Overview

overview

10

Static

static

SecuriteIn...59.exe

windows7-x64

10

SecuriteIn...59.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    47s
  • max time network
    48s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    27-10-2022 13:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Win32.PWSX-gen.24087.4059.exe

  • Size

    588KB

  • MD5

    e9a36af4d6ea3314299ed373894610cf

  • SHA1

    6da7991d3ffb64388e23936b3d99a2f2637fc3ce

  • SHA256

    09cda694bcb240c7b0742de73888b7ab55db4f29ee1c6c471f4b8982dc150f5d

  • SHA512

    d69be3cbf9bb164df60f554ecccaa063267c88b83f2c143522835f3d1e64b4c107a98512f613764a1ed502dcadccb53a562c04b979f83a8317d4fb0f06577c80

  • SSDEEP

    12288:YllG66h7Josrm8PKW8czF6iXVRh7JgNmac5U0wu5lC/V1ok96:FHtbjFX7u/POIVOk9

Score
10/10
formbookng04ratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ng04

Decoy

tevimaq.com

easterspecialtystore.com

smartlever.tech

10312.uk

tanjawiharbi.co.uk

471338.com

horusventure.com

empress-care.com

sinrian.com

465951.com

aemsti.com

nxcourier.com

stargatefarms.com

lalyquainvestment.com

dailysportsadvice.com

justlistmoore.com

stoneonroll.online

tatianakolomiets.com

barcodebbm.com

protectorship.world

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook
  • Formbook payload 2 IoCs
    rat
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.24087.4059.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.24087.4059.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2020
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.24087.4059.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.24087.4059.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:836

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/836-60-0x0000000000400000-0x000000000042F000-memory.dmp
    Filesize

    188KB

    Download
  • memory/836-64-0x000000000041F020-mapping.dmp
    Download
  • memory/836-63-0x0000000000400000-0x000000000042F000-memory.dmp
    Filesize

    188KB

    Download
  • memory/836-61-0x0000000000400000-0x000000000042F000-memory.dmp
    Filesize

    188KB

    Download
  • memory/836-65-0x0000000000A40000-0x0000000000D43000-memory.dmp
    Filesize

    3.0MB

    Download
  • memory/2020-54-0x0000000001330000-0x00000000013C8000-memory.dmp
    Filesize

    608KB

    Download
  • memory/2020-55-0x00000000756B1000-0x00000000756B3000-memory.dmp
    Filesize

    8KB

    Download
  • memory/2020-56-0x00000000005F0000-0x0000000000608000-memory.dmp
    Filesize

    96KB

    Download
  • memory/2020-57-0x00000000005A0000-0x00000000005AC000-memory.dmp
    Filesize

    48KB

    Download
  • memory/2020-58-0x0000000000D30000-0x0000000000DA0000-memory.dmp
    Filesize

    448KB

    Download
  • memory/2020-59-0x0000000000B30000-0x0000000000B66000-memory.dmp
    Filesize

    216KB

    Download