formbook | 7b31ba7b2efc104b3c0152939a129a39bdd9a64bc466937d26083e26ff2a3967

Analysis

max time kernel
133s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
22/09/2022, 14:10

Target
SecuriteInfo.com.Trojan.Mardom.MN.24.23058.18490.exe
Size 425KB
Sample220922-rgpf8afdep
SHA256 7b31ba7b2efc104b3c0152939a129a39bdd9a64bc466937d26083e26ff2a3967
MD5 261c58fa9e5ea52cad21925b3aa9b225
SHA1 1a27d110014f166cfc031a2e9049c9f468de23fb
SHA512 0fd68b15bd0d6373642b0f0c182d915e99f133815ffa2def7a3212628fb558c1124e9ae629343dd23358dc01dac10846fb113ae2731f9bdcc94087ee863e6df5
SSDEEP 6144:bj96Huv0BrLGMgG1M759rduADueKiGvK0/QkAx1uTNt+OiH:n96HEEV71Md9rdXDuedy/QkiuuLH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Campaign

Decoy

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4988 set thread context of 4776	4988	SecuriteInfo.com.Trojan.Mardom.MN.24.23058.18490.exe	83

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4776	SecuriteInfo.com.Trojan.Mardom.MN.24.23058.18490.exe
4776	SecuriteInfo.com.Trojan.Mardom.MN.24.23058.18490.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4988	SecuriteInfo.com.Trojan.Mardom.MN.24.23058.18490.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 4776	4988	SecuriteInfo.com.Trojan.Mardom.MN.24.23058.18490.exe	83
PID 4988 wrote to memory of 4776	4988	SecuriteInfo.com.Trojan.Mardom.MN.24.23058.18490.exe	83
PID 4988 wrote to memory of 4776	4988	SecuriteInfo.com.Trojan.Mardom.MN.24.23058.18490.exe	83
PID 4988 wrote to memory of 4776	4988	SecuriteInfo.com.Trojan.Mardom.MN.24.23058.18490.exe	83
PID 4988 wrote to memory of 4776	4988	SecuriteInfo.com.Trojan.Mardom.MN.24.23058.18490.exe	83
PID 4988 wrote to memory of 4776	4988	SecuriteInfo.com.Trojan.Mardom.MN.24.23058.18490.exe	83

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Mardom.MN.24.23058.18490.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Mardom.MN.24.23058.18490.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Mardom.MN.24.23058.18490.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Mardom.MN.24.23058.18490.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4776

memory/4776-135-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4776-136-0x00000000015D0000-0x000000000191A000-memory.dmp

Download

memory/4988-132-0x0000000000BF0000-0x0000000000C60000-memory.dmp

Download

memory/4988-133-0x0000000005B30000-0x00000000060D4000-memory.dmp

Download