formbook | f6538d9666e7ae65a8a5e8551808ee946b99b9f8fb189e65e7a06eb4be014e28

Analysis

max time kernel
69s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30/09/2022, 05:04

Target
SecuriteInfo.com.Trojan.Mardom.MN.24.5565.5278.exe
Size 494KB
Sample220930-fp9xcaddhj
SHA256 f6538d9666e7ae65a8a5e8551808ee946b99b9f8fb189e65e7a06eb4be014e28
MD5 5f4c9dee81662dfd4ad1bb9b6f5d554f
SHA1 bc4d1fe3fdf97de36dcd249db04033d23badf710
SHA512 7ced89afbf56d21c6bf28b323175da5a4a7029553a59d79b9288ac68721d88d3649e969fef9667e0dece5266dc8d7f42759445af1e6eed761e7b677b197879ee
SSDEEP 6144:aQM911Dqi6r3aIrzQ6QZNY0KVqNADIFjTy/QDreMGv7XGtSVO1j:A1+i6DaBYXqNADIFj2/Q+vv7WSOF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Campaign

Decoy

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2568 set thread context of 4800	2568	SecuriteInfo.com.Trojan.Mardom.MN.24.5565.5278.exe	85

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4800	SecuriteInfo.com.Trojan.Mardom.MN.24.5565.5278.exe
4800	SecuriteInfo.com.Trojan.Mardom.MN.24.5565.5278.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2568	SecuriteInfo.com.Trojan.Mardom.MN.24.5565.5278.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 4800	2568	SecuriteInfo.com.Trojan.Mardom.MN.24.5565.5278.exe	85
PID 2568 wrote to memory of 4800	2568	SecuriteInfo.com.Trojan.Mardom.MN.24.5565.5278.exe	85
PID 2568 wrote to memory of 4800	2568	SecuriteInfo.com.Trojan.Mardom.MN.24.5565.5278.exe	85
PID 2568 wrote to memory of 4800	2568	SecuriteInfo.com.Trojan.Mardom.MN.24.5565.5278.exe	85
PID 2568 wrote to memory of 4800	2568	SecuriteInfo.com.Trojan.Mardom.MN.24.5565.5278.exe	85
PID 2568 wrote to memory of 4800	2568	SecuriteInfo.com.Trojan.Mardom.MN.24.5565.5278.exe	85

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Mardom.MN.24.5565.5278.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Mardom.MN.24.5565.5278.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Mardom.MN.24.5565.5278.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Mardom.MN.24.5565.5278.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4800

memory/2568-132-0x0000000000880000-0x0000000000900000-memory.dmp

Download

memory/2568-133-0x00000000059A0000-0x0000000005F44000-memory.dmp

Download

memory/2568-134-0x0000000005450000-0x00000000054B6000-memory.dmp

Download

memory/4800-136-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4800-137-0x0000000001AF0000-0x0000000001E3A000-memory.dmp

Download