formbook | b6f12247c9a7928280fc2f83e19792f3f3f099a9437d493877e59df36bd46a28

Analysis

max time kernel
91s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/10/2022, 03:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.MSIL.GenKryptik.GAVU.tr.4402.6076.exe
Size 879KB
Sample221007-d1b4cabffp
SHA256 b6f12247c9a7928280fc2f83e19792f3f3f099a9437d493877e59df36bd46a28
MD5 3de62507ad47817c02c4efe9ccbf61e0
SHA1 fd7ebfa868cec0fb4f6083c8b141984be52cf421
SHA512 c43fcf0eee4a526032a5c71800e6345f3e09061d30cc4377a73578fcec8ced7976c51101ac8cbcf7cc5fc618763d03410365910740faadfc4c7b5d52d0e50511
SSDEEP 12288:OBJ2ugTsHabvZlEon/ihpF8v+qqhh8rLoL7L4QH3GB:BwHyZ+TpF8FuVX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook wyhq rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

wyhq

Decoy

+J2MBqYTckIf+ggtwXQy
VW3OLmLkxIM41y9uUg==
eigFKJyIR9FZHnnTir5mKA==
+wtyCE8SNrYKMq4G3TY=
I7i7JZFXdVTYueYsJZGRzr6WRJOhYpQqbw==
t9EecYbu3Nd0YLMgkx+gma8PMg==
vOlSjolRC9FRZfNOSg==
CLF1pC+Z9tBm9QQtwXQy
MyyhGj7EzIxkPYk=
nDkTcNtUaieyjuhAIIaNMIXGfApY25sucg==
WAMMat1j8OidAH7Qir5mKA==
mKEyo3VImmQ+5ihgSw==
Oku9EfGnSV861aYIjieA8oENd0JtcQ==
mRjzRxDUfXt4l/5DQw==
Cbq4KcE3qXX9nK0MXv8mEd2E
ZZUT6ovcMbuZAQ==
PC1+vr+mMbuZAQ==
U2WxDyeJgIA5OYLp8pdeDoE=
+EfNPwlkSxf6Vuz3rwl6NQ==
sksRbxGH2CAfNYg=
8KqV0Eq5HPiRDxtlTbCOEM6Rhjw=
RbuTwyOmGPjUrKy7Q5/9+NqD
DDd4ZajtfTWu
U+SyE5MJdzz4K/xlTQ==
9yKJ0at0GBPSZDKnmYXUOrxDb26SYpQqbw==
P+Dbw3y5EYxiQ5E=
S1jKOibmFLGUq4ju
SujyT8Azo376SvEtUvV6NQ==
eDMARfOzANe2EJij1ctvKg==
1lUWVB/nkX84bpvYir5mKA==
tMkU5klNdTGq
HR+Du6gyUdzDGg==
uxlTvmMxdD+z
IZWR+1qRy1UpVZA=
P93iLm4THv+H5ihgSw==
1NtSvMVGMcSCU4s=
bX/YCPzmIqqY0g3pjG4v
rjsoj0HaWF0of+snuSKVk78SSiE=
C6GY+ntpNdGUc9UMinQv
FJuqFFwFCPPSKLAR9JdeDoE=
aX7ML3spKP51PnXWokxPB4M=
3Xd25hCsazMMX23k
TvndSfRv1qzMWkqlXA==
BpehFog3OkQPOwNivyOMh4eQ6nav
yuVr2rFbkCfqU/hPF8hJBHoBVw7IVFILZw==
jcMhsfCZQdfMWkqlXA==
41NQwFg0iYV5iflMTCO/OJg=
mbEkVzu4ozLhuPY0Qw==
7/FdePGLYioRlFu0Npj+tA47d0JtcQ==
9qW1IjM47IBDStUMinQv
jTU3viLGyIhbMII=
3UqBu/zsCP0=
+oFIrVXKLPfZsKLcPBYPvruL
6+tZ1enVZ/FoTZU=
z/NXhh2qgErtcXDFFdGglYWQ6nav
o6oOcosSDNKxhO5UTQ==
8G9amCUZ7rEwmXvIKA/e162Q6nav
2YF1vUAIKe/OuLjuUkBrE86Rhjw=
BIubDmMgyFgZZHDLzjY=
P7yoGntt4KUpXAp6VQ==
ZnXXUulw3qkjhDYtwXQy
X/DaOfO6Xi535ihgSw==
G8+yErdUjCKHY8EoAZdeDoE=
xFk0kfOeUBamA7cW9OKJiakDKg==
payon.digital

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 560 set thread context of 3984	560	SecuriteInfo.com.MSIL.GenKryptik.GAVU.tr.4402.6076.exe	90

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3984	SecuriteInfo.com.MSIL.GenKryptik.GAVU.tr.4402.6076.exe
3984	SecuriteInfo.com.MSIL.GenKryptik.GAVU.tr.4402.6076.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 560 wrote to memory of 3984	560	SecuriteInfo.com.MSIL.GenKryptik.GAVU.tr.4402.6076.exe	90
PID 560 wrote to memory of 3984	560	SecuriteInfo.com.MSIL.GenKryptik.GAVU.tr.4402.6076.exe	90
PID 560 wrote to memory of 3984	560	SecuriteInfo.com.MSIL.GenKryptik.GAVU.tr.4402.6076.exe	90
PID 560 wrote to memory of 3984	560	SecuriteInfo.com.MSIL.GenKryptik.GAVU.tr.4402.6076.exe	90
PID 560 wrote to memory of 3984	560	SecuriteInfo.com.MSIL.GenKryptik.GAVU.tr.4402.6076.exe	90
PID 560 wrote to memory of 3984	560	SecuriteInfo.com.MSIL.GenKryptik.GAVU.tr.4402.6076.exe	90

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.MSIL.GenKryptik.GAVU.tr.4402.6076.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.MSIL.GenKryptik.GAVU.tr.4402.6076.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:560
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.MSIL.GenKryptik.GAVU.tr.4402.6076.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.MSIL.GenKryptik.GAVU.tr.4402.6076.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/560-132-0x0000000000070000-0x0000000000150000-memory.dmp

Download

memory/560-133-0x0000000005070000-0x0000000005614000-memory.dmp

Download

memory/560-134-0x0000000004B60000-0x0000000004BF2000-memory.dmp

Download

memory/560-135-0x0000000004B10000-0x0000000004B1A000-memory.dmp

Download

memory/560-136-0x0000000009890000-0x000000000992C000-memory.dmp

Download

memory/560-137-0x0000000009930000-0x0000000009996000-memory.dmp

Download

memory/3984-139-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3984-141-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3984-142-0x0000000000401000-0x000000000042F000-memory.dmp

Download

memory/3984-143-0x0000000001010000-0x000000000135A000-memory.dmp

Download