Overview

overview

10

Static

static

SecuriteIn...19.exe

windows7-x64

10

SecuriteIn...19.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    91s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-11-2022 05:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Win32.PWSX-gen.15485.10619.exe

  • Size

    698KB

  • MD5

    384c1108356687200fa75e23c9880279

  • SHA1

    6b9eb66cedd25665627c095b40d41913447ca60b

  • SHA256

    7c470477c32979be016bffc98f861acc089861a6a2ba015aed73d769774370bf

  • SHA512

    954821f87770e3013f3c1e35cbd33772c806dc255be206c300314bf659cb41232e82303dfee325165891263796c82ce28eb172e27b405ee77f68412cd1225446

  • SSDEEP

    12288:SJRgh/PsZ1DX/VDJtmZo6+qLCON4WI1GtpRZF/R1Y3U7t7E:sRgh/Pomxzmc4XAFc7

Score
10/10
formbookm5oeratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Campaign

m5oe

Decoy

HdR8hG6r12hBYuHY4zv6YeeFPQ==

tD1V9gswYvgQXEGd

1xKtJ1LdqRYMRMC84U1A

MbhjiWb7Lz8z7KIWl3UyUIJwA6Tb

joVB5Xggy2RtE+odsZg=

TrduAIay6Y3SvoIK20xI

pSna7LOsXXwXT/zz3Iow4g==

QnthmO4Qst5gC3sDoA==

eAirzOOgO7SOCenz3Iow4g==

xg0uSbfLTg==

YWQXwyGRzPEHzGrDFE8CBSE=

ujLnfuXoH9dbgHIK20xI

291v0XsGFrYQXEGd

MRvTd/qMuaHpjCM=

X131fLC6VWX4MsvCb2IPjIfq8wlksWfg

Y9Bur8DbgqFt/Yni86MMCCE=

q6RTBmJkmy5pWTmmCCrvmuCDPw==

mQS26DojT+EQXEGd

sjHQ+Kav2Wx9FeodsZg=

JA24UKnTA5re1LhcQaVo/w==

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.15485.10619.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.15485.10619.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4848
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.15485.10619.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.15485.10619.exe"
      2⤵
        PID:4528
      • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.15485.10619.exe
        "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.15485.10619.exe"
        2⤵
          PID:2452
        • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.15485.10619.exe
          "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.15485.10619.exe"
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2988

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2452-138-0x0000000000000000-mapping.dmp
        Download
      • memory/2988-139-0x0000000000000000-mapping.dmp
        Download
      • memory/2988-140-0x0000000000400000-0x000000000042F000-memory.dmp
        Filesize

        188KB

        Download
      • memory/2988-142-0x0000000000400000-0x000000000042F000-memory.dmp
        Filesize

        188KB

        Download
      • memory/2988-143-0x0000000000401000-0x000000000042F000-memory.dmp
        Filesize

        184KB

        Download
      • memory/2988-144-0x0000000001270000-0x00000000015BA000-memory.dmp
        Filesize

        3.3MB

        Download
      • memory/4528-137-0x0000000000000000-mapping.dmp
        Download
      • memory/4848-132-0x00000000005A0000-0x0000000000654000-memory.dmp
        Filesize

        720KB

        Download
      • memory/4848-133-0x0000000005490000-0x0000000005A34000-memory.dmp
        Filesize

        5.6MB

        Download
      • memory/4848-134-0x0000000004FE0000-0x0000000005072000-memory.dmp
        Filesize

        584KB

        Download
      • memory/4848-135-0x0000000005090000-0x000000000509A000-memory.dmp
        Filesize

        40KB

        Download
      • memory/4848-136-0x00000000079B0000-0x0000000007A4C000-memory.dmp
        Filesize

        624KB

        Download