Overview

overview

10

Static

static

4305e40a0e...0c.exe

windows7_x64

10

4305e40a0e...0c.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    92s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    24-05-2022 18:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4305e40a0eb2ed4133ad2b881d34f7cb4e31da8d3ccbc705968b6c6f79329d0c.exe

  • Size

    280KB

  • MD5

    12fb37f122adb02ce6d17aeb436111f9

  • SHA1

    2e0a8d604227d8c24b1bdebb53d321c40a9fc4a2

  • SHA256

    4305e40a0eb2ed4133ad2b881d34f7cb4e31da8d3ccbc705968b6c6f79329d0c

  • SHA512

    cb8d0ec715609f8fb207c15079c0ecbab7023c9956727bed40678547a1325988994c2c1b2b6535422d86f75829a831ff20c96b1a639006f2059c43edba4902f1

Score
10/10
formbookq5eratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

q5e

Decoy

2177.ltd

thanxiety.com

max-width.com

fixti.net

mostmaj.com

mobilteknolojiuzmani.com

historyannals.com

wheelchairmotion.com

mossandmoonstonestudio.com

kastellifournis.com

axokey.net

peekl.com

metsteeshirt.com

abcfinancial-inc.com

btxrsp.com

amydh.com

ccoauthority.com

lumacorretora.com

kimfelixrealtor.com

iconext.biz

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook
  • Formbook Payload 1 IoCs
    rat
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4305e40a0eb2ed4133ad2b881d34f7cb4e31da8d3ccbc705968b6c6f79329d0c.exe
    "C:\Users\Admin\AppData\Local\Temp\4305e40a0eb2ed4133ad2b881d34f7cb4e31da8d3ccbc705968b6c6f79329d0c.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:4344
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4344 -s 384
      2⤵
      • Program crash
      PID:1972
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4344 -ip 4344
    1⤵
      PID:4204

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4344-130-0x0000000000DAB000-0x0000000000DF2000-memory.dmp

      Filesize

      284KB

      Download

    • memory/4344-131-0x0000000000DBD000-0x0000000000DEA000-memory.dmp

      Filesize

      180KB

      Download

    • memory/4344-132-0x0000000002E70000-0x00000000031BA000-memory.dmp

      Filesize

      3.3MB

      Download