formbook | 567deb123c5d32e9af005cc681340d95fce92e73cf198db892c0d2b9b0e2a38f

Analysis

max time kernel
82s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 16:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Trojan.PackedNET.389.16151.14322.exe
Size

552KB
MD5

4a20a8cc90118bd227dc8c34451da980
SHA1

32516d8174aa9c0a7d31b3d3457783dea0756e06
SHA256

567deb123c5d32e9af005cc681340d95fce92e73cf198db892c0d2b9b0e2a38f
SHA512

0b14532f3571c52178b4d2fb579895d7e34d9a7bbe8b9a379649ceb610d8c209810809ff70ec62b984adca63f3082f8ba2b7a8ab491e018fbafbf51fb3ac090e
SSDEEP

12288:uqz6CeZtZWbkx5THT4aecA29ZP22Sx4sJYsAe/S9jq:p1eZSsJPA29ZPZt4Ab9j

Score

10^/10

formbook qmpa rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

qmpa

Decoy

IEiN8oqOnNUEkfZd

LWyAr1P5PHPV

tMGP9gYCIc9DKQ==

fWi2stCh2E3DBWuEK612

B3LCCi2JvPxfNA==

NjLnNjX+DDWt/VuEK612

AvK5/JdMDLztPRg=

U+zn2FswDLztPRg=

3bRIXGwsIc9DKQ==

EXmAoj3/7Cyl+VuEK612

1gkKPklP1odxx7c/Zm+L6HeV4g==

1cMaHDg0ypV0vbT2Ibh+/5Cj5xmAVxA=

MSyBdIV+6nFRloTQAwmFklQ=

qilszGJvhMUsHgaUx/MNSKuo6A==

WYKLwmYEij4q2Hy6sOc=

sjII/IyFmORBFPJ2dVjpG0Q=

mTjzaRwZ9OsEkfZd

iL27vFhbX5ECbBIJxvJKbPHFf9M=

5A5Xr0D5PHPV

IpxsaTO4a1/I

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

SecuriteInfo.com.Trojan.PackedNET.389.16151.14322.exe

description	pid	process	target process
PID 892 set thread context of 952	892	SecuriteInfo.com.Trojan.PackedNET.389.16151.14322.exe	SecuriteInfo.com.Trojan.PackedNET.389.16151.14322.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

SecuriteInfo.com.Trojan.PackedNET.389.16151.14322.exe

pid process

952 SecuriteInfo.com.Trojan.PackedNET.389.16151.14322.exe

pid	process
952	SecuriteInfo.com.Trojan.PackedNET.389.16151.14322.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

SecuriteInfo.com.Trojan.PackedNET.389.16151.14322.exe

description	pid	process	target process
PID 892 wrote to memory of 952	892	SecuriteInfo.com.Trojan.PackedNET.389.16151.14322.exe	SecuriteInfo.com.Trojan.PackedNET.389.16151.14322.exe
PID 892 wrote to memory of 952	892	SecuriteInfo.com.Trojan.PackedNET.389.16151.14322.exe	SecuriteInfo.com.Trojan.PackedNET.389.16151.14322.exe
PID 892 wrote to memory of 952	892	SecuriteInfo.com.Trojan.PackedNET.389.16151.14322.exe	SecuriteInfo.com.Trojan.PackedNET.389.16151.14322.exe
PID 892 wrote to memory of 952	892	SecuriteInfo.com.Trojan.PackedNET.389.16151.14322.exe	SecuriteInfo.com.Trojan.PackedNET.389.16151.14322.exe
PID 892 wrote to memory of 952	892	SecuriteInfo.com.Trojan.PackedNET.389.16151.14322.exe	SecuriteInfo.com.Trojan.PackedNET.389.16151.14322.exe
PID 892 wrote to memory of 952	892	SecuriteInfo.com.Trojan.PackedNET.389.16151.14322.exe	SecuriteInfo.com.Trojan.PackedNET.389.16151.14322.exe
PID 892 wrote to memory of 952	892	SecuriteInfo.com.Trojan.PackedNET.389.16151.14322.exe	SecuriteInfo.com.Trojan.PackedNET.389.16151.14322.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.389.16151.14322.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.389.16151.14322.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:892

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.389.16151.14322.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.389.16151.14322.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:952

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/892-54-0x0000000000FD0000-0x000000000105A000-memory.dmp

Filesize
552KB

Download
memory/892-55-0x0000000075131000-0x0000000075133000-memory.dmp

Filesize
8KB

Download
memory/892-56-0x0000000000310000-0x0000000000326000-memory.dmp

Filesize
88KB

Download
memory/892-57-0x0000000000640000-0x000000000064E000-memory.dmp

Filesize
56KB

Download
memory/892-58-0x0000000005260000-0x00000000052D0000-memory.dmp

Filesize
448KB

Download
memory/892-59-0x0000000000740000-0x0000000000774000-memory.dmp

Filesize
208KB

Download
memory/952-60-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/952-61-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/952-64-0x00000000004012B0-mapping.dmp

Download
memory/952-63-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/952-66-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/952-67-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/952-68-0x00000000008E0000-0x0000000000BE3000-memory.dmp

Filesize
3.0MB

Download