Overview

overview

10

Static

static

SecuriteIn...42.exe

windows7-x64

10

SecuriteIn...42.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    93s
  • max time network
    130s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/10/2022, 16:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    SecuriteInfo.com.Win32.PWSX-gen.6500.7242.exe
  • Size 941KB
  • Sample221031-tn221abde2
  • SHA256 0c7d7c9cf153c7c97e3e2789bc903e72ccb6b27251df20e56cf7015d5df372f5
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbooko0cbratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Campaign

  • o0cb

Decoy

  • MnIkB8ic2qUgkrHK0g==

  • BEp5ADX1KNsRkrHK0g==

  • BnX7exkYq8Ml8Q==

  • VHFnxRbZhVfJv6Hkhcs=

  • 4/JqTPnIAL7/O+Rx7UEp

  • 9zlRsvrDhkmaVLxREgKFxxPuCLk=

  • e6JHOvPABuNIoXL81oC7mqJB0LEQ

  • FSYdbTkHJQVcS/J4d9Bn4Fw=

  • b795gqFxQiiidwTjtu8lDA==

  • O2TXxuejTxNv/tS4yw==

  • svCbYh3t1HJpto8mJMM=

  • VZII3ZrRWq3LUiSAR/NBGVgN8YSVcuc=

  • 2BL9Wns3oQE7A9vvz9Bn4Fw=

  • KEt/BnQCPhZ70nmqUQZlcg/96iEtgA==

  • f5IE5Ndz0DJO1m6QZiNUYZeIs2M1gw==

  • udR4Sve8Bet5Bt//tu8lDA==

  • P6J58YLGkaX97ZQ=

  • DxSrqm8745PiV/kO

  • fIAeDIF8MCrTaQP8nGC309ycww==

  • pN37QgCl28MQ47QG

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.6500.7242.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.6500.7242.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:928
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.6500.7242.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.6500.7242.exe"
      2⤵
        PID:3928
      • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.6500.7242.exe
        "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.6500.7242.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:3512

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          memory/928-132-0x0000000000D20000-0x0000000000E12000-memory.dmp
          Download

          memory/928-133-0x0000000005DB0000-0x0000000006354000-memory.dmp
          Download

          memory/928-134-0x0000000005800000-0x0000000005892000-memory.dmp
          Download

          memory/928-135-0x0000000005780000-0x000000000578A000-memory.dmp
          Download

          memory/928-136-0x00000000081F0000-0x000000000828C000-memory.dmp
          Download

          memory/3512-139-0x0000000000400000-0x000000000042F000-memory.dmp
          Download

          memory/3512-141-0x0000000000400000-0x000000000042F000-memory.dmp
          Download

          memory/3512-142-0x0000000000401000-0x000000000042F000-memory.dmp
          Download

          memory/3512-143-0x0000000001700000-0x0000000001A4A000-memory.dmp
          Download