formbook | e5afa7413d271eb60f89be735d02aee02bb7390c022eeadf46ff30448416995d

Analysis

max time kernel
143s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
08/11/2022, 15:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Trojan.MSIL.AgentTesla.NWJ.MTB.22257.28503.exe
Size 1.0MB
Sample221108-s62zaaedc9
SHA256 e5afa7413d271eb60f89be735d02aee02bb7390c022eeadf46ff30448416995d
MD5 1da62988e49c14d4638f06b9eb87f54f
SHA1 7e076603f6be2c7cb5762875a423c059b6b1396a
SHA512 f51e179c689de4286183e5805926b141278561e1813b25aeade3a9606fe72e4d98ef169951de260bdcae3c70b37d71a62b41f90ccb8dbcc4177330cf429cf81a
SSDEEP 12288:TUEkCMDIQH5DdjUyBxMuDNTndn9kP4sjmDMJVKNb91IZCBKdWA2LM6oShKa7Q:TUOQbH5xBSuz9+jm3bbIMB+WAeLAaM
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook e7nb rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

e7nb

Decoy

PsTzh30CVEdk
lubNs/ediiAunBs=
508fP8IdRzd/
U549ZBc72VO65OOIBgw=
Zrhzpl05MNXVsnltXG7VJcZMaQ==
PHkdSJEyEOSxOwb6W0mv9ciuW+ybmQMt
uirizUluo2S80tubABs=
NSBqCst2TQsoCuPQCWrVJcZMaQ==
XgULikLb6PkeOubi
5YBDKpVGIrvCFbOc3Q==
8DbiHNWtmTAyw1YsjH/lL8TpimUu8ygl
nxj1I6Op1IGJVRbN7gpx
0KvxaFuA6cBryzDH1Lni7s9W
1rS3Dk9oxD/fRA==
eMFF9fHMPRZFILKx5WCRng==
pMxC7OGKd0jbCYRVMHnbFur1N+DU
nZzNQDhdyK5hEL2QkPhrtYVHz7k62Y0=
siXP5iXuAcxnhZBayg==
dP6jOfGxmFQDW+zPoDtnpnY=
MidVv6GxFvuwx5R5/w4=
LpZUdST377Hpy0TN7gpx
LsBbQ2sZTBNsWM+z5WCRng==
YFa4bVYH/tGjCIRk6yCVvmmvUwU=
uqThVT3iIRWG1oVNanjVJcZMaQ==
yN1dTZel57xXn0sEba7eJcZMaQ==
/1jjitFRKpyN52Imwg==
k7IxIFpTqoM4iTOtFBU=
9gOZw1XJoyAunBs=
Jr9fTH9F8Jtlz+OIBgw=
sE1gheW3Fgk2SBbN7gpx
CTK4XmN1v6Gd98qvZk95
e+rUBXFDusmiCuOIBgw=
fZHunc2mxD/fRA==
fnTXfIzBd1RpTRXN7gpx
YtGx3lYxoYE2ihunOy5lmw==
HECnR2JpQZTRbAY=
eLEkG1ry2Z9f376ekrfgSA5e
f3vbjXohEdJG4o5NAAo=
ZHfBOzJEfEvwPvPNWKsaViuskoAmmw==
SbRbTa5ZM+z+Jp9fTEt5
AaFWcbw1FJTRbAY=
aVyXNgkXUejctF0p/u3gSA5e
1irAZGGDz7vk9rR+cbvgSA5e
rwaQLi3z1ZNoyzPnFTODiQ==
X86YvV9818TpvuOIBgw=
fYzYf6jbPTkYdATucqAWViuskoAmmw==
IPoHMrvXPk3dO+qz5WCRng==
VcSSh/rDsVgy4cqd9hh3elxP3Lk62Y0=
iv7I8Zi3GPn+VyD1
E6+VFL6F++HOsmc0IJWx3tFW
nMT0kFURTw+0vjcIFCKOum61koAmmw==
RNvmXQzRLyQU6qBZTudAYGE=
vrII/zgDdFC1xETN7gpx
8qC110oD65CJVxbN7gpx
BSrg/UwN+pnkuGRGSsgzWNn6hRw=
XmaV+d+ixD/fRA==
k9Exy5USh0R5
hzYtTbRjQOrvzY5JBjZeooABDbRzmBU0
EG49W40rWxrsUCbn
0BS16ZvEAcXkvOOIBgw=
tPpwEAnSuXYOVQO+5WCRng==
/NTiWhW9+//cLMak5WCRng==
r6gKAzHwMd0T8Wc2fs0DIdg7Yf2bmQMt
SoDogHd/p2c70sOy5WCRng==
wikidesva.site

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1476 set thread context of 1724	1476	SecuriteInfo.com.Trojan.MSIL.AgentTesla.NWJ.MTB.22257.28503.exe	82

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1724	SecuriteInfo.com.Trojan.MSIL.AgentTesla.NWJ.MTB.22257.28503.exe
1724	SecuriteInfo.com.Trojan.MSIL.AgentTesla.NWJ.MTB.22257.28503.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 1724	1476	SecuriteInfo.com.Trojan.MSIL.AgentTesla.NWJ.MTB.22257.28503.exe	82
PID 1476 wrote to memory of 1724	1476	SecuriteInfo.com.Trojan.MSIL.AgentTesla.NWJ.MTB.22257.28503.exe	82
PID 1476 wrote to memory of 1724	1476	SecuriteInfo.com.Trojan.MSIL.AgentTesla.NWJ.MTB.22257.28503.exe	82
PID 1476 wrote to memory of 1724	1476	SecuriteInfo.com.Trojan.MSIL.AgentTesla.NWJ.MTB.22257.28503.exe	82
PID 1476 wrote to memory of 1724	1476	SecuriteInfo.com.Trojan.MSIL.AgentTesla.NWJ.MTB.22257.28503.exe	82
PID 1476 wrote to memory of 1724	1476	SecuriteInfo.com.Trojan.MSIL.AgentTesla.NWJ.MTB.22257.28503.exe	82

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MSIL.AgentTesla.NWJ.MTB.22257.28503.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MSIL.AgentTesla.NWJ.MTB.22257.28503.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MSIL.AgentTesla.NWJ.MTB.22257.28503.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MSIL.AgentTesla.NWJ.MTB.22257.28503.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1476-132-0x0000000000040000-0x000000000014A000-memory.dmp

Download

memory/1476-133-0x0000000005150000-0x00000000056F4000-memory.dmp

Download

memory/1476-134-0x0000000004AD0000-0x0000000004B62000-memory.dmp

Download

memory/1476-135-0x0000000004B80000-0x0000000004B8A000-memory.dmp

Download

memory/1476-136-0x00000000086A0000-0x000000000873C000-memory.dmp

Download

memory/1724-138-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1724-140-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1724-141-0x0000000000401000-0x000000000042F000-memory.dmp

Download

memory/1724-142-0x0000000001AE0000-0x0000000001E2A000-memory.dmp

Download