formbook | cd5cfb5118e9af25a488d5c360c67d934193fcbcd649bf2ff88afe5860da88b3

Analysis

max time kernel
46s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-10-2022 13:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.W32.MSIL_Agent.DZS.gen.Eldorado.30628.26370.exe
Size

823KB
MD5

e98f7db67e567eee870d0bdbc078cf30
SHA1

cdbe9abe7426a5f237e70eba3009bd415f363b9f
SHA256

cd5cfb5118e9af25a488d5c360c67d934193fcbcd649bf2ff88afe5860da88b3
SHA512

eba5f3b8d1c168e3fd762156e40ac658e39bb2e480c4f461811f2d510fddf04a28e3326d19f5dad15be580303cbc383d5babefc2fa2b7feacef7ac5b01b33a84
SSDEEP

24576:NoWfjScOu165U4sgcb1VG+KP0Ce1Rl1U:NoWZOzb0lKP0Ce1Rlu

Score

10^/10

formbook ss63 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ss63

Decoy

heartgroupfurniture.com

petruskraftshop.net

bernesespirit.com

minulgul.com

canoncashier.com

britishsaschool.com

frau-kruppa.net

cj-zn.com

derdggyih5ctsc.kred

xvvbros.pics

unacucinadipasta.com

brandsalted.com

pledialinks.xyz

teslamoto.shop

doxycyclin.monster

nuflowalexandriava.com

eliteinfratech.com

laymember.net

bestprobiotics.online

diversifiedpower.international

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 2 IoCs

rat

resource	yara_rule
behavioral1/memory/1444-63-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1444-64-0x000000000041F120-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1680 set thread context of 1444	1680	SecuriteInfo.com.W32.MSIL_Agent.DZS.gen.Eldorado.30628.26370.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1444	SecuriteInfo.com.W32.MSIL_Agent.DZS.gen.Eldorado.30628.26370.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 1444	1680	SecuriteInfo.com.W32.MSIL_Agent.DZS.gen.Eldorado.30628.26370.exe	28
PID 1680 wrote to memory of 1444	1680	SecuriteInfo.com.W32.MSIL_Agent.DZS.gen.Eldorado.30628.26370.exe	28
PID 1680 wrote to memory of 1444	1680	SecuriteInfo.com.W32.MSIL_Agent.DZS.gen.Eldorado.30628.26370.exe	28
PID 1680 wrote to memory of 1444	1680	SecuriteInfo.com.W32.MSIL_Agent.DZS.gen.Eldorado.30628.26370.exe	28
PID 1680 wrote to memory of 1444	1680	SecuriteInfo.com.W32.MSIL_Agent.DZS.gen.Eldorado.30628.26370.exe	28
PID 1680 wrote to memory of 1444	1680	SecuriteInfo.com.W32.MSIL_Agent.DZS.gen.Eldorado.30628.26370.exe	28
PID 1680 wrote to memory of 1444	1680	SecuriteInfo.com.W32.MSIL_Agent.DZS.gen.Eldorado.30628.26370.exe	28

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Agent.DZS.gen.Eldorado.30628.26370.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Agent.DZS.gen.Eldorado.30628.26370.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Agent.DZS.gen.Eldorado.30628.26370.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Agent.DZS.gen.Eldorado.30628.26370.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1444

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1444-60-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1444-61-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1444-63-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1444-65-0x00000000008D0000-0x0000000000BD3000-memory.dmp

Filesize
3.0MB

Download
memory/1680-54-0x0000000001390000-0x0000000001464000-memory.dmp

Filesize
848KB

Download
memory/1680-55-0x0000000075281000-0x0000000075283000-memory.dmp

Filesize
8KB

Download
memory/1680-56-0x0000000000450000-0x0000000000468000-memory.dmp

Filesize
96KB

Download
memory/1680-57-0x0000000000230000-0x000000000023C000-memory.dmp

Filesize
48KB

Download
memory/1680-58-0x0000000005230000-0x00000000052DC000-memory.dmp

Filesize
688KB

Download
memory/1680-59-0x0000000000E70000-0x0000000000EE4000-memory.dmp

Filesize
464KB

Download