formbook | 5d35bb95e95e3e166b00362d93f852af93448a4039894bbe25a55e79b29084d8

Analysis

max time kernel
90s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30/09/2022, 05:04

Target
SecuriteInfo.com.Trojan.Mardom.MN.24.20742.7603.exe
Size 495KB
Sample220930-fp9xcaceh2
SHA256 5d35bb95e95e3e166b00362d93f852af93448a4039894bbe25a55e79b29084d8
MD5 7bebccf0fb9a65efa89b80691c87a9a3
SHA1 d8591dc79392a5493f45165096a92ac7c6413d6d
SHA512 15cd4673bdee9af50406054360dbea5c62794446ab3f477a300a06f0d5ab6024143133d22232a5e7d7b8486a8e26359c323088788863b9ff44df4ff248bbb53d
SSDEEP 12288:4iaZjkDbjsKfEZYGnSTHrYtE9NwWgSOF:4qbjMZYBYu9NwWROF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Campaign

Decoy

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 892 set thread context of 3132	892	SecuriteInfo.com.Trojan.Mardom.MN.24.20742.7603.exe	82

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3132	SecuriteInfo.com.Trojan.Mardom.MN.24.20742.7603.exe
3132	SecuriteInfo.com.Trojan.Mardom.MN.24.20742.7603.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	892	SecuriteInfo.com.Trojan.Mardom.MN.24.20742.7603.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 892 wrote to memory of 3132	892	SecuriteInfo.com.Trojan.Mardom.MN.24.20742.7603.exe	82
PID 892 wrote to memory of 3132	892	SecuriteInfo.com.Trojan.Mardom.MN.24.20742.7603.exe	82
PID 892 wrote to memory of 3132	892	SecuriteInfo.com.Trojan.Mardom.MN.24.20742.7603.exe	82
PID 892 wrote to memory of 3132	892	SecuriteInfo.com.Trojan.Mardom.MN.24.20742.7603.exe	82
PID 892 wrote to memory of 3132	892	SecuriteInfo.com.Trojan.Mardom.MN.24.20742.7603.exe	82
PID 892 wrote to memory of 3132	892	SecuriteInfo.com.Trojan.Mardom.MN.24.20742.7603.exe	82

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Mardom.MN.24.20742.7603.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Mardom.MN.24.20742.7603.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:892
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Mardom.MN.24.20742.7603.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Mardom.MN.24.20742.7603.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3132

memory/892-132-0x0000000000540000-0x00000000005C2000-memory.dmp

Download

memory/892-133-0x00000000050B0000-0x0000000005654000-memory.dmp

Download

memory/892-134-0x0000000004B00000-0x0000000004B66000-memory.dmp

Download

memory/3132-136-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/3132-137-0x0000000001190000-0x00000000014DA000-memory.dmp

Download