formbook | 7bfd0cbe00b3e14080e2001ec896a53d2f205caa56480a0d760f8460980da76b

Analysis

max time kernel
97s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
17-09-2022 00:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe
Size

995KB
MD5

68044d2b9e7c7ece6ef766f8630056c6
SHA1

543f725d90cff24cdfd9fbb89a42cab55dc5aca3
SHA256

7bfd0cbe00b3e14080e2001ec896a53d2f205caa56480a0d760f8460980da76b
SHA512

58bbd2b0db8ccfa6d71c28cae774295f335e936985b1693d60db42e661a32c543998e73203b6ee3165464615201f823dbf3be5135404aee44601122084788cb9
SSDEEP

12288:szkcqMpQbMbZpe7dootyPl4F0mdnS5i/E6Lql3tnc8JEyi18ufnBF7:szkcFQYbZGdookGzpS5i/Eg8tn

Score

10^/10

formbook ng04 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ng04

Decoy

tevimaq.com

easterspecialtystore.com

smartlever.tech

10312.uk

tanjawiharbi.co.uk

471338.com

horusventure.com

empress-care.com

sinrian.com

465951.com

aemsti.com

nxcourier.com

stargatefarms.com

lalyquainvestment.com

dailysportsadvice.com

justlistmoore.com

stoneonroll.online

tatianakolomiets.com

barcodebbm.com

protectorship.world

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1472-140-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe

description	pid	process	target process
PID 4984 set thread context of 1472	4984	SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe	SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exeSecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe

pid	process
4984	SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe
4984	SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe
1472	SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe
1472	SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe

description pid process

Token: SeDebugPrivilege 4984 SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe

description	pid	process
Token: SeDebugPrivilege	4984	SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe

description	pid	process	target process
PID 4984 wrote to memory of 1780	4984	SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe	SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe
PID 4984 wrote to memory of 1780	4984	SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe	SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe
PID 4984 wrote to memory of 1780	4984	SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe	SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe
PID 4984 wrote to memory of 1472	4984	SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe	SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe
PID 4984 wrote to memory of 1472	4984	SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe	SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe
PID 4984 wrote to memory of 1472	4984	SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe	SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe
PID 4984 wrote to memory of 1472	4984	SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe	SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe
PID 4984 wrote to memory of 1472	4984	SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe	SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe
PID 4984 wrote to memory of 1472	4984	SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe	SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4984

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe"
2⤵
PID:1780

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Ser.MSILHeracles.491.28767.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1472-139-0x0000000000000000-mapping.dmp

Download
memory/1472-140-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1472-141-0x0000000000EA0000-0x00000000011EA000-memory.dmp

Filesize
3.3MB

Download
memory/1780-138-0x0000000000000000-mapping.dmp

Download
memory/4984-132-0x0000000000CE0000-0x0000000000DDE000-memory.dmp

Filesize
1016KB

Download
memory/4984-133-0x0000000005CF0000-0x0000000006294000-memory.dmp

Filesize
5.6MB

Download
memory/4984-134-0x00000000057E0000-0x0000000005872000-memory.dmp

Filesize
584KB

Download
memory/4984-135-0x00000000057C0000-0x00000000057CA000-memory.dmp

Filesize
40KB

Download
memory/4984-136-0x0000000008220000-0x00000000082BC000-memory.dmp

Filesize
624KB

Download
memory/4984-137-0x00000000082C0000-0x0000000008326000-memory.dmp

Filesize
408KB

Download