005180000-0x00000000052B9000-memory.dmp

Filesize
1.2MB

Download
memory/1220-24-0x0000000005180000-0x00000000052B9000-memory.dmp

Filesize
1.2MB

Download
memory/1220-21-0x0000000004D30000-0x0000000004E08000-memory.dmp

Filesize
864KB

Download
memory/1220-16-0x0000000003D10000-0x0000000003E10000-memory.dmp

Filesize
1024KB

Download
memory/1700-13-0x0000000074B90000-0x000000007527E000-memory.dmp

Filesize
6.9MB

Download
memory/1700-5-0x0000000000690000-0x0000000000696000-memory.dmp

Filesize
24KB

Download
memory/1700-1-0x0000000000BB0000-0x0000000000C38000-memory.dmp

Filesize
544KB

Download
memory/1700-2-0x0000000000520000-0x0000000000564000-memory.dmp

Filesize
272KB

Download
memory/1700-10-0x0000000074B9E000-0x0000000074B9F000-memory.dmp

Filesize
4KB

Download
memory/1700-11-0x0000000074B90000-0x000000007527E000-memory.dmp

Filesize
6.9MB

Download
memory/1700-3-0x0000000074B90000-0x000000007527E000-memory.dmp

Filesize
6.9MB

Download
memory/1700-0-0x0000000074B9E000-0x0000000074B9F000-memory.dmp

Filesize
4KB

Download
memory/1700-4-0x00000000006B0000-0x00000000006CA000-memory.dmp

Filesize
104KB

Download
memory/2616-18-0x0000000000130000-0x0000000000144000-memory.dmp

Filesize
80KB

Download
memory/2616-17-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2616-6-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2616-14-0x0000000000C40000-0x0000000000F43000-memory.dmp

Filesize
3.0MB

Download
memory/2616-12-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2616-8-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2616-23-0x00000000001A0000-0x00000000001B4000-memory.dmp

Filesize
80KB

Download
memory/2616-22-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2616-7-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3000-25-0x0000000000D20000-0x0000000000D36000-memory.dmp

Filesize
88KB

Download
memory/3000-27-0x0000000000D20000-0x0000000000D36000-memory.dmp

Filesize
88KB

Download
memory/3000-28-0x0000000000080000-0x00000000000AF000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads