formbook | ed575e87b8ddb54cdd3f247dc89ac394081bbd503cbd6b29d1a4592d60aa07a6

Analysis

max time kernel
95s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
08/11/2022, 09:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.W32.MSIL_Kryptik.IIT.gen.Eldorado.2530.1880.exe
Size 952KB
Sample221108-lml1dsbhdn
SHA256 ed575e87b8ddb54cdd3f247dc89ac394081bbd503cbd6b29d1a4592d60aa07a6
MD5 13714bde6fe1086cbda50bd4d994892d
SHA1 19c3fc1a7d7bfc1dab877800c34a9a1a71369e89
SHA512 28f193d2ba0ee88e068db3fdfc22c704fd208703095f0a8900ee70eaa00c2089f48f696dc013c8b1bb689ada3a893237a6067c44a6f446e1556e5e6248038f6b
SSDEEP 12288:JWuHgjTWJh6WJwYlLIIuc+7a2xkpirPXLUAgooW5Z6rYHFyxlTj99dcJFEXodUrS:JWuHgjTAkWJwYBlVueQwrYHo71TcSOx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook qmpa rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

qmpa

Decoy

IEiN8oqOnNUEkfZd
LWyAr1P5PHPV
tMGP9gYCIc9DKQ==
fWi2stCh2E3DBWuEK612
B3LCCi2JvPxfNA==
NjLnNjX+DDWt/VuEK612
AvK5/JdMDLztPRg=
U+zn2FswDLztPRg=
3bRIXGwsIc9DKQ==
EXmAoj3/7Cyl+VuEK612
1gkKPklP1odxx7c/Zm+L6HeV4g==
1cMaHDg0ypV0vbT2Ibh+/5Cj5xmAVxA=
MSyBdIV+6nFRloTQAwmFklQ=
qilszGJvhMUsHgaUx/MNSKuo6A==
WYKLwmYEij4q2Hy6sOc=
sjII/IyFmORBFPJ2dVjpG0Q=
mTjzaRwZ9OsEkfZd
iL27vFhbX5ECbBIJxvJKbPHFf9M=
5A5Xr0D5PHPV
IpxsaTO4a1/I
O0akl/OtJu4=
W/Uo1VYpCLztPRg=
TxppXmMgUNC7BQOgzfIMSKuo6A==
R9Qsn1NYXIn0L9fTueU=
O5nTCTAIUYiqFQU=
qUA5LcysmdcEkfZd
jzY2a8iJvPxfNA==
G3Sjzt+b4lfVJo/AOp24sw==
pXEEKkfNMVnK
S6Cz2nc10oNrsJ0P+fA6jH48paMTEw==
sIDiCIeUrOAEkfZd
wKQkm/9lVVnI
uiIfKsOIQjwn8J2V5J1r
zHF4c+ypQ7ztPRg=
KwzbHrpTv3laKtfTueU=
k6JZiCC1KtFSIwiZk47UDt64Yss=
2fLFESoxpllKl5KxYXiW9toW+3DhXwE=
7VAnHMvgw84gTPYPyw==
ArIxekAPMmnRInupMqXfEUA=
ASdaAujYAQRRPg==
4h0THru60PsqyyGCBax+
6Ko6ZoljwEKxwljcDEOZuw==
gjO1ys5bRoj94slTOp24sw==
x4IVLlJKz4x/ybAzVoWSTt64Yss=
ilPsNVL6IaVE0bkfc+w=
wCKB0/SQg704jfUv3/wSSKuo6A==
+eR0tEZJMepVMA==
U42K55D5PHPV
goRIp7OCvDSpg20JCAE/rGT6/w==
2SoyM+br3hJySS1aDQoQZXe784VlUAU=
4LE7N1ZjxDsdfXYAGAzoUV0=
Z9D0XXcxIc9DKQ==
50BLU/bJfGFWsqJD76Yrr3H8
bHozX/y2emhZnX/3FxMQSKuo6A==
ETn+luu5Ugm4IkmeMBDfTcUDByHHFQ==
DWeErEUN29PLqCBSde+C6Z21HgbBWAkLRA==
ervK+g4HIc9DKQ==
/eaqAhTqH4X/5bEhHgzoUV0=
JUtMz3n5PHPV
LT8KV/+eGcivBfE8HwzoUV0=
/xyfrdbaaSMUdmW3/qcrr3H8
ZgQYKcKUKOPQtBidD5krr3H8
Qcd6yWA3xM1ftS1xI/t/BPCeS8M=
nmDfwNfXAQRRPg==
erwgcb.top

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1640 set thread context of 4220	1640	SecuriteInfo.com.W32.MSIL_Kryptik.IIT.gen.Eldorado.2530.1880.exe	89

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4220	SecuriteInfo.com.W32.MSIL_Kryptik.IIT.gen.Eldorado.2530.1880.exe
4220	SecuriteInfo.com.W32.MSIL_Kryptik.IIT.gen.Eldorado.2530.1880.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 4220	1640	SecuriteInfo.com.W32.MSIL_Kryptik.IIT.gen.Eldorado.2530.1880.exe	89
PID 1640 wrote to memory of 4220	1640	SecuriteInfo.com.W32.MSIL_Kryptik.IIT.gen.Eldorado.2530.1880.exe	89
PID 1640 wrote to memory of 4220	1640	SecuriteInfo.com.W32.MSIL_Kryptik.IIT.gen.Eldorado.2530.1880.exe	89
PID 1640 wrote to memory of 4220	1640	SecuriteInfo.com.W32.MSIL_Kryptik.IIT.gen.Eldorado.2530.1880.exe	89
PID 1640 wrote to memory of 4220	1640	SecuriteInfo.com.W32.MSIL_Kryptik.IIT.gen.Eldorado.2530.1880.exe	89
PID 1640 wrote to memory of 4220	1640	SecuriteInfo.com.W32.MSIL_Kryptik.IIT.gen.Eldorado.2530.1880.exe	89

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Kryptik.IIT.gen.Eldorado.2530.1880.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Kryptik.IIT.gen.Eldorado.2530.1880.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Kryptik.IIT.gen.Eldorado.2530.1880.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Kryptik.IIT.gen.Eldorado.2530.1880.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1640-132-0x00000000000F0000-0x00000000001DE000-memory.dmp

Download

memory/1640-133-0x0000000005010000-0x00000000055B4000-memory.dmp

Download

memory/1640-134-0x0000000004B60000-0x0000000004BF2000-memory.dmp

Download

memory/1640-135-0x0000000004C10000-0x0000000004C1A000-memory.dmp

Download

memory/1640-136-0x00000000087D0000-0x000000000886C000-memory.dmp

Download

memory/4220-138-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4220-141-0x0000000000401000-0x000000000042E000-memory.dmp

Download

memory/4220-140-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4220-142-0x00000000011D0000-0x000000000151A000-memory.dmp

Download