Overview

overview

10

Static

static

SecuriteIn...47.exe

windows7-x64

10

SecuriteIn...47.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    55s
  • max time network
    44s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    29-11-2022 18:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Win32.CrypterX-gen.845.22447.exe

  • Size

    904KB

  • MD5

    2364501a86685f9a53d37d339549cee5

  • SHA1

    ebacf33c1e9f53048a8e808429671ed489dc285d

  • SHA256

    74a3379894a1b92cb381a128c7fe7c5f97e1a12df02588ec816d1a4fc5dc0a25

  • SHA512

    1210b67603986cfa62d6ac7df1ac3da1aeb03d80716f605465967e8895ec9fd39106918b5de5f865b7ce937cc2f111849b88450b517201cc6ea4b2af269e819d

  • SSDEEP

    12288:8SYqU+RPN8z0WC9ZG5MyVh+rpDhl6loeY7XccEKjxN4qwkqpUKPPDdzoa1cfN:/JKzOZl56lE7McE6xN44ZKPPDdEPf

Score
10/10
formbookb3esratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

b3es

Decoy

sweets.wtf

apextama.com

tygbs.com

kumaoedu.com

bestbathroomremodeling.club

lnshykj.com

nelsonanddima.com

falunap.info

codyhinrichs.com

2797vip.com

danutka.com

3o2t307a.com

kellymariewest.com

profilelonn.online

procan.website

sopjimmy.com

xn--skdarkae-55ac80i.net

entitymanaged.com

melitadahl.art

joineguru.net

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook
  • Formbook payload 2 IoCs
    rat
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterX-gen.845.22447.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterX-gen.845.22447.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1228
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterX-gen.845.22447.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterX-gen.845.22447.exe"
      2⤵
        PID:1592
      • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterX-gen.845.22447.exe
        "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterX-gen.845.22447.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:1636

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1228-54-0x0000000001310000-0x00000000013F8000-memory.dmp
      Filesize

      928KB

      Download
    • memory/1228-55-0x0000000075561000-0x0000000075563000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1228-56-0x0000000000250000-0x0000000000266000-memory.dmp
      Filesize

      88KB

      Download
    • memory/1228-57-0x0000000000410000-0x000000000041E000-memory.dmp
      Filesize

      56KB

      Download
    • memory/1228-58-0x0000000005780000-0x0000000005816000-memory.dmp
      Filesize

      600KB

      Download
    • memory/1228-59-0x0000000004F90000-0x0000000004FEC000-memory.dmp
      Filesize

      368KB

      Download
    • memory/1636-63-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

      Download
    • memory/1636-64-0x000000000041F0F0-mapping.dmp
      Download
    • memory/1636-61-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

      Download
    • memory/1636-60-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

      Download
    • memory/1636-65-0x0000000000860000-0x0000000000B63000-memory.dmp
      Filesize

      3.0MB

      Download