Overview

overview

10

Static

static

SecuriteIn...87.exe

windows7-x64

10

SecuriteIn...87.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    46s
  • max time network
    47s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    06-12-2022 00:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Win32.PWSX-gen.8040.31387.exe

  • Size

    626KB

  • MD5

    094fd52eec0055205bddc82c5f78ad87

  • SHA1

    c06a2da7c13bcebe40b4cd46d4afaaa856b0de95

  • SHA256

    dd7c962afea2752944885fdd3551a0a50fc3a58f676c1466f5fb71eda72d5a24

  • SHA512

    d2b87d9a99516041216c593aec1913d807b9771f60dcdc86918be55a8c686de99ad33bfd48cd7756394649da04a61e2d66f7d14fae4987104838bf968d97c592

  • SSDEEP

    12288:R3c1yxe16Rd0U5oMhZXomtfIQCXgncvEyCaM/dawm5ovZ7W/HgJepIQ:RGyxcY0UiMhZVtgmnc/Cb/dLHB7WvgM1

Score
10/10
formbookng04ratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ng04

Decoy

tevimaq.com

easterspecialtystore.com

smartlever.tech

10312.uk

tanjawiharbi.co.uk

471338.com

horusventure.com

empress-care.com

sinrian.com

465951.com

aemsti.com

nxcourier.com

stargatefarms.com

lalyquainvestment.com

dailysportsadvice.com

justlistmoore.com

stoneonroll.online

tatianakolomiets.com

barcodebbm.com

protectorship.world

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook
  • Formbook payload 2 IoCs
    rat
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.8040.31387.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.8040.31387.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1676
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.8040.31387.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.8040.31387.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1676-54-0x0000000001140000-0x00000000011E2000-memory.dmp
    Filesize

    648KB

    Download
  • memory/1676-55-0x0000000075E31000-0x0000000075E33000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1676-56-0x00000000048C0000-0x000000000497A000-memory.dmp
    Filesize

    744KB

    Download
  • memory/1676-57-0x00000000003F0000-0x000000000040A000-memory.dmp
    Filesize

    104KB

    Download
  • memory/1676-58-0x00000000002E0000-0x00000000002EE000-memory.dmp
    Filesize

    56KB

    Download
  • memory/1676-59-0x0000000007F60000-0x0000000007FDC000-memory.dmp
    Filesize

    496KB

    Download
  • memory/1676-60-0x0000000000AE0000-0x0000000000B22000-memory.dmp
    Filesize

    264KB

    Download
  • memory/2032-61-0x0000000000400000-0x000000000042F000-memory.dmp
    Filesize

    188KB

    Download
  • memory/2032-62-0x0000000000400000-0x000000000042F000-memory.dmp
    Filesize

    188KB

    Download
  • memory/2032-64-0x0000000000400000-0x000000000042F000-memory.dmp
    Filesize

    188KB

    Download
  • memory/2032-65-0x000000000041F020-mapping.dmp
    Download
  • memory/2032-66-0x0000000000920000-0x0000000000C23000-memory.dmp
    Filesize

    3.0MB

    Download