formbook | a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c

Analysis

max time kernel
138s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02-07-2024 01:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe
Size

795KB
MD5

a6d026ed6d34720275d8d6fd98ad5113
SHA1

fb398d1e20b29f5dc346a7b84309a0e5c55ce7d7
SHA256

a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c
SHA512

9c46f3271e02a45b63beac8e74c84fc05a987ffb53fd41fa79c1d60a1c8379d72bc1df256dc7ba9e01363e0767e616e5ee4b32c22c9efbd1ea8496eb8364f324
SSDEEP

12288:9TCE8GILjWLWgAnOKU1AIcP4CVIadpBR8wZLm5cAw0sVj0b1SMp0dR:ccAOKU1AIlihPPlZLmZw2pp4

Score

10^/10

formbook mc10 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

mc10

Decoy

sttcorp.one

jack88.lat

owl-protect.com

hnszrrn.com

at89v2.com

h147.top

takle4creators.com

fondsa.xyz

mantenopolice.com

shophansler.com

dessertt.com

thecollisionmagazine.com

tatesfluffyfrenchies.com

h1f2v.rest

bluewandltd.com

cuplaho2003.shop

2thetcleaningservice.com

yc85w.top

natursache.shop

allmyabilities.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Formbook payload 1 IoCs
rat

Processes:

resource yara_rule

behavioral2/memory/4280-10-0x0000000000400000-0x000000000042F000-memory.dmp formbook

resource	yara_rule
behavioral2/memory/4280-10-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe

description	pid	process	target process
PID 5112 set thread context of 4280	5112	a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe	a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe

pid process

4280 a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe
4280 a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe

pid	process
4280	a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe
4280	a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe

description	pid	process	target process
PID 5112 wrote to memory of 4280	5112	a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe	a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe
PID 5112 wrote to memory of 4280	5112	a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe	a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe
PID 5112 wrote to memory of 4280	5112	a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe	a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe
PID 5112 wrote to memory of 4280	5112	a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe	a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe
PID 5112 wrote to memory of 4280	5112	a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe	a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe
PID 5112 wrote to memory of 4280	5112	a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe	a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe

C:\Users\Admin\AppData\Local\Temp\a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe
"C:\Users\Admin\AppData\Local\Temp\a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5112

C:\Users\Admin\AppData\Local\Temp\a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe
"C:\Users\Admin\AppData\Local\Temp\a4e1544dee96f911479934ecd89b51ead1ee008026a2468f65167e0d76cb459c.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4280

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3688 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:8
1⤵
PID:3884

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4280-10-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4280-13-0x00000000017E0000-0x0000000001B2A000-memory.dmp

Filesize
3.3MB

Download
memory/5112-6-0x0000000005680000-0x0000000005690000-memory.dmp

Filesize
64KB

Download
memory/5112-3-0x0000000005360000-0x00000000053F2000-memory.dmp

Filesize
584KB

Download
memory/5112-4-0x0000000074CB0000-0x0000000075460000-memory.dmp

Filesize
7.7MB

Download
memory/5112-5-0x0000000005330000-0x000000000533A000-memory.dmp

Filesize
40KB

Download
memory/5112-0-0x0000000074CBE000-0x0000000074CBF000-memory.dmp

Filesize
4KB

Download
memory/5112-7-0x00000000057B0000-0x00000000057BC000-memory.dmp

Filesize
48KB

Download
memory/5112-8-0x0000000005EC0000-0x0000000005F36000-memory.dmp

Filesize
472KB

Download
memory/5112-9-0x0000000008460000-0x00000000084FC000-memory.dmp

Filesize
624KB

Download
memory/5112-2-0x0000000005910000-0x0000000005EB4000-memory.dmp

Filesize
5.6MB

Download
memory/5112-12-0x0000000074CB0000-0x0000000075460000-memory.dmp

Filesize
7.7MB

Download
memory/5112-1-0x0000000000860000-0x000000000092C000-memory.dmp

Filesize
816KB

Download