formbook | 672b918c5c82cfed617eeca2ab662854d2e9feef0031f7a72025962f3ee867ca

Analysis

max time kernel
91s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 10:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Win32.PWSX-gen.2588.21949.exe
Size 661KB
Sample221205-mpdx8sbd85
SHA256 672b918c5c82cfed617eeca2ab662854d2e9feef0031f7a72025962f3ee867ca
MD5 b8462af1afb6c95d62624002fcc05726
SHA1 5173feb0360d628a1fd33e00b8860cfe576dff3a
SHA512 11c25ed18165ffa232828bcbf772d403c16406f85891ed4f6783ba021a9677d9f49628179f8ce9d385974da8ca62054891da25efd6be4092283350f45455636f
SSDEEP 12288:4PuYd+V6b1momPZefNteeJB6s6IvcyOHQ4iPz1r+9Mvp0ThGv2Rg9PuYd+V6b:4PuYd+V6bIomxiNdwuA2F+9MvOmQiPuI
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook n2hm rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

n2hm

Decoy

XCeG4IxNKbAl
YzJWbnC+El84nA==
KAJcdmP8yEcO5LXPCFF42Wfb
I+J+xYO95GJQWVU=
GtgxPPv3FmQmhw==
Og9NYF4xEl+j7vGTR93xvg==
506Cg07bsT0G6yK+A96H0h35V+JLkwI=
wAYXFN+pSFIXgQ==
ijzLI/f+FmQmhw==
UfT2PweNm+w8
GQWVw5aZnfF/kS5e
30BKYjua9zcA7gAwsPUngLnjyrBNEgo=
AM65OrmyFmQmhw==
VSlTVxISZ4J/kS5e
GGKj6K33SRh6e0/YzT5nQGlK5CXRqw==
B9H98cUUfX+AWOqiTA==
MxVffWOIoVnM37zrd2sTaOY=
z6bxCgG/mGhR7oDzQA==
pQgSLSRi6AK3M/PdArpX
6rRRsYuSnXx/kS5e
tJRNn0ias3Yw
7c4NEQLSp/R/kS5e
TJmwu5Aa/IuRHtoXXQ==
TLoRUygkiJQE5GoRji0aff0=
Y83qB/DsQFYeZzahj6pYqw==
Bup2q3PHFmQmhw==
cDTa78WEWaYMdoDdArpX
28Rw4MRMnjT52raaTR5KhtMJYa8=
WydpZS7v/4XubCZuhkdxP2OAKdyK68u6
B+osKudaL8yAV/K/VAH3T+Q=
qVz9Y0QD3TGeM/PdArpX
+r49VzlFXLpFegdyc4q5ow==
gsXk990afa1hl6ATTA==
XkblOQWRaet/kS5e
4TNPSf2OcfNk9cfPCFF42Wfb
NaIIUEoRdKYr
ITSqBfn5FmQmhw==
KPRUmWnqxVE0hERFtyo=
VLzd1qk6E5wNcQ49KnmhAoT3Ok5roMK4kQ==
65jM2pKJ8EIST04=
I3+JoYVgYgDiv3O15Ntvw0On/sJroMK4kQ==
C+YhNzH20aCpy8MqVw==
yBZRl4HdPn+RHtoXXQ==
pGQATg0mMfntSBR9c4q5ow==
YUKFixIRdKYr
Hv+C4cZTOMAKV+/dArpX
MVW+PJpyCVA=
FX2AJYBFYbgk
/cX1CsjSpvU+
fWoThWagDVhBHt4yMjWQifM=
/vCd69xrS8QwuCt/yD8=
GvAsSzbCRxplG582TKzVug==
S6zlGfJ6DFc4TBNUvig=
k0z/QwnTpfR/kS5e
KPofKfkPcoRqxowFuWWNhvM=
Xrj+JvENc3yBln4OUw==
ScTatpYj/IKRHtoXXQ==
vLRdwbLyTpzFn+dAR93xvg==
mLTJe/eFp2kxl69W
Cbr5/dRQbio2P/e8ay0aff0=
xooviWn51V7DI7mMOwWT4lCIJUlf
l0t7fTmLqSCAuIYIVA==
06xFejwYMSkbfETTiNT21O0=
bWzTF+1nS4kxlydW
madamkikkiey.net

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4996 set thread context of 3808	4996	SecuriteInfo.com.Win32.PWSX-gen.2588.21949.exe	90

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3808	SecuriteInfo.com.Win32.PWSX-gen.2588.21949.exe
3808	SecuriteInfo.com.Win32.PWSX-gen.2588.21949.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 3808	4996	SecuriteInfo.com.Win32.PWSX-gen.2588.21949.exe	90
PID 4996 wrote to memory of 3808	4996	SecuriteInfo.com.Win32.PWSX-gen.2588.21949.exe	90
PID 4996 wrote to memory of 3808	4996	SecuriteInfo.com.Win32.PWSX-gen.2588.21949.exe	90
PID 4996 wrote to memory of 3808	4996	SecuriteInfo.com.Win32.PWSX-gen.2588.21949.exe	90
PID 4996 wrote to memory of 3808	4996	SecuriteInfo.com.Win32.PWSX-gen.2588.21949.exe	90
PID 4996 wrote to memory of 3808	4996	SecuriteInfo.com.Win32.PWSX-gen.2588.21949.exe	90

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.2588.21949.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.2588.21949.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.2588.21949.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.2588.21949.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3808

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3808-138-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3808-141-0x0000000000401000-0x000000000042F000-memory.dmp

Download

memory/3808-140-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3808-142-0x0000000001520000-0x000000000186A000-memory.dmp

Download

memory/3808-143-0x0000000001520000-0x000000000186A000-memory.dmp

Download

memory/4996-132-0x00000000000F0000-0x000000000019C000-memory.dmp

Download

memory/4996-133-0x00000000051F0000-0x0000000005794000-memory.dmp

Download

memory/4996-134-0x0000000004B90000-0x0000000004C22000-memory.dmp

Download

memory/4996-135-0x0000000004B20000-0x0000000004B2A000-memory.dmp

Download

memory/4996-136-0x0000000005B10000-0x0000000005BAC000-memory.dmp

Download