Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
16-09-2022 11:16
General
-
Target
SecuriteInfo.com.W32.Formbook.AA.tr.17194.exe
-
Size
975KB
-
MD5
5c5f6418364d135500080bcbaecf1be1
-
SHA1
718544eece57175e5d34e8f2c02264ffd08cc98a
-
SHA256
44db6b3b48500386767c3b65e1ccc784a41108486ff999a8d3be6e97b828ab87
-
SHA512
3484ab14148aa6b370dc1f789e6e5b0fcb54ef7bda2f0d73bb701c7acc03fc61afb106b15d57f8332a4359331abf080e0cdf42ee0dfb52e0f72b36203c3bd90f
-
SSDEEP
12288:Mi8HjEB1mpzdFnoIvtUg2jIEsnciI50wv2ykDooyZGbR48yArhf7fvqd2222222P:MvD+mpzdCIvtUjmnzfXooX48yAlv
Malware Config
Extracted
formbook
od65
vWv++sZuMcvF33G4l6XP9EZPtA==
t5BN04mkc6x7eQtgS2Cny1c74wh2JQ==
ZTwBHxvcOi/zDyg=
HwPQCRbYNSbYx9YwkxE7M8jD
zrZ7kYRUKtRvsNwuQoroFy2XBerx1ZfW
x5kgkNmETMWdsMcOWt8=
U0nl/edTCD8CML781w==
eC3RNeH20QR4+QB6
p41iGJpixNsjiSetfNP4Xw==
EgiwGUUP9OJdsjqZh4WLohiTERg=
vKx/M5lOHMDiAarHuukJ
im4Rsi5OGk2Qv9cjI2fC+gReNuXeksU=
dynF4YrQWXXHLMxHG1yVAZNvIO/x1ZfW
5pYrnPK8nt07O4mUm9c=
+tdo4GF+OlqJwtwXcP9Da1H1sBA=
zaoxtveyMFwVVFy/GaHFTfl3EbqsGInQ
Dth/Hns1tuE1cJwjk1SkP0w74wh2JQ==
9LJY/i/hzC/zDyg=
/eZh3RKaXKLXGG1kvkZs5m4=
o31J4w2cWOhJP4mUm9c=
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 64 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 58 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 7 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.Formbook.AA.tr.17194.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.Formbook.AA.tr.17194.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\iexpress.exeiexpress3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
-
Filesize
188KB
-
Filesize
184KB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
188KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.0MB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
100KB
-
Filesize
3.3MB
-
Filesize
572KB
-
Filesize
180KB
-
Filesize
180KB
-