formbook | 780c4d3a33c89cd911190c17d7ba3ad69e5ddc66396762e4bef8ff67bd45b7b5

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
21-06-2024 01:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

780c4d3a33c89cd911190c17d7ba3ad69e5ddc66396762e4bef8ff67bd45b7b5.exe
Size

903KB
MD5

66bbfd82c0b1bdd60dca1d71945b42c2
SHA1

467d4125a380f1672983c51f1a4706f039b890af
SHA256

780c4d3a33c89cd911190c17d7ba3ad69e5ddc66396762e4bef8ff67bd45b7b5
SHA512

ca85a5e898139ad5e437a66c99baee9c8408773a214d37df02bad4388f8d5ab30cb240985b8869c1e36d971c9615da236e90de20d3a3e091b13caded01fa2bbf
SSDEEP

12288:4SiJkBoxXIFykQzrAVZK3B6xNYUCSPGnsV9nJyJ+XwrwILkz4ZTyrhbjjq5jCkj4:37wWg4NtCSPGGkUNW2rJjq5uM4

Score

10^/10

formbook dy13 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dy13

Decoy

manga-house.com

kjsdhklssk51.xyz

b0ba138.xyz

bt365033.com

ccbsinc.net

mrwine.xyz

nrxkrd527o.xyz

hoshi.social

1912ai.com

serco2020.com

byfchfyr.xyz

imuschestvostorgov.online

austinheafey.com

mrdfa.club

883106.photos

profitablefxmarkets.com

taini00.net

brye.top

ginsm.com

sportglid.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Detects executables packed with SmartAssembly 1 IoCs

Processes:

resource yara_rule

behavioral1/memory/1968-5-0x00000000006C0000-0x00000000006CC000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly
Formbook payload 1 IoCs
rat

Processes:

resource yara_rule

behavioral1/memory/2760-14-0x0000000000400000-0x000000000042F000-memory.dmp formbook

resource	yara_rule
behavioral1/memory/1968-5-0x00000000006C0000-0x00000000006CC000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly

resource	yara_rule
behavioral1/memory/2760-14-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

780c4d3a33c89cd911190c17d7ba3ad69e5ddc66396762e4bef8ff67bd45b7b5.exe

description	pid	process	target process
PID 1968 set thread context of 2760	1968	780c4d3a33c89cd911190c17d7ba3ad69e5ddc66396762e4bef8ff67bd45b7b5.exe	780c4d3a33c89cd911190c17d7ba3ad69e5ddc66396762e4bef8ff67bd45b7b5.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

780c4d3a33c89cd911190c17d7ba3ad69e5ddc66396762e4bef8ff67bd45b7b5.exe

pid process

2760 780c4d3a33c89cd911190c17d7ba3ad69e5ddc66396762e4bef8ff67bd45b7b5.exe

pid	process
2760	780c4d3a33c89cd911190c17d7ba3ad69e5ddc66396762e4bef8ff67bd45b7b5.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

780c4d3a33c89cd911190c17d7ba3ad69e5ddc66396762e4bef8ff67bd45b7b5.exe

description	pid	process	target process
PID 1968 wrote to memory of 2760	1968	780c4d3a33c89cd911190c17d7ba3ad69e5ddc66396762e4bef8ff67bd45b7b5.exe	780c4d3a33c89cd911190c17d7ba3ad69e5ddc66396762e4bef8ff67bd45b7b5.exe
PID 1968 wrote to memory of 2760	1968	780c4d3a33c89cd911190c17d7ba3ad69e5ddc66396762e4bef8ff67bd45b7b5.exe	780c4d3a33c89cd911190c17d7ba3ad69e5ddc66396762e4bef8ff67bd45b7b5.exe
PID 1968 wrote to memory of 2760	1968	780c4d3a33c89cd911190c17d7ba3ad69e5ddc66396762e4bef8ff67bd45b7b5.exe	780c4d3a33c89cd911190c17d7ba3ad69e5ddc66396762e4bef8ff67bd45b7b5.exe
PID 1968 wrote to memory of 2760	1968	780c4d3a33c89cd911190c17d7ba3ad69e5ddc66396762e4bef8ff67bd45b7b5.exe	780c4d3a33c89cd911190c17d7ba3ad69e5ddc66396762e4bef8ff67bd45b7b5.exe
PID 1968 wrote to memory of 2760	1968	780c4d3a33c89cd911190c17d7ba3ad69e5ddc66396762e4bef8ff67bd45b7b5.exe	780c4d3a33c89cd911190c17d7ba3ad69e5ddc66396762e4bef8ff67bd45b7b5.exe
PID 1968 wrote to memory of 2760	1968	780c4d3a33c89cd911190c17d7ba3ad69e5ddc66396762e4bef8ff67bd45b7b5.exe	780c4d3a33c89cd911190c17d7ba3ad69e5ddc66396762e4bef8ff67bd45b7b5.exe
PID 1968 wrote to memory of 2760	1968	780c4d3a33c89cd911190c17d7ba3ad69e5ddc66396762e4bef8ff67bd45b7b5.exe	780c4d3a33c89cd911190c17d7ba3ad69e5ddc66396762e4bef8ff67bd45b7b5.exe

C:\Users\Admin\AppData\Local\Temp\780c4d3a33c89cd911190c17d7ba3ad69e5ddc66396762e4bef8ff67bd45b7b5.exe
"C:\Users\Admin\AppData\Local\Temp\780c4d3a33c89cd911190c17d7ba3ad69e5ddc66396762e4bef8ff67bd45b7b5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1968

C:\Users\Admin\AppData\Local\Temp\780c4d3a33c89cd911190c17d7ba3ad69e5ddc66396762e4bef8ff67bd45b7b5.exe
"C:\Users\Admin\AppData\Local\Temp\780c4d3a33c89cd911190c17d7ba3ad69e5ddc66396762e4bef8ff67bd45b7b5.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2760

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1968-6-0x0000000002260000-0x00000000022E4000-memory.dmp

Filesize
528KB

Download
memory/1968-0-0x0000000074AEE000-0x0000000074AEF000-memory.dmp

Filesize
4KB

Download
memory/1968-2-0x0000000074AE0000-0x00000000751CE000-memory.dmp

Filesize
6.9MB

Download
memory/1968-3-0x00000000003D0000-0x00000000003E2000-memory.dmp

Filesize
72KB

Download
memory/1968-4-0x00000000006B0000-0x00000000006B8000-memory.dmp

Filesize
32KB

Download
memory/1968-5-0x00000000006C0000-0x00000000006CC000-memory.dmp

Filesize
48KB

Download
memory/1968-1-0x0000000000990000-0x0000000000A78000-memory.dmp

Filesize
928KB

Download
memory/1968-7-0x0000000002050000-0x00000000020C6000-memory.dmp

Filesize
472KB

Download
memory/1968-15-0x0000000074AE0000-0x00000000751CE000-memory.dmp

Filesize
6.9MB

Download
memory/2760-10-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2760-8-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2760-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2760-14-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2760-16-0x0000000000A80000-0x0000000000D83000-memory.dmp

Filesize
3.0MB

Download