Overview

overview

10

Static

static

SecuriteIn...63.exe

windows7-x64

10

SecuriteIn...63.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    68s
  • max time network
    44s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    12-10-2022 17:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Trojan.PackedNET.1620.5013.23763.exe

  • Size

    908KB

  • MD5

    e1f42208b49e95ab6efcfc2c793d4c21

  • SHA1

    796675f60d150b4026528c5b703f8beefe8467a1

  • SHA256

    7f8b18cb89b63284a7d5fed4c53f861f8ce52a6c7c776e8d7c4b1b223202c6f8

  • SHA512

    b9275846599b3f81a528044eefd351f850a70327264eed0c539daa0940b4dca6b8da93fe202ae4866b98b39ad26ef7de88c5f5489dc9ab803031e1b2d3e32c34

  • SSDEEP

    12288:Cp//ql7BmqFGUu8t2Wd/wbXhgnZ2Mi5KQleLYQ2BC5wPIEGLajT:qqlrFGLsWbxQgDbR

Score
10/10
formbookng04ratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ng04

Decoy

tevimaq.com

easterspecialtystore.com

smartlever.tech

10312.uk

tanjawiharbi.co.uk

471338.com

horusventure.com

empress-care.com

sinrian.com

465951.com

aemsti.com

nxcourier.com

stargatefarms.com

lalyquainvestment.com

dailysportsadvice.com

justlistmoore.com

stoneonroll.online

tatianakolomiets.com

barcodebbm.com

protectorship.world

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook
  • Formbook payload 2 IoCs
    rat
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1620.5013.23763.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1620.5013.23763.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1348
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1620.5013.23763.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1620.5013.23763.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:828

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/828-60-0x0000000000400000-0x000000000042F000-memory.dmp
    Filesize

    188KB

    Download
  • memory/828-61-0x0000000000400000-0x000000000042F000-memory.dmp
    Filesize

    188KB

    Download
  • memory/828-63-0x0000000000400000-0x000000000042F000-memory.dmp
    Filesize

    188KB

    Download
  • memory/828-64-0x000000000041F020-mapping.dmp
    Download
  • memory/828-65-0x0000000000870000-0x0000000000B73000-memory.dmp
    Filesize

    3.0MB

    Download
  • memory/1348-54-0x00000000010F0000-0x00000000011D8000-memory.dmp
    Filesize

    928KB

    Download
  • memory/1348-55-0x00000000750A1000-0x00000000750A3000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1348-56-0x00000000009C0000-0x00000000009DA000-memory.dmp
    Filesize

    104KB

    Download
  • memory/1348-57-0x00000000002F0000-0x00000000002FC000-memory.dmp
    Filesize

    48KB

    Download
  • memory/1348-58-0x0000000004A00000-0x0000000004A8E000-memory.dmp
    Filesize

    568KB

    Download
  • memory/1348-59-0x00000000009F0000-0x0000000000A24000-memory.dmp
    Filesize

    208KB

    Download