formbook | c1fd700322fe5a908b87744730a34c923c9db9163adc0d018545c4ab285a31b9

Analysis

max time kernel
164s
max time network
195s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 19:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Win32.PWSX-gen.21214.29334.exe
Size

791KB
MD5

b94ac3cb559832fa92e65b6a127ba7e0
SHA1

def0dd941e90de0dc3d077033dbc234e86bcc077
SHA256

c1fd700322fe5a908b87744730a34c923c9db9163adc0d018545c4ab285a31b9
SHA512

b221425dc8dc5058fed6ef7a7200dde81f89788fc54bc709b261bd7c467737d5528575de33da853828c200bf6c4d83c4a706361d64ffc142ab6b6d3d02034164
SSDEEP

12288:vOvEq3qsQx8CuOrz/fsjE+en9+Ijp4mcDTUO95e6ANXJzvFC:zq3qn8CTrz/fswj9+ISmEVC6Ajzv

Score

10^/10

formbook fqwu rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

fqwu

Decoy

N6XHavFRXQTRmNUkF9dn

EoaWTgFMmLFmUJ7CJNkTiGoj5A==

Dm+WNJDwSQa5cML3Q7EBiGoj5A==

nixR8ZCkOWjqrASBuic=

yvWQNApkdf4QYIih4+xUDY0=

RtmBQtDYDb50g8btXA==

8SU541y9Ec12NYK8PSOfA8OPpaphimY=

/yEvxvlAkquuY3W1QQ==

AlHZgYW4BiI9V+M=

YsHIUsAOO15j+9TnWA==

JJu1S7QIIMij0xUqlUtv

CmWBLrD98YnyUCCFvy0=

uPwhAVEvtu1rTuY=

PI6bR88GVGXmRlpxpKjtBpo=

GnL7qs9HVQAiF6ckF9dn

2zVeBFKZgO1rTuY=

2VI1VpOg7boCAFxvrWN3ys9rovE=

L1lO62zA2o1QEEZRQtgh7g==

brhF5dY1e3zmSyCFvy0=

U6m2TsEidTTdsA5kX8wh7g==

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

SecuriteInfo.com.Win32.PWSX-gen.21214.29334.exe

description	pid	process	target process
PID 1748 set thread context of 3540	1748	SecuriteInfo.com.Win32.PWSX-gen.21214.29334.exe	SecuriteInfo.com.Win32.PWSX-gen.21214.29334.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

SecuriteInfo.com.Win32.PWSX-gen.21214.29334.exe

pid process

3540 SecuriteInfo.com.Win32.PWSX-gen.21214.29334.exe
3540 SecuriteInfo.com.Win32.PWSX-gen.21214.29334.exe

pid	process
3540	SecuriteInfo.com.Win32.PWSX-gen.21214.29334.exe
3540	SecuriteInfo.com.Win32.PWSX-gen.21214.29334.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

SecuriteInfo.com.Win32.PWSX-gen.21214.29334.exe

description	pid	process	target process
PID 1748 wrote to memory of 3540	1748	SecuriteInfo.com.Win32.PWSX-gen.21214.29334.exe	SecuriteInfo.com.Win32.PWSX-gen.21214.29334.exe
PID 1748 wrote to memory of 3540	1748	SecuriteInfo.com.Win32.PWSX-gen.21214.29334.exe	SecuriteInfo.com.Win32.PWSX-gen.21214.29334.exe
PID 1748 wrote to memory of 3540	1748	SecuriteInfo.com.Win32.PWSX-gen.21214.29334.exe	SecuriteInfo.com.Win32.PWSX-gen.21214.29334.exe
PID 1748 wrote to memory of 3540	1748	SecuriteInfo.com.Win32.PWSX-gen.21214.29334.exe	SecuriteInfo.com.Win32.PWSX-gen.21214.29334.exe
PID 1748 wrote to memory of 3540	1748	SecuriteInfo.com.Win32.PWSX-gen.21214.29334.exe	SecuriteInfo.com.Win32.PWSX-gen.21214.29334.exe
PID 1748 wrote to memory of 3540	1748	SecuriteInfo.com.Win32.PWSX-gen.21214.29334.exe	SecuriteInfo.com.Win32.PWSX-gen.21214.29334.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.21214.29334.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.21214.29334.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1748

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.21214.29334.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.21214.29334.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1748-132-0x0000000000430000-0x00000000004FC000-memory.dmp

Filesize
816KB

Download
memory/1748-133-0x00000000053D0000-0x0000000005974000-memory.dmp

Filesize
5.6MB

Download
memory/1748-134-0x0000000004EC0000-0x0000000004F52000-memory.dmp

Filesize
584KB

Download
memory/1748-135-0x0000000004E90000-0x0000000004E9A000-memory.dmp

Filesize
40KB

Download
memory/1748-136-0x0000000008910000-0x00000000089AC000-memory.dmp

Filesize
624KB

Download
memory/3540-137-0x0000000000000000-mapping.dmp

Download
memory/3540-138-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3540-141-0x0000000000401000-0x000000000042F000-memory.dmp

Filesize
184KB

Download
memory/3540-140-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3540-142-0x0000000001A00000-0x0000000001D4A000-memory.dmp

Filesize
3.3MB

Download