formbook | 459ce6294883e7069e69f00661550399519e9710fa272e68b92fc23505269751

Analysis

max time kernel
54s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 11:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Trojan.PackedNET.1701.28303.5115.exe
Size

956KB
MD5

25afac4af95e135929e5dde1963f8f8f
SHA1

e201340360ea54e7f95076ff6cd35c9d7750b2ca
SHA256

459ce6294883e7069e69f00661550399519e9710fa272e68b92fc23505269751
SHA512

2e4341f33f8215ff136c5320ce2f23b555e76d370931e8883f1390ff1bb56d7cee5e5eb64865528649c9ea7962eccb48208ee681dfac9b263bd43c529dbe40b9
SSDEEP

24576:52qmbU8dpkJLgWv+Mi5oenEpaTiwAAgEEY4:QbU8dpk5K5oenjTQp

Score

10^/10

formbook go5o rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

go5o

Decoy

fEf3DteodjMS6sd7vgJeSvrFAjOyshM=

uc2s6+zSjq1jaMBrDIkbbfRB4Q==

1DUmPeheM/m2JuYZT9n1JEI=

Q8FlspVcKwohXhVD

PFATZwiJD6bkPqs=

5tHEw4jXm14dvppgGJx131tYeM4=

a5FigDzuo78hXhVD

nfmv8+wh5JHV

lnMvJvjhm7t0fdaA+9JrhA==

GnFAOuQx+o/L

kKeWmF41+RKfwkyZrXtbZUo=

koFndRQCh1zzOfO3TZLsdBxb

mXUzN51s8JHV

j+vOPsXEyCOEzA==

KgrZxnGEVOh8zQ==

LvWq2+PSUvusUEdnfkZXommlxCwf

meqtGP3Afq9MXXMv5A==

2W80eXRnD/Hp+jQCrmU=

asKlvYDQpWW/Cs6A+9JrhA==

fm9gkFsDy9w=

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

SecuriteInfo.com.Trojan.PackedNET.1701.28303.5115.exe

description	pid	process	target process
PID 1112 set thread context of 1552	1112	SecuriteInfo.com.Trojan.PackedNET.1701.28303.5115.exe	SecuriteInfo.com.Trojan.PackedNET.1701.28303.5115.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

SecuriteInfo.com.Trojan.PackedNET.1701.28303.5115.exe

pid process

1552 SecuriteInfo.com.Trojan.PackedNET.1701.28303.5115.exe

pid	process
1552	SecuriteInfo.com.Trojan.PackedNET.1701.28303.5115.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

SecuriteInfo.com.Trojan.PackedNET.1701.28303.5115.exe

description	pid	process	target process
PID 1112 wrote to memory of 1552	1112	SecuriteInfo.com.Trojan.PackedNET.1701.28303.5115.exe	SecuriteInfo.com.Trojan.PackedNET.1701.28303.5115.exe
PID 1112 wrote to memory of 1552	1112	SecuriteInfo.com.Trojan.PackedNET.1701.28303.5115.exe	SecuriteInfo.com.Trojan.PackedNET.1701.28303.5115.exe
PID 1112 wrote to memory of 1552	1112	SecuriteInfo.com.Trojan.PackedNET.1701.28303.5115.exe	SecuriteInfo.com.Trojan.PackedNET.1701.28303.5115.exe
PID 1112 wrote to memory of 1552	1112	SecuriteInfo.com.Trojan.PackedNET.1701.28303.5115.exe	SecuriteInfo.com.Trojan.PackedNET.1701.28303.5115.exe
PID 1112 wrote to memory of 1552	1112	SecuriteInfo.com.Trojan.PackedNET.1701.28303.5115.exe	SecuriteInfo.com.Trojan.PackedNET.1701.28303.5115.exe
PID 1112 wrote to memory of 1552	1112	SecuriteInfo.com.Trojan.PackedNET.1701.28303.5115.exe	SecuriteInfo.com.Trojan.PackedNET.1701.28303.5115.exe
PID 1112 wrote to memory of 1552	1112	SecuriteInfo.com.Trojan.PackedNET.1701.28303.5115.exe	SecuriteInfo.com.Trojan.PackedNET.1701.28303.5115.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1701.28303.5115.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1701.28303.5115.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1112

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1701.28303.5115.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1701.28303.5115.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1552

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1112-54-0x0000000000FF0000-0x00000000010E6000-memory.dmp

Filesize
984KB

Download
memory/1112-55-0x0000000076031000-0x0000000076033000-memory.dmp

Filesize
8KB

Download
memory/1112-56-0x0000000000390000-0x00000000003A6000-memory.dmp

Filesize
88KB

Download
memory/1112-57-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1112-58-0x0000000007E20000-0x0000000007EB2000-memory.dmp

Filesize
584KB

Download
memory/1112-59-0x0000000000C00000-0x0000000000C58000-memory.dmp

Filesize
352KB

Download
memory/1552-60-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1552-61-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1552-63-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1552-64-0x00000000004012B0-mapping.dmp

Download
memory/1552-66-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1552-67-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/1552-68-0x00000000008D0000-0x0000000000BD3000-memory.dmp

Filesize
3.0MB

Download