Overview

overview

10

Static

static

SecuriteIn...27.exe

windows7_x64

10

SecuriteIn...27.exe

windows10_x64

10

Analysis

  • max time kernel
    3s
  • max time network
    11s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    22-07-2021 08:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Variant.Zusy.394472.15672.20727.exe

  • Size

    193KB

  • MD5

    89cfb542cda6a428cc5c02feaf3c55f8

  • SHA1

    9a0606c633ffe5ae4b6dcb7dcfba57b7e22cb05d

  • SHA256

    b663fea76aadbf574e5bb9f704ad689ec10f0d720b0b9641e70b27494fe4cc17

  • SHA512

    22fd691c761ec2ac5be4b3a9b682daf53abb3de05787d07474bc0e41a8c7bf001a10783f3eea6d7d70528dae1da13506e4370b16f3c02b7d92db9e6ffb2ac79b

Score
10/10
formbookratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

C2

http://www.yjhlgg.com/grve/

Decoy

jrvinganimalexterminator.com

smallsyalls.com

po1c3.com

mencg.com

aussieenjoyment.today

espace22.com

aanmelding-desk.info

gallopshoes.com

nftsexy.com

ricosdulcesmexicanos.com

riseswift.com

thechicthirty.com

matdcg.com

alternet.today

creativehuesdesigns.com

rjkcrafts.com

lowdosemortgage.com

adoptahamster.com

wellness-sense.com

jacardcapital.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook
  • Formbook Payload 1 IoCs
    rat
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Zusy.394472.15672.20727.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Zusy.394472.15672.20727.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:308
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Zusy.394472.15672.20727.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Zusy.394472.15672.20727.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/308-60-0x0000000075A31000-0x0000000075A33000-memory.dmp
    Filesize

    8KB

    Download
  • memory/308-62-0x0000000000280000-0x0000000000282000-memory.dmp
    Filesize

    8KB

    Download
  • memory/2004-61-0x000000000041EAF0-mapping.dmp
    Download
  • memory/2004-63-0x0000000000400000-0x000000000042E000-memory.dmp
    Filesize

    184KB

    Download
  • memory/2004-64-0x0000000000990000-0x0000000000C93000-memory.dmp
    Filesize

    3.0MB

    Download