formbook | 5d35bb95e95e3e166b00362d93f852af93448a4039894bbe25a55e79b29084d8

Analysis

max time kernel
41s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/09/2022, 05:04

Target
SecuriteInfo.com.Trojan.Mardom.MN.24.20742.7603.exe
Size 495KB
Sample220930-fp9xcaceh2
SHA256 5d35bb95e95e3e166b00362d93f852af93448a4039894bbe25a55e79b29084d8
MD5 7bebccf0fb9a65efa89b80691c87a9a3
SHA1 d8591dc79392a5493f45165096a92ac7c6413d6d
SHA512 15cd4673bdee9af50406054360dbea5c62794446ab3f477a300a06f0d5ab6024143133d22232a5e7d7b8486a8e26359c323088788863b9ff44df4ff248bbb53d
SSDEEP 12288:4iaZjkDbjsKfEZYGnSTHrYtE9NwWgSOF:4qbjMZYBYu9NwWROF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Campaign

Decoy

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1248 set thread context of 1132	1248	SecuriteInfo.com.Trojan.Mardom.MN.24.20742.7603.exe	26

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1132	SecuriteInfo.com.Trojan.Mardom.MN.24.20742.7603.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1248	SecuriteInfo.com.Trojan.Mardom.MN.24.20742.7603.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1248 wrote to memory of 1132	1248	SecuriteInfo.com.Trojan.Mardom.MN.24.20742.7603.exe	26
PID 1248 wrote to memory of 1132	1248	SecuriteInfo.com.Trojan.Mardom.MN.24.20742.7603.exe	26
PID 1248 wrote to memory of 1132	1248	SecuriteInfo.com.Trojan.Mardom.MN.24.20742.7603.exe	26
PID 1248 wrote to memory of 1132	1248	SecuriteInfo.com.Trojan.Mardom.MN.24.20742.7603.exe	26
PID 1248 wrote to memory of 1132	1248	SecuriteInfo.com.Trojan.Mardom.MN.24.20742.7603.exe	26
PID 1248 wrote to memory of 1132	1248	SecuriteInfo.com.Trojan.Mardom.MN.24.20742.7603.exe	26
PID 1248 wrote to memory of 1132	1248	SecuriteInfo.com.Trojan.Mardom.MN.24.20742.7603.exe	26

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Mardom.MN.24.20742.7603.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Mardom.MN.24.20742.7603.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Mardom.MN.24.20742.7603.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Mardom.MN.24.20742.7603.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1132

memory/1132-56-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1132-57-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1132-59-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1132-61-0x0000000000950000-0x0000000000C53000-memory.dmp

Download

memory/1248-54-0x0000000000F20000-0x0000000000FA2000-memory.dmp

Download

memory/1248-55-0x0000000075351000-0x0000000075353000-memory.dmp

Download