formbook | bc50bd102cef75bd5e2e54618302f10459cd18f90fbbba15ffb4d7503e7e895a

Analysis

max time kernel
103s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/09/2022, 03:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.W32.AIDetectNet.01.923.21773.exe
Size 964KB
Sample220901-d2gp8affar
SHA256 bc50bd102cef75bd5e2e54618302f10459cd18f90fbbba15ffb4d7503e7e895a
MD5 c693031c71200463aa6c11a291dba3db
SHA1 563eba3e248239dc707a487d9d7ed728b3b56938
SHA512 bec2fae926786007915cf00c10fe535287d26b63d9a90b2dc4cccc5b16c4d10ab6ee2283e4ae00cca88e1930268f622f484881ede8f3dbeea7b5c299a680fbf8
SSDEEP 12288:TF75eWgPwqoXY+mzoRtbvRT70qp6NOq4yyejOD5Du5OQ/CTMuWQxhvhR:TZ5BXY+mzo3bvelz4F9I9o7TR
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook ko29 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

ko29

Decoy

citusdig.site
ecomrise.store
aringtonortho.com
plan-indonesia.com
retreat-to-the-alps.com
themerchperch.biz
freshfashiondesign.com
zachmizrachi.com
machomancoin.site
racunhariini.com
13378888.com
landofnd.com
techactive.digital
yourdebttips.com
www147171.com
xraino.top
willshouseofhorrors.com
redfiree.com
cyanband.com
srbs35.com
principaldirects.site
lamarnationa.com
guidedshop.co.uk
masajedomiciliomarbella.com
polska-sterydy.com
jakepaulcrypto.com
kumarrahulclub.xyz
ps01.xyz
americanboard-us.com
shopkashandlaine.com
seedzfoundation.com
se-updates.nz
savanoparksjdm.com
truckmodeler.com
harriwhistle.store
hostmani.com
redepaz.com
yourfinewine.com
naveendj.com
theo-creative.com
radio-podcast.info
juniatainsurance.net
esquiviaseguros.co
amazonmx.top
thefishinclub.com
plugintowealth.com
blackdatasociety.com
kimsretro.com
hornemakers.com
nobullauonlineshop.com
smartcorpmail.com
vibotrade.com
foomusic.com
limitedessense.net
testingcommerce.com
lalvaniandco.com
ba2bd.com
dmsander.site
booksea.net
strong-seo.co.uk
clearlookbymarteli.com
dainclog.xyz
bentleysrenovationsllc.net
sexporno-girls.com
535cambridge.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/3976-139-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4172 set thread context of 3976	4172	SecuriteInfo.com.W32.AIDetectNet.01.923.21773.exe	99

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3976	SecuriteInfo.com.W32.AIDetectNet.01.923.21773.exe
3976	SecuriteInfo.com.W32.AIDetectNet.01.923.21773.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4172 wrote to memory of 3976	4172	SecuriteInfo.com.W32.AIDetectNet.01.923.21773.exe	99
PID 4172 wrote to memory of 3976	4172	SecuriteInfo.com.W32.AIDetectNet.01.923.21773.exe	99
PID 4172 wrote to memory of 3976	4172	SecuriteInfo.com.W32.AIDetectNet.01.923.21773.exe	99
PID 4172 wrote to memory of 3976	4172	SecuriteInfo.com.W32.AIDetectNet.01.923.21773.exe	99
PID 4172 wrote to memory of 3976	4172	SecuriteInfo.com.W32.AIDetectNet.01.923.21773.exe	99
PID 4172 wrote to memory of 3976	4172	SecuriteInfo.com.W32.AIDetectNet.01.923.21773.exe	99

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.923.21773.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.923.21773.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4172
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.923.21773.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.923.21773.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3976-139-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3976-140-0x0000000001A30000-0x0000000001D7A000-memory.dmp

Download

memory/4172-132-0x0000000000DB0000-0x0000000000EA8000-memory.dmp

Download

memory/4172-133-0x0000000005C50000-0x00000000061F4000-memory.dmp

Download

memory/4172-134-0x0000000005740000-0x00000000057D2000-memory.dmp

Download

memory/4172-135-0x0000000005710000-0x000000000571A000-memory.dmp

Download

memory/4172-136-0x0000000009030000-0x00000000090CC000-memory.dmp

Download

memory/4172-137-0x00000000090D0000-0x0000000009136000-memory.dmp

Download