formbook | 8ba89f4cd9f76d5ec870673db35849d80c7bb2a46614bb4e7a8fd2e951846c11

Analysis

max time kernel
90s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
24/10/2022, 15:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Trojan.PackedNET.738.1739.2441.exe
Size 824KB
Sample221024-st6rpshdg9
SHA256 8ba89f4cd9f76d5ec870673db35849d80c7bb2a46614bb4e7a8fd2e951846c11
MD5 8d38957a709debc4257631de2e4fd55b
SHA1 9689258ff59163d807b9c11806f73270c20591f4
SHA512 9d9549af07cff5a88fed316ded74f0fbc61c20fbdccf539deea0ed6b9fe7e0797b53879d659568c0651f8d277bd6cd8fab413a9408814a0fd2eba3dd7dd0a461
SSDEEP 12288:7/fFx8kd3dgb/Kp+g5WQIwbs48FNy5sx6zj:7/tfdgwILTFE506f
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook gpaz rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

gpaz

Decoy

5j3uoV7+6eJ9XICnu+mP6OUkhXc=
oYDcQQrsUCY+Kygqdacr
a0plKcxTec+WBAYZP6Yo
0TSBRR86rkA6q7Tq/VQLfg==
ML+HexMkoB2+jcA/ed9gtMEMJMaZMHs=
ZkstGAieglG4tzT0JIdN0eUkhXc=
GiL8CLTFJv8EwFbgJEPI6Oahuw==
sJkVuU3uKo4JxRmx30EvuY30JLFHbw==
MAZh/YkqdeBpCQANIxYVpCBj
5b6GgVmCu58kI4gwR4F21ijAsw==
SV7TgR/EorR/NvK/Aw==
4f7MkWJvwybPlGDzCw==
QZPtvpGjAFcSibT5
IqpgIfXZCewdAo3XGXU=
a9agVOjJIiwPDeY=
NiIIJPHyHw+qlOh+5MjVpOUkhXc=
HjQsFaB5xnGiUuKyAw==
7L6gqnxUOxQx00sMO5BKz+UkhXc=
ULYVxFYSNPaPfA==
XFgBvWowRNtdZQ==
lAgup6LpRNtdZQ==
ulvAlF4pRNtdZQ==
mIdzmUoiEm//vwpmku4E1BVMQvVQ
48lE4daSvKLdyqiqOZoh
5kGdLcvcQKcz6gdZtBPMy1h+
TlYV2rLFzMulLM3iA2w=
GnpdaDTyJw9FSu0vWsM2
Jjb8lTDdKQgZlGDzCw==
tgJcLdrGOrpbFCwqdacr
uBbS8JB23DfOlGDzCw==
VF85LMNqYUphEI3XGXU=
FyiaaATjhACbcg==
Gdi6mEQjRNtdZQ==
QRbMgUhi1UHo1Bpset3My1h+
PsqNThzVuLSbpcH/
FhWx5dxPyBmu
a0gCuVXfEv10bQ==
wk8rG4tAHx/ExUDb+F1Q7QPA8ai3MXM=
obmrj0KfwA2q
H66GcRoiggKpT+0vWsM2
4jSNFe2hxnGiUuKyAw==
Oco+GbaL9XgFp4UPNstMaQ==
i2YmS+2ceOMq5tH7
a0Y+VfKOakYCv0XiCQ==
XS6IHdmozm2APfs=
HJoEtY9kqH9G+PYzWrVu0Yz0JLFHbw==
th4cIbfGPcBaDysqdacr
a4RAzYosRNtdZQ==
pHYb1nZTqRfAeZHdLJkJJKOJBe1N
es6YtlT3qSe3
MQ7ErDgtY0qBJH4HUa5k3cgzYMUqZQ==
AIND7n4iRNtdZQ==
kx/z3XceBnzSiozk
uoo54ndHMRhTH9WnxujXNXg=
109zdSf3qSe3
xKBUQ9HE+NDztlwVI1XWQp98tam0LugiTg==
FKMNpzUpc8xZECkqdacr
op6IgiQmYUyJQ8RRsOPRYQ==
4cJ3PAQRhQ3b3l0psOPRYQ==
7C/xn5znRNtdZQ==
4ltGGrKBcSwPDeY=
2sLB27BtUEcCv0XiCQ==
pR5+Lcqce1mIMK5Vq0TX4o/GpA==
p6SNcz9EfOXm5+nt9ejXNXg=
sejeongvalve.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1312 set thread context of 3720	1312	SecuriteInfo.com.Trojan.PackedNET.738.1739.2441.exe	91

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3720	SecuriteInfo.com.Trojan.PackedNET.738.1739.2441.exe
3720	SecuriteInfo.com.Trojan.PackedNET.738.1739.2441.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1312 wrote to memory of 3720	1312	SecuriteInfo.com.Trojan.PackedNET.738.1739.2441.exe	91
PID 1312 wrote to memory of 3720	1312	SecuriteInfo.com.Trojan.PackedNET.738.1739.2441.exe	91
PID 1312 wrote to memory of 3720	1312	SecuriteInfo.com.Trojan.PackedNET.738.1739.2441.exe	91
PID 1312 wrote to memory of 3720	1312	SecuriteInfo.com.Trojan.PackedNET.738.1739.2441.exe	91
PID 1312 wrote to memory of 3720	1312	SecuriteInfo.com.Trojan.PackedNET.738.1739.2441.exe	91
PID 1312 wrote to memory of 3720	1312	SecuriteInfo.com.Trojan.PackedNET.738.1739.2441.exe	91

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.738.1739.2441.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.738.1739.2441.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.738.1739.2441.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.738.1739.2441.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1312-132-0x00000000007C0000-0x0000000000894000-memory.dmp

Download

memory/1312-133-0x00000000056D0000-0x0000000005C74000-memory.dmp

Download

memory/1312-134-0x0000000005120000-0x00000000051B2000-memory.dmp

Download

memory/1312-135-0x0000000005350000-0x000000000535A000-memory.dmp

Download

memory/1312-136-0x0000000008E70000-0x0000000008F0C000-memory.dmp

Download

memory/3720-138-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3720-140-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3720-141-0x0000000000401000-0x000000000042F000-memory.dmp

Download

memory/3720-142-0x0000000001010000-0x000000000135A000-memory.dmp

Download