formbook | a10740d29e2893feeb045ffc024317447b7bd06ccdb76e33da08ff97f1a9c48e

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16-06-2024 00:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a10740d29e2893feeb045ffc024317447b7bd06ccdb76e33da08ff97f1a9c48e.exe
Size

517KB
MD5

22dfcea6b9a1cb6690a49b39be8eb18f
SHA1

7c55b5acc2b63c984b44d56d7ab071da98dd31bc
SHA256

a10740d29e2893feeb045ffc024317447b7bd06ccdb76e33da08ff97f1a9c48e
SHA512

b457da101cf88ea6e847970b20f1ecf6ddd7f9bfe5699010621acebbf9edc97de3a32e338ed9e3e2ce2ca68f9122f31bdbe7eef2f2607cd523fbee013738ac76
SSDEEP

12288:Q7JYXh0JJro3lFqXjumzt2RavD7R5GDYG2ucI:yih0JJrovcIGxGV

Score

10^/10

formbook na10 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

na10

Decoy

tetheus.com

ventlikeyoumeanit.com

tintbliss.com

rinabet357.com

sapphireboutiqueusa.com

abc8bet6.com

xzcn3i7jb13cqei.buzz

pinktravelsnagpur.com

bt365038.com

rtpbossujang303.shop

osthirmaker.com

thelonelyteacup.com

rlc2019.com

couverture-charpente.com

productivagc.com

defendercarcare.com

abcentixdigital.com

petco.ltd

oypivh.top

micro.guru

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Formbook payload 1 IoCs
rat

Processes:

resource yara_rule

behavioral2/memory/1032-13-0x0000000000400000-0x000000000042F000-memory.dmp formbook

resource	yara_rule
behavioral2/memory/1032-13-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

a10740d29e2893feeb045ffc024317447b7bd06ccdb76e33da08ff97f1a9c48e.exe

description	pid	process	target process
PID 4560 set thread context of 1032	4560	a10740d29e2893feeb045ffc024317447b7bd06ccdb76e33da08ff97f1a9c48e.exe	a10740d29e2893feeb045ffc024317447b7bd06ccdb76e33da08ff97f1a9c48e.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

a10740d29e2893feeb045ffc024317447b7bd06ccdb76e33da08ff97f1a9c48e.exea10740d29e2893feeb045ffc024317447b7bd06ccdb76e33da08ff97f1a9c48e.exe

pid	process
4560	a10740d29e2893feeb045ffc024317447b7bd06ccdb76e33da08ff97f1a9c48e.exe
4560	a10740d29e2893feeb045ffc024317447b7bd06ccdb76e33da08ff97f1a9c48e.exe
1032	a10740d29e2893feeb045ffc024317447b7bd06ccdb76e33da08ff97f1a9c48e.exe
1032	a10740d29e2893feeb045ffc024317447b7bd06ccdb76e33da08ff97f1a9c48e.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a10740d29e2893feeb045ffc024317447b7bd06ccdb76e33da08ff97f1a9c48e.exe

description pid process

Token: SeDebugPrivilege 4560 a10740d29e2893feeb045ffc024317447b7bd06ccdb76e33da08ff97f1a9c48e.exe

description	pid	process
Token: SeDebugPrivilege	4560	a10740d29e2893feeb045ffc024317447b7bd06ccdb76e33da08ff97f1a9c48e.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

a10740d29e2893feeb045ffc024317447b7bd06ccdb76e33da08ff97f1a9c48e.exe

description	pid	process	target process
PID 4560 wrote to memory of 1032	4560	a10740d29e2893feeb045ffc024317447b7bd06ccdb76e33da08ff97f1a9c48e.exe	a10740d29e2893feeb045ffc024317447b7bd06ccdb76e33da08ff97f1a9c48e.exe
PID 4560 wrote to memory of 1032	4560	a10740d29e2893feeb045ffc024317447b7bd06ccdb76e33da08ff97f1a9c48e.exe	a10740d29e2893feeb045ffc024317447b7bd06ccdb76e33da08ff97f1a9c48e.exe
PID 4560 wrote to memory of 1032	4560	a10740d29e2893feeb045ffc024317447b7bd06ccdb76e33da08ff97f1a9c48e.exe	a10740d29e2893feeb045ffc024317447b7bd06ccdb76e33da08ff97f1a9c48e.exe
PID 4560 wrote to memory of 1032	4560	a10740d29e2893feeb045ffc024317447b7bd06ccdb76e33da08ff97f1a9c48e.exe	a10740d29e2893feeb045ffc024317447b7bd06ccdb76e33da08ff97f1a9c48e.exe
PID 4560 wrote to memory of 1032	4560	a10740d29e2893feeb045ffc024317447b7bd06ccdb76e33da08ff97f1a9c48e.exe	a10740d29e2893feeb045ffc024317447b7bd06ccdb76e33da08ff97f1a9c48e.exe
PID 4560 wrote to memory of 1032	4560	a10740d29e2893feeb045ffc024317447b7bd06ccdb76e33da08ff97f1a9c48e.exe	a10740d29e2893feeb045ffc024317447b7bd06ccdb76e33da08ff97f1a9c48e.exe

C:\Users\Admin\AppData\Local\Temp\a10740d29e2893feeb045ffc024317447b7bd06ccdb76e33da08ff97f1a9c48e.exe
"C:\Users\Admin\AppData\Local\Temp\a10740d29e2893feeb045ffc024317447b7bd06ccdb76e33da08ff97f1a9c48e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4560

C:\Users\Admin\AppData\Local\Temp\a10740d29e2893feeb045ffc024317447b7bd06ccdb76e33da08ff97f1a9c48e.exe
"C:\Users\Admin\AppData\Local\Temp\a10740d29e2893feeb045ffc024317447b7bd06ccdb76e33da08ff97f1a9c48e.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1032

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1032-13-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1032-16-0x0000000001710000-0x0000000001A5A000-memory.dmp

Filesize
3.3MB

Download
memory/4560-8-0x0000000074E60000-0x0000000075610000-memory.dmp

Filesize
7.7MB

Download
memory/4560-9-0x0000000007340000-0x000000000735A000-memory.dmp

Filesize
104KB

Download
memory/4560-4-0x00000000057A0000-0x0000000005832000-memory.dmp

Filesize
584KB

Download
memory/4560-5-0x0000000005600000-0x0000000005644000-memory.dmp

Filesize
272KB

Download
memory/4560-6-0x0000000074E60000-0x0000000075610000-memory.dmp

Filesize
7.7MB

Download
memory/4560-7-0x00000000056E0000-0x00000000056EA000-memory.dmp

Filesize
40KB

Download
memory/4560-0-0x0000000074E6E000-0x0000000074E6F000-memory.dmp

Filesize
4KB

Download
memory/4560-3-0x0000000005D50000-0x00000000062F4000-memory.dmp

Filesize
5.6MB

Download
memory/4560-10-0x00000000073B0000-0x00000000073B6000-memory.dmp

Filesize
24KB

Download
memory/4560-11-0x0000000074E6E000-0x0000000074E6F000-memory.dmp

Filesize
4KB

Download
memory/4560-12-0x0000000074E60000-0x0000000075610000-memory.dmp

Filesize
7.7MB

Download
memory/4560-2-0x0000000005700000-0x000000000579C000-memory.dmp

Filesize
624KB

Download
memory/4560-15-0x0000000074E60000-0x0000000075610000-memory.dmp

Filesize
7.7MB

Download
memory/4560-1-0x0000000000570000-0x00000000005F8000-memory.dmp

Filesize
544KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads