formbook | d0ffbae7e9bd73cace59052f816477125a065396d4c1fab29cb1a024df2486e2

Analysis

max time kernel
50s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
08/11/2022, 12:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Win32.PWSX-gen.15649.15740.exe
Size 1024KB
Sample221108-pxb5qaabhp
SHA256 d0ffbae7e9bd73cace59052f816477125a065396d4c1fab29cb1a024df2486e2
MD5 0234d87eb937d4db64ad209181183ea1
SHA1 c2e526d305a79ee39c45a07ed870979ff675c4a4
SHA512 c8e55606517d19d387116813f877a54620bf01625658fe13c606a1ed53f9bc7decdc6725b4289321fcb35a058dc406a7dc1877d4c127fc8fe0af5e081ab84273
SSDEEP 24576:vUchp8ZGCk+a1MX75jRCftkChtzUuMWF3jQDZ:Bb8M8auX75jUCItTN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook ss63 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

ss63

Decoy

heartgroupfurniture.com
petruskraftshop.net
bernesespirit.com
minulgul.com
canoncashier.com
britishsaschool.com
frau-kruppa.net
cj-zn.com
derdggyih5ctsc.kred
xvvbros.pics
unacucinadipasta.com
brandsalted.com
pledialinks.xyz
teslamoto.shop
doxycyclin.monster
nuflowalexandriava.com
eliteinfratech.com
laymember.net
bestprobiotics.online
diversifiedpower.international
autorenda.fun
ciseaux-a-bois.com
elsaltodelfraile.online
dikingte.cyou
gaosan123.com
gxgvdd.com
iz0maopis0o2p3.kred
mcc-xia55pjs.com
vnhanh.net
hey-hee.com
ahxinying.com
blanerussell.com
happytopia.net
pennburyfarm.shop
a5t3.cyou
wbhgxs027f.vip
mzzmj.com
grooming.asia
successful101.com
dagatructiephd.com
thinkphysiotherapy.com
thenewburaimohs.com
leedart.com
folsomappraisers.com
hindibizz.tech
cctrmo.com
blainrussell.com
pop-up-flat.com
xscnc.net
happykidsindonesia.com
nsber.store
mediqhealthcare.com
allinvest-swiss.com
chaokeke.com
littleyeoneo.com
yapek.xyz
9b505.app
dream.parts
vexpertsonline.com
bbpo11.com
candyclub7.world
fadesrus.net
poolsigncase.com
offplan.realestate
khetikissani.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 2 IoCs

rat

resource	yara_rule
behavioral1/memory/2020-64-0x000000000041F120-mapping.dmp	formbook
behavioral1/memory/2020-63-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1624 set thread context of 2020	1624	SecuriteInfo.com.Win32.PWSX-gen.15649.15740.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2020	SecuriteInfo.com.Win32.PWSX-gen.15649.15740.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 2020	1624	SecuriteInfo.com.Win32.PWSX-gen.15649.15740.exe	28
PID 1624 wrote to memory of 2020	1624	SecuriteInfo.com.Win32.PWSX-gen.15649.15740.exe	28
PID 1624 wrote to memory of 2020	1624	SecuriteInfo.com.Win32.PWSX-gen.15649.15740.exe	28
PID 1624 wrote to memory of 2020	1624	SecuriteInfo.com.Win32.PWSX-gen.15649.15740.exe	28
PID 1624 wrote to memory of 2020	1624	SecuriteInfo.com.Win32.PWSX-gen.15649.15740.exe	28
PID 1624 wrote to memory of 2020	1624	SecuriteInfo.com.Win32.PWSX-gen.15649.15740.exe	28
PID 1624 wrote to memory of 2020	1624	SecuriteInfo.com.Win32.PWSX-gen.15649.15740.exe	28

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.15649.15740.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.15649.15740.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.15649.15740.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.15649.15740.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1624-54-0x0000000001010000-0x0000000001116000-memory.dmp

Download

memory/1624-55-0x00000000753C1000-0x00000000753C3000-memory.dmp

Download

memory/1624-56-0x0000000000470000-0x0000000000482000-memory.dmp

Download

memory/1624-57-0x00000000004A0000-0x00000000004AC000-memory.dmp

Download

memory/1624-58-0x00000000051B0000-0x000000000525A000-memory.dmp

Download

memory/1624-59-0x0000000000CB0000-0x0000000000D22000-memory.dmp

Download

memory/2020-60-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2020-61-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2020-63-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2020-65-0x00000000009A0000-0x0000000000CA3000-memory.dmp

Download