formbook | c30a52af8e6fdb816ad1efea8ad00af616202cdd9df1fccaa85d744da35f65e1

Analysis

max time kernel
86s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
22/11/2022, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Trojan.Packed2.44634.18408.4820.exe
Size 917KB
Sample221122-e6jaaaad29
SHA256 c30a52af8e6fdb816ad1efea8ad00af616202cdd9df1fccaa85d744da35f65e1
MD5 d07475e2be6c516b411af466db4f7c28
SHA1 7d7721100513e01c4fa9b04c3ddabeaff94dab06
SHA512 612fc1b97ff9a8c48c1feb35b87cb1c964d2f911805db1731e0ce8b99ac03c05a4923a35d5ac16b0794c8157d148945067b50554d612bf07e78325828c8677c0
SSDEEP 24576:ZM+L74mBfNUstzopkrqft7ULTmKdwuWx1LAP+x3hkEwyAW33r8JN:LqlgTLaFAP+Zh4yAW3I
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook cfvc rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

cfvc

Decoy

qFcyI8OAPHKap6ubfQ==
NuOCNnr/zOqy1xM5AN4=
CnHfypZMLKQKgKaaVw4J1g==
9WpDFnsiwEyoFko7+GYiyo55
zUKhZPi3f21+ux+L
vqqeiTTPlz+cnQaD
GLGZh9zop+UvsCtBEm9x
eCUGyUEAe9hmj8KgaA==
EvXUn0s63zJyoxQfCGQmMZRu
kVy6iO/FuRGD/A==
+tg0M82KQk7fX4XXoYIluHMEFhbrzMk=
hP/nqutI9DR+0mBnYA==
cwrq1kLJd9QzqtQq9QCc7hHV9FjjKSvU
eE6vlcLHxAHZ7g==
vpKQL84+30y4SZpU/Ox5
vbfnlWZmAj1aVbCdbA==
UNQwEfT8tzbiL3J2Wrjm3g==
02LLqYRY9SeDIHwK5pFjYrg=
PhkLzj8IuT6R7v3lxlBYwqO69HReqnrF
mkYwC5lsF6cDS6RU/Ox5
1egU0tEWDQZP4Q==
j2hZM5oc3kuPqgtxdw==
ceTIuEIUsSqC1+kg0DN357A=
0n3Tv+je3uk1uPJ2UCeiBsWBroDfJ7bf
hgHg0mI184XD+2HFnlVUNK8=
zVhUFCJH0xh00mBnYA==
0JhxOe3ytCRhyfjJVw4J1g==
WwLp1zuiQYGcnQaD
x39kI22vp+a0
WAr3xT8KyvPACx4FqUhkPqU=
X+bPkcY70A0oFQcG+m1x
ewR0bXi8fMYZkqubVw4J1g==
vUgh8nUYreg2t9ppSTDRNj216pc=
ey2Fa74m0WOr4AcR4dY=
O/b2teB5XDwgSID94pFjYrg=
II5sV7MarwZFXKoOEHFx
knDWptRdEGBPoLCeVw4J1g==
/oiISUVo+yTt0mBnYA==
JgTr0m7TrMqp
95qEXdpyGYbuaoDblmvOhWJk
X4plwqU17S2xDSQ=
DqIBzM4G0zN/+xovDWciyo55
XEAaCx5Oz/DaKSOZh2n5Chw6anyZ1mTG5w==
GfzORwwFDQZP4Q==
NejQnRiIqch90mBnYA==
p28NrwJ8FC2xDSQ=
uUu3mq7RWJTeXHtsUrndrD216pc=
rEOem/FY+yQAH15sUcDQnl3A1I4=
WA+HZENXPUKK/w==
IfsfZRUUGmKywQp/Nm/iOjPQLwytFA==
+OW+RRAHDQZP4Q==
OuZOFzi2R3ucnQaD
Z+pRRCYe6gvvO0Ym4E1Tvn44uy+8
ihkH5xZaF1y2SJalVw4J1g==
3VLCoGuDY1inTTw=
LA3nunIjBF+g
8rwsCO4H70CbCiw=
+2phRZUq3BnyL5dU/Ox5
y6SOR85wEWKxR5xU/Ox5
74Dvum5h/jo3rxM5AN4=
iXZg793elQ6cnQaD
fx6DZlZJInbJSV66eCMJdT/zC58=
uXnhoI/On/A50C0hzeZ+c7o=
9pKOGVH0o0E=
creativepediatric.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1528 set thread context of 1184	1528	SecuriteInfo.com.Trojan.Packed2.44634.18408.4820.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1184	SecuriteInfo.com.Trojan.Packed2.44634.18408.4820.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 1184	1528	SecuriteInfo.com.Trojan.Packed2.44634.18408.4820.exe	28
PID 1528 wrote to memory of 1184	1528	SecuriteInfo.com.Trojan.Packed2.44634.18408.4820.exe	28
PID 1528 wrote to memory of 1184	1528	SecuriteInfo.com.Trojan.Packed2.44634.18408.4820.exe	28
PID 1528 wrote to memory of 1184	1528	SecuriteInfo.com.Trojan.Packed2.44634.18408.4820.exe	28
PID 1528 wrote to memory of 1184	1528	SecuriteInfo.com.Trojan.Packed2.44634.18408.4820.exe	28
PID 1528 wrote to memory of 1184	1528	SecuriteInfo.com.Trojan.Packed2.44634.18408.4820.exe	28
PID 1528 wrote to memory of 1184	1528	SecuriteInfo.com.Trojan.Packed2.44634.18408.4820.exe	28

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Packed2.44634.18408.4820.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Packed2.44634.18408.4820.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Packed2.44634.18408.4820.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Packed2.44634.18408.4820.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1184-60-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1184-61-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1184-63-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1184-66-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1184-67-0x0000000000401000-0x000000000042F000-memory.dmp

Download

memory/1184-68-0x0000000000C70000-0x0000000000F73000-memory.dmp

Download

memory/1528-55-0x00000000757B1000-0x00000000757B3000-memory.dmp

Download

memory/1528-56-0x0000000000510000-0x0000000000528000-memory.dmp

Download

memory/1528-57-0x00000000004F0000-0x00000000004FC000-memory.dmp

Download

memory/1528-58-0x00000000057A0000-0x0000000005842000-memory.dmp

Download

memory/1528-59-0x0000000004E20000-0x0000000004E88000-memory.dmp

Download

memory/1528-54-0x0000000000B80000-0x0000000000C6C000-memory.dmp

Download