Overview

overview

10

Static

static

SecuriteIn...22.exe

windows7-x64

10

SecuriteIn...22.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    154s
  • max time network
    196s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-12-2022 16:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Trojan.PackedNET.389.16151.14322.exe

  • Size

    552KB

  • MD5

    4a20a8cc90118bd227dc8c34451da980

  • SHA1

    32516d8174aa9c0a7d31b3d3457783dea0756e06

  • SHA256

    567deb123c5d32e9af005cc681340d95fce92e73cf198db892c0d2b9b0e2a38f

  • SHA512

    0b14532f3571c52178b4d2fb579895d7e34d9a7bbe8b9a379649ceb610d8c209810809ff70ec62b984adca63f3082f8ba2b7a8ab491e018fbafbf51fb3ac090e

  • SSDEEP

    12288:uqz6CeZtZWbkx5THT4aecA29ZP22Sx4sJYsAe/S9jq:p1eZSsJPA29ZPZt4Ab9j

Score
10/10
formbookqmparatspywarestealertrojan

Malware Config

Extracted

Family

formbook

Campaign

qmpa

Decoy

IEiN8oqOnNUEkfZd

LWyAr1P5PHPV

tMGP9gYCIc9DKQ==

fWi2stCh2E3DBWuEK612

B3LCCi2JvPxfNA==

NjLnNjX+DDWt/VuEK612

AvK5/JdMDLztPRg=

U+zn2FswDLztPRg=

3bRIXGwsIc9DKQ==

EXmAoj3/7Cyl+VuEK612

1gkKPklP1odxx7c/Zm+L6HeV4g==

1cMaHDg0ypV0vbT2Ibh+/5Cj5xmAVxA=

MSyBdIV+6nFRloTQAwmFklQ=

qilszGJvhMUsHgaUx/MNSKuo6A==

WYKLwmYEij4q2Hy6sOc=

sjII/IyFmORBFPJ2dVjpG0Q=

mTjzaRwZ9OsEkfZd

iL27vFhbX5ECbBIJxvJKbPHFf9M=

5A5Xr0D5PHPV

IpxsaTO4a1/I

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.389.16151.14322.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.389.16151.14322.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3272
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.389.16151.14322.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.389.16151.14322.exe"
      2⤵
        PID:3040
      • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.389.16151.14322.exe
        "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.389.16151.14322.exe"
        2⤵
          PID:504
        • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.389.16151.14322.exe
          "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.389.16151.14322.exe"
          2⤵
            PID:4100
          • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.389.16151.14322.exe
            "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.389.16151.14322.exe"
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:4356

        Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/504-139-0x0000000000000000-mapping.dmp
          Download
        • memory/3040-138-0x0000000000000000-mapping.dmp
          Download
        • memory/3272-135-0x0000000005410000-0x00000000055B6000-memory.dmp
          Filesize

          1.6MB

          Download
        • memory/3272-132-0x0000000000740000-0x00000000007CA000-memory.dmp
          Filesize

          552KB

          Download
        • memory/3272-136-0x00000000051A0000-0x00000000051AA000-memory.dmp
          Filesize

          40KB

          Download
        • memory/3272-137-0x00000000079D0000-0x0000000007A6C000-memory.dmp
          Filesize

          624KB

          Download
        • memory/3272-134-0x00000000051C0000-0x0000000005252000-memory.dmp
          Filesize

          584KB

          Download
        • memory/3272-133-0x00000000056D0000-0x0000000005C74000-memory.dmp
          Filesize

          5.6MB

          Download
        • memory/4100-140-0x0000000000000000-mapping.dmp
          Download
        • memory/4356-141-0x0000000000000000-mapping.dmp
          Download
        • memory/4356-142-0x0000000000400000-0x000000000042E000-memory.dmp
          Filesize

          184KB

          Download
        • memory/4356-144-0x0000000000400000-0x000000000042E000-memory.dmp
          Filesize

          184KB

          Download
        • memory/4356-145-0x0000000000401000-0x000000000042E000-memory.dmp
          Filesize

          180KB

          Download
        • memory/4356-146-0x0000000001820000-0x0000000001B6A000-memory.dmp
          Filesize

          3.3MB

          Download