formbook | e8ed49650b42ebb3a251a7353809309e94f885316bf1b0153def1c180628cee4

Analysis

max time kernel
163s
max time network
178s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 04:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe
Size

1.0MB
MD5

21eb8736dd89da5191e78fde4a3ca3da
SHA1

c96857cc2d0177ec028bba3e467f3930e5c02f85
SHA256

e8ed49650b42ebb3a251a7353809309e94f885316bf1b0153def1c180628cee4
SHA512

71ba19fd8cb5bbef1f4fb0d9a03ab7b9c8724263b0ab38e5c9cb979b65f42e7743c3e46050fc2b2fc52087a5e4523b8482c3a9acd3858a8bb71b536f4a220b6e
SSDEEP

12288:oyRPYYsZ1DX/VDJtV7oT6P9GJ2LjmgoxQT0z/ZBQfWh+QJFuUtxEr5Cd4uUVhjPO:oCYYk8WP9GcWje0zXhnzxEPZV

Score

10^/10

formbook ng04 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ng04

Decoy

tevimaq.com

easterspecialtystore.com

smartlever.tech

10312.uk

tanjawiharbi.co.uk

471338.com

horusventure.com

empress-care.com

sinrian.com

465951.com

aemsti.com

nxcourier.com

stargatefarms.com

lalyquainvestment.com

dailysportsadvice.com

justlistmoore.com

stoneonroll.online

tatianakolomiets.com

barcodebbm.com

protectorship.world

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/1776-138-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4080 set thread context of 1776	4080	SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe	92

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1776	SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe
1776	SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4080 wrote to memory of 1776	4080	SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe	92
PID 4080 wrote to memory of 1776	4080	SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe	92
PID 4080 wrote to memory of 1776	4080	SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe	92
PID 4080 wrote to memory of 1776	4080	SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe	92
PID 4080 wrote to memory of 1776	4080	SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe	92
PID 4080 wrote to memory of 1776	4080	SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe	92

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4080
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1617.32609.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1776

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1776-137-0x0000000000000000-mapping.dmp

Download
memory/1776-138-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1776-139-0x00000000016C0000-0x0000000001A0A000-memory.dmp

Filesize
3.3MB

Download
memory/4080-132-0x0000000000E60000-0x0000000000F6C000-memory.dmp

Filesize
1.0MB

Download
memory/4080-133-0x0000000005DD0000-0x0000000006374000-memory.dmp

Filesize
5.6MB

Download
memory/4080-134-0x0000000005900000-0x0000000005992000-memory.dmp

Filesize
584KB

Download
memory/4080-135-0x00000000058E0000-0x00000000058EA000-memory.dmp

Filesize
40KB

Download
memory/4080-136-0x0000000007D20000-0x0000000007DBC000-memory.dmp

Filesize
624KB

Download