formbook | 69c4f08c64ca2809ab57dfb43008d4e197bda7ce1a3613402563660afd6e6226

Analysis

max time kernel
181s
max time network
184s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 11:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Trojan.PackedNET.1701.27630.3248.exe
Size

940KB
MD5

ad4afa925700586e0138bda59adaddb7
SHA1

8309a84b841861ccac278fc03a5e213bd6628126
SHA256

69c4f08c64ca2809ab57dfb43008d4e197bda7ce1a3613402563660afd6e6226
SHA512

48ccbd2a3297246499a252f9a3028f6400ca5199a0158f893ab62a347fc887269d338ef761e8daabe723c24bbb985b242b9091ac054fe541181598b33d5bd5e0
SSDEEP

24576:vzq75DWfksa2TEiYxBayY7CdTiwAAgEEY4:8Wfe2Q9xBxDTQp

Score

10^/10

formbook fqwu rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

fqwu

Decoy

N6XHavFRXQTRmNUkF9dn

EoaWTgFMmLFmUJ7CJNkTiGoj5A==

Dm+WNJDwSQa5cML3Q7EBiGoj5A==

nixR8ZCkOWjqrASBuic=

yvWQNApkdf4QYIih4+xUDY0=

RtmBQtDYDb50g8btXA==

8SU541y9Ec12NYK8PSOfA8OPpaphimY=

/yEvxvlAkquuY3W1QQ==

AlHZgYW4BiI9V+M=

YsHIUsAOO15j+9TnWA==

JJu1S7QIIMij0xUqlUtv

CmWBLrD98YnyUCCFvy0=

uPwhAVEvtu1rTuY=

PI6bR88GVGXmRlpxpKjtBpo=

GnL7qs9HVQAiF6ckF9dn

2zVeBFKZgO1rTuY=

2VI1VpOg7boCAFxvrWN3ys9rovE=

L1lO62zA2o1QEEZRQtgh7g==

brhF5dY1e3zmSyCFvy0=

U6m2TsEidTTdsA5kX8wh7g==

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

SecuriteInfo.com.Trojan.PackedNET.1701.27630.3248.exe

description	pid	process	target process
PID 1796 set thread context of 3840	1796	SecuriteInfo.com.Trojan.PackedNET.1701.27630.3248.exe	SecuriteInfo.com.Trojan.PackedNET.1701.27630.3248.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

SecuriteInfo.com.Trojan.PackedNET.1701.27630.3248.exe

pid process

3840 SecuriteInfo.com.Trojan.PackedNET.1701.27630.3248.exe
3840 SecuriteInfo.com.Trojan.PackedNET.1701.27630.3248.exe

pid	process
3840	SecuriteInfo.com.Trojan.PackedNET.1701.27630.3248.exe
3840	SecuriteInfo.com.Trojan.PackedNET.1701.27630.3248.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

SecuriteInfo.com.Trojan.PackedNET.1701.27630.3248.exe

description	pid	process	target process
PID 1796 wrote to memory of 3840	1796	SecuriteInfo.com.Trojan.PackedNET.1701.27630.3248.exe	SecuriteInfo.com.Trojan.PackedNET.1701.27630.3248.exe
PID 1796 wrote to memory of 3840	1796	SecuriteInfo.com.Trojan.PackedNET.1701.27630.3248.exe	SecuriteInfo.com.Trojan.PackedNET.1701.27630.3248.exe
PID 1796 wrote to memory of 3840	1796	SecuriteInfo.com.Trojan.PackedNET.1701.27630.3248.exe	SecuriteInfo.com.Trojan.PackedNET.1701.27630.3248.exe
PID 1796 wrote to memory of 3840	1796	SecuriteInfo.com.Trojan.PackedNET.1701.27630.3248.exe	SecuriteInfo.com.Trojan.PackedNET.1701.27630.3248.exe
PID 1796 wrote to memory of 3840	1796	SecuriteInfo.com.Trojan.PackedNET.1701.27630.3248.exe	SecuriteInfo.com.Trojan.PackedNET.1701.27630.3248.exe
PID 1796 wrote to memory of 3840	1796	SecuriteInfo.com.Trojan.PackedNET.1701.27630.3248.exe	SecuriteInfo.com.Trojan.PackedNET.1701.27630.3248.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1701.27630.3248.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1701.27630.3248.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1796

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1701.27630.3248.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1701.27630.3248.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1796-132-0x00000000004E0000-0x00000000005D2000-memory.dmp

Filesize
968KB

Download
memory/1796-133-0x0000000005520000-0x0000000005AC4000-memory.dmp

Filesize
5.6MB

Download
memory/1796-134-0x0000000005010000-0x00000000050A2000-memory.dmp

Filesize
584KB

Download
memory/1796-135-0x0000000004FA0000-0x0000000004FAA000-memory.dmp

Filesize
40KB

Download
memory/1796-136-0x0000000008D40000-0x0000000008DDC000-memory.dmp

Filesize
624KB

Download
memory/3840-137-0x0000000000000000-mapping.dmp

Download
memory/3840-138-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3840-141-0x0000000000401000-0x000000000042F000-memory.dmp

Filesize
184KB

Download
memory/3840-140-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3840-142-0x00000000014F0000-0x000000000183A000-memory.dmp

Filesize
3.3MB

Download