formbook | 97a96aa2cacdb919c81ae3573ded887431a924c2e4ee6137f704cfec0aae9fbb

Analysis

max time kernel
91s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/11/2022, 22:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Variant.MSILHeracles.44990.19490.13381.exe
Size 817KB
Sample221101-2vhwpsffh5
SHA256 97a96aa2cacdb919c81ae3573ded887431a924c2e4ee6137f704cfec0aae9fbb
MD5 ba1eb63506584f84ac0410b03afc9fc4
SHA1 8f7ea2afb2c7370b0be82e8c7af8fa8a6cf7b944
SHA512 fa2b1d8a39d0624ecd775b145171fe4a6426ae10bbac86f340d655c14a05612f44c0a59aa093ad2d07ff883d4376bd54e01562628324534266dbeebb0e074cec
SSDEEP 12288:YratMy71VQ3MmJwhuJSQv9zps7tibPI+4BlHTZNtxFeL/V1mfNEf:3tL7hjuJts7tipKrtxU7a1E
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook ss63 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

ss63

Decoy

heartgroupfurniture.com
petruskraftshop.net
bernesespirit.com
minulgul.com
canoncashier.com
britishsaschool.com
frau-kruppa.net
cj-zn.com
derdggyih5ctsc.kred
xvvbros.pics
unacucinadipasta.com
brandsalted.com
pledialinks.xyz
teslamoto.shop
doxycyclin.monster
nuflowalexandriava.com
eliteinfratech.com
laymember.net
bestprobiotics.online
diversifiedpower.international
autorenda.fun
ciseaux-a-bois.com
elsaltodelfraile.online
dikingte.cyou
gaosan123.com
gxgvdd.com
iz0maopis0o2p3.kred
mcc-xia55pjs.com
vnhanh.net
hey-hee.com
ahxinying.com
blanerussell.com
happytopia.net
pennburyfarm.shop
a5t3.cyou
wbhgxs027f.vip
mzzmj.com
grooming.asia
successful101.com
dagatructiephd.com
thinkphysiotherapy.com
thenewburaimohs.com
leedart.com
folsomappraisers.com
hindibizz.tech
cctrmo.com
blainrussell.com
pop-up-flat.com
xscnc.net
happykidsindonesia.com
nsber.store
mediqhealthcare.com
allinvest-swiss.com
chaokeke.com
littleyeoneo.com
yapek.xyz
9b505.app
dream.parts
vexpertsonline.com
bbpo11.com
candyclub7.world
fadesrus.net
poolsigncase.com
offplan.realestate
khetikissani.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/3148-138-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 988 set thread context of 3148	988	SecuriteInfo.com.Variant.MSILHeracles.44990.19490.13381.exe	89

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3148	SecuriteInfo.com.Variant.MSILHeracles.44990.19490.13381.exe
3148	SecuriteInfo.com.Variant.MSILHeracles.44990.19490.13381.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 988 wrote to memory of 3148	988	SecuriteInfo.com.Variant.MSILHeracles.44990.19490.13381.exe	89
PID 988 wrote to memory of 3148	988	SecuriteInfo.com.Variant.MSILHeracles.44990.19490.13381.exe	89
PID 988 wrote to memory of 3148	988	SecuriteInfo.com.Variant.MSILHeracles.44990.19490.13381.exe	89
PID 988 wrote to memory of 3148	988	SecuriteInfo.com.Variant.MSILHeracles.44990.19490.13381.exe	89
PID 988 wrote to memory of 3148	988	SecuriteInfo.com.Variant.MSILHeracles.44990.19490.13381.exe	89
PID 988 wrote to memory of 3148	988	SecuriteInfo.com.Variant.MSILHeracles.44990.19490.13381.exe	89

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.MSILHeracles.44990.19490.13381.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.MSILHeracles.44990.19490.13381.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:988
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.MSILHeracles.44990.19490.13381.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.MSILHeracles.44990.19490.13381.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3148

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/988-132-0x00000000008A0000-0x0000000000972000-memory.dmp

Download

memory/988-133-0x00000000059C0000-0x0000000005F64000-memory.dmp

Download

memory/988-134-0x0000000005310000-0x00000000053A2000-memory.dmp

Download

memory/988-135-0x00000000053D0000-0x00000000053DA000-memory.dmp

Download

memory/988-136-0x0000000007F50000-0x0000000007FEC000-memory.dmp

Download

memory/3148-138-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3148-139-0x00000000013A0000-0x00000000016EA000-memory.dmp

Download