formbook | 459ce6294883e7069e69f00661550399519e9710fa272e68b92fc23505269751

Analysis

max time kernel
174s
max time network
186s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 11:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Trojan.PackedNET.1701.28303.5115.exe
Size

956KB
MD5

25afac4af95e135929e5dde1963f8f8f
SHA1

e201340360ea54e7f95076ff6cd35c9d7750b2ca
SHA256

459ce6294883e7069e69f00661550399519e9710fa272e68b92fc23505269751
SHA512

2e4341f33f8215ff136c5320ce2f23b555e76d370931e8883f1390ff1bb56d7cee5e5eb64865528649c9ea7962eccb48208ee681dfac9b263bd43c529dbe40b9
SSDEEP

24576:52qmbU8dpkJLgWv+Mi5oenEpaTiwAAgEEY4:QbU8dpk5K5oenjTQp

Score

10^/10

formbook go5o rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

go5o

Decoy

fEf3DteodjMS6sd7vgJeSvrFAjOyshM=

uc2s6+zSjq1jaMBrDIkbbfRB4Q==

1DUmPeheM/m2JuYZT9n1JEI=

Q8FlspVcKwohXhVD

PFATZwiJD6bkPqs=

5tHEw4jXm14dvppgGJx131tYeM4=

a5FigDzuo78hXhVD

nfmv8+wh5JHV

lnMvJvjhm7t0fdaA+9JrhA==

GnFAOuQx+o/L

kKeWmF41+RKfwkyZrXtbZUo=

koFndRQCh1zzOfO3TZLsdBxb

mXUzN51s8JHV

j+vOPsXEyCOEzA==

KgrZxnGEVOh8zQ==

LvWq2+PSUvusUEdnfkZXommlxCwf

meqtGP3Afq9MXXMv5A==

2W80eXRnD/Hp+jQCrmU=

asKlvYDQpWW/Cs6A+9JrhA==

fm9gkFsDy9w=

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

SecuriteInfo.com.Trojan.PackedNET.1701.28303.5115.exe

description	pid	process	target process
PID 2628 set thread context of 2852	2628	SecuriteInfo.com.Trojan.PackedNET.1701.28303.5115.exe	SecuriteInfo.com.Trojan.PackedNET.1701.28303.5115.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

SecuriteInfo.com.Trojan.PackedNET.1701.28303.5115.exe

pid process

2852 SecuriteInfo.com.Trojan.PackedNET.1701.28303.5115.exe
2852 SecuriteInfo.com.Trojan.PackedNET.1701.28303.5115.exe

pid	process
2852	SecuriteInfo.com.Trojan.PackedNET.1701.28303.5115.exe
2852	SecuriteInfo.com.Trojan.PackedNET.1701.28303.5115.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

SecuriteInfo.com.Trojan.PackedNET.1701.28303.5115.exe

description	pid	process	target process
PID 2628 wrote to memory of 2852	2628	SecuriteInfo.com.Trojan.PackedNET.1701.28303.5115.exe	SecuriteInfo.com.Trojan.PackedNET.1701.28303.5115.exe
PID 2628 wrote to memory of 2852	2628	SecuriteInfo.com.Trojan.PackedNET.1701.28303.5115.exe	SecuriteInfo.com.Trojan.PackedNET.1701.28303.5115.exe
PID 2628 wrote to memory of 2852	2628	SecuriteInfo.com.Trojan.PackedNET.1701.28303.5115.exe	SecuriteInfo.com.Trojan.PackedNET.1701.28303.5115.exe
PID 2628 wrote to memory of 2852	2628	SecuriteInfo.com.Trojan.PackedNET.1701.28303.5115.exe	SecuriteInfo.com.Trojan.PackedNET.1701.28303.5115.exe
PID 2628 wrote to memory of 2852	2628	SecuriteInfo.com.Trojan.PackedNET.1701.28303.5115.exe	SecuriteInfo.com.Trojan.PackedNET.1701.28303.5115.exe
PID 2628 wrote to memory of 2852	2628	SecuriteInfo.com.Trojan.PackedNET.1701.28303.5115.exe	SecuriteInfo.com.Trojan.PackedNET.1701.28303.5115.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1701.28303.5115.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1701.28303.5115.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2628

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1701.28303.5115.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1701.28303.5115.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2852

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2628-132-0x00000000009E0000-0x0000000000AD6000-memory.dmp

Filesize
984KB

Download
memory/2628-133-0x0000000005A00000-0x0000000005FA4000-memory.dmp

Filesize
5.6MB

Download
memory/2628-134-0x0000000005330000-0x00000000053C2000-memory.dmp

Filesize
584KB

Download
memory/2628-135-0x00000000053E0000-0x00000000053EA000-memory.dmp

Filesize
40KB

Download
memory/2628-136-0x0000000009110000-0x00000000091AC000-memory.dmp

Filesize
624KB

Download
memory/2852-137-0x0000000000000000-mapping.dmp

Download
memory/2852-138-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2852-140-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2852-141-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2852-142-0x0000000001510000-0x000000000185A000-memory.dmp

Filesize
3.3MB

Download