Overview

overview

10

Static

static

SecuriteIn...29.exe

windows7-x64

10

SecuriteIn...29.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    123s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/11/2022, 06:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    SecuriteInfo.com.Variant.Lazy.264511.1509.10929.exe
  • Size 1.0MB
  • Sample221115-hfr2aabf8x
  • SHA256 d621c9967cd3036f9e888588e71820eec8f5649ebe8c441ae3ef3bae9e01b0ac
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbooks5zxratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Campaign

  • s5zx

Decoy

  • wMAY83Xf8pYlwmcLm5HvBdaL

  • CEtcpyGISM/CVFQ5zam3

  • jQE/nMmnXlmcTVQ5zam3

  • kUtRVpN/YY33wLfac81TKg==

  • WxtrRs8s52o/GPsPog==

  • w8LUN0UWABcTD1Hv

  • pCU+Wnk+6/E08im2Xo5y7uea

  • 4o2dnKCJNOgbwud9JfMHrMJuAGI+fg==

  • AbPNtFXXpcoeyWB1WGC/AOiS

  • 5Kbo75EKwcLiArHSoc/SIg==

  • IaICXWtqc2xvU++OXEd+tRitdw==

  • x0M6GKkDC8SPQGd/S61UdfgVZLqVDFg=

  • Y6TEJKsC3IxVJN986uJugqNcN7NO5EU=

  • rltiOepgaw3Mk0Lbt1yoxuA=

  • z94mjMxyFcLUu1Q=

  • xH3F3Hz93BCSMuBtI65JGm+VN3xm

  • +GO142npuuptGPsPog==

  • WX/VsE7R0FTm3Ju2ema/AOiS

  • qam0OKkfCyE6ZKxZtQ==

  • 0ojGr0OMV9khz+4GoA==

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Lazy.264511.1509.10929.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Lazy.264511.1509.10929.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:996
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Lazy.264511.1509.10929.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Lazy.264511.1509.10929.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:3340

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/996-132-0x00000000006F0000-0x00000000007FE000-memory.dmp
        Download

        memory/996-133-0x00000000055E0000-0x0000000005B84000-memory.dmp
        Download

        memory/996-134-0x00000000050D0000-0x0000000005162000-memory.dmp
        Download

        memory/996-135-0x0000000005090000-0x000000000509A000-memory.dmp
        Download

        memory/996-136-0x00000000092A0000-0x000000000933C000-memory.dmp
        Download

        memory/3340-138-0x0000000000400000-0x000000000042F000-memory.dmp
        Download

        memory/3340-140-0x0000000000400000-0x000000000042F000-memory.dmp
        Download

        memory/3340-141-0x0000000000401000-0x000000000042F000-memory.dmp
        Download

        memory/3340-142-0x0000000001AA0000-0x0000000001DEA000-memory.dmp
        Download