formbook | c1fd700322fe5a908b87744730a34c923c9db9163adc0d018545c4ab285a31b9

Analysis

max time kernel
85s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 19:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Win32.PWSX-gen.21214.29334.exe
Size

791KB
MD5

b94ac3cb559832fa92e65b6a127ba7e0
SHA1

def0dd941e90de0dc3d077033dbc234e86bcc077
SHA256

c1fd700322fe5a908b87744730a34c923c9db9163adc0d018545c4ab285a31b9
SHA512

b221425dc8dc5058fed6ef7a7200dde81f89788fc54bc709b261bd7c467737d5528575de33da853828c200bf6c4d83c4a706361d64ffc142ab6b6d3d02034164
SSDEEP

12288:vOvEq3qsQx8CuOrz/fsjE+en9+Ijp4mcDTUO95e6ANXJzvFC:zq3qn8CTrz/fswj9+ISmEVC6Ajzv

Score

10^/10

formbook fqwu rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

fqwu

Decoy

N6XHavFRXQTRmNUkF9dn

EoaWTgFMmLFmUJ7CJNkTiGoj5A==

Dm+WNJDwSQa5cML3Q7EBiGoj5A==

nixR8ZCkOWjqrASBuic=

yvWQNApkdf4QYIih4+xUDY0=

RtmBQtDYDb50g8btXA==

8SU541y9Ec12NYK8PSOfA8OPpaphimY=

/yEvxvlAkquuY3W1QQ==

AlHZgYW4BiI9V+M=

YsHIUsAOO15j+9TnWA==

JJu1S7QIIMij0xUqlUtv

CmWBLrD98YnyUCCFvy0=

uPwhAVEvtu1rTuY=

PI6bR88GVGXmRlpxpKjtBpo=

GnL7qs9HVQAiF6ckF9dn

2zVeBFKZgO1rTuY=

2VI1VpOg7boCAFxvrWN3ys9rovE=

L1lO62zA2o1QEEZRQtgh7g==

brhF5dY1e3zmSyCFvy0=

U6m2TsEidTTdsA5kX8wh7g==

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

SecuriteInfo.com.Win32.PWSX-gen.21214.29334.exe

description	pid	process	target process
PID 1308 set thread context of 580	1308	SecuriteInfo.com.Win32.PWSX-gen.21214.29334.exe	SecuriteInfo.com.Win32.PWSX-gen.21214.29334.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

SecuriteInfo.com.Win32.PWSX-gen.21214.29334.exe

pid process

580 SecuriteInfo.com.Win32.PWSX-gen.21214.29334.exe

pid	process
580	SecuriteInfo.com.Win32.PWSX-gen.21214.29334.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

SecuriteInfo.com.Win32.PWSX-gen.21214.29334.exe

description	pid	process	target process
PID 1308 wrote to memory of 580	1308	SecuriteInfo.com.Win32.PWSX-gen.21214.29334.exe	SecuriteInfo.com.Win32.PWSX-gen.21214.29334.exe
PID 1308 wrote to memory of 580	1308	SecuriteInfo.com.Win32.PWSX-gen.21214.29334.exe	SecuriteInfo.com.Win32.PWSX-gen.21214.29334.exe
PID 1308 wrote to memory of 580	1308	SecuriteInfo.com.Win32.PWSX-gen.21214.29334.exe	SecuriteInfo.com.Win32.PWSX-gen.21214.29334.exe
PID 1308 wrote to memory of 580	1308	SecuriteInfo.com.Win32.PWSX-gen.21214.29334.exe	SecuriteInfo.com.Win32.PWSX-gen.21214.29334.exe
PID 1308 wrote to memory of 580	1308	SecuriteInfo.com.Win32.PWSX-gen.21214.29334.exe	SecuriteInfo.com.Win32.PWSX-gen.21214.29334.exe
PID 1308 wrote to memory of 580	1308	SecuriteInfo.com.Win32.PWSX-gen.21214.29334.exe	SecuriteInfo.com.Win32.PWSX-gen.21214.29334.exe
PID 1308 wrote to memory of 580	1308	SecuriteInfo.com.Win32.PWSX-gen.21214.29334.exe	SecuriteInfo.com.Win32.PWSX-gen.21214.29334.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.21214.29334.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.21214.29334.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1308

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.21214.29334.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.21214.29334.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:580

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/580-64-0x00000000004012B0-mapping.dmp

Download
memory/580-60-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/580-61-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/580-63-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/580-66-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/580-67-0x0000000000401000-0x000000000042F000-memory.dmp

Filesize
184KB

Download
memory/580-68-0x0000000000AF0000-0x0000000000DF3000-memory.dmp

Filesize
3.0MB

Download
memory/1308-55-0x00000000766F1000-0x00000000766F3000-memory.dmp

Filesize
8KB

Download
memory/1308-56-0x0000000000440000-0x0000000000456000-memory.dmp

Filesize
88KB

Download
memory/1308-57-0x00000000003E0000-0x00000000003EE000-memory.dmp

Filesize
56KB

Download
memory/1308-58-0x0000000007DE0000-0x0000000007E76000-memory.dmp

Filesize
600KB

Download
memory/1308-59-0x0000000005CC0000-0x0000000005D1C000-memory.dmp

Filesize
368KB

Download
memory/1308-54-0x0000000000A20000-0x0000000000AEC000-memory.dmp

Filesize
816KB

Download