formbook | 2106aa8235bc1e05d367bae1e65c50bf8d11c4b4106ceebde0f9307ffcf273c0

Analysis

max time kernel
91s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2022 03:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Win32.PWSX-gen.13411.23211.exe
Size

837KB
MD5

b185ab1a2b4309a489c658d5231c3ce8
SHA1

9e09ef7b618d841ba4fc0cc17d0a76a24acde115
SHA256

2106aa8235bc1e05d367bae1e65c50bf8d11c4b4106ceebde0f9307ffcf273c0
SHA512

bd15bc8fbbe262e1831b82841992409a8f9667b209fc9bbf257677b74833a71586ca3d516046f29f656709ef9ae822b6998dcb18cdc80de4630776406b9d1c8e
SSDEEP

12288:9cNhQ3udD6w4toeYw1Ctn4Na7dBNBNjma3gKZ/nXt7virmWhlGLaQYI:WNhHZ6wG7Yw1Ctn4NCF

Score

10^/10

formbook bmr1 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

bmr1

Decoy

q05YNsJC4MpYLGAf4A==

6KUzKCvwX0fwzrFQXvlucw==

KA4ZibW1w+hWN5Q=

TfgNq18tIWtsM7h+DexncQ==

zspNqjUKBdJVHTkiMMXJYeF7G53bVvMPoA==

hopQr+b8KzPIbMWvw0Yxir6cyw==

2thmt+17FR/MVsakbM/+w3xGOhopJw==

5gO5gfA6jwna/4FNSPqrvvHyr2A=

kqtr0wr9KaOXVMyDDexncQ==

PNldyz0Boa5cLGAf4A==

Gysor7fqabd0UzTwWp3Zir6cyw==

pMRgV18gtLorB21prX4=

ukpf+vu2u+hWN5Q=

pcS/rO+KmPMj69G9cMHnoSEm59cbIQ==

4fWGzv347bFNDYJeeIHKG5co

WXlRyM2Yn+4Ab1EgRAFHWdGDCzf1

ZPoM+2U1cwMzteOBsHY=

o8jQoNron4sT3A/KomE=

7QX8tTpv/A+YKw==

wFvmV8SY/A+YKw==

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

SecuriteInfo.com.Win32.PWSX-gen.13411.23211.exe

description	pid	process	target process
PID 5064 set thread context of 4632	5064	SecuriteInfo.com.Win32.PWSX-gen.13411.23211.exe	SecuriteInfo.com.Win32.PWSX-gen.13411.23211.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

SecuriteInfo.com.Win32.PWSX-gen.13411.23211.exe

pid process

4632 SecuriteInfo.com.Win32.PWSX-gen.13411.23211.exe
4632 SecuriteInfo.com.Win32.PWSX-gen.13411.23211.exe

pid	process
4632	SecuriteInfo.com.Win32.PWSX-gen.13411.23211.exe
4632	SecuriteInfo.com.Win32.PWSX-gen.13411.23211.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

SecuriteInfo.com.Win32.PWSX-gen.13411.23211.exe

description	pid	process	target process
PID 5064 wrote to memory of 4632	5064	SecuriteInfo.com.Win32.PWSX-gen.13411.23211.exe	SecuriteInfo.com.Win32.PWSX-gen.13411.23211.exe
PID 5064 wrote to memory of 4632	5064	SecuriteInfo.com.Win32.PWSX-gen.13411.23211.exe	SecuriteInfo.com.Win32.PWSX-gen.13411.23211.exe
PID 5064 wrote to memory of 4632	5064	SecuriteInfo.com.Win32.PWSX-gen.13411.23211.exe	SecuriteInfo.com.Win32.PWSX-gen.13411.23211.exe
PID 5064 wrote to memory of 4632	5064	SecuriteInfo.com.Win32.PWSX-gen.13411.23211.exe	SecuriteInfo.com.Win32.PWSX-gen.13411.23211.exe
PID 5064 wrote to memory of 4632	5064	SecuriteInfo.com.Win32.PWSX-gen.13411.23211.exe	SecuriteInfo.com.Win32.PWSX-gen.13411.23211.exe
PID 5064 wrote to memory of 4632	5064	SecuriteInfo.com.Win32.PWSX-gen.13411.23211.exe	SecuriteInfo.com.Win32.PWSX-gen.13411.23211.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.13411.23211.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.13411.23211.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5064

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.13411.23211.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.13411.23211.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4632-137-0x0000000000000000-mapping.dmp

Download
memory/4632-138-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4632-140-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4632-141-0x0000000000401000-0x000000000042F000-memory.dmp

Filesize
184KB

Download
memory/4632-142-0x0000000001500000-0x000000000184A000-memory.dmp

Filesize
3.3MB

Download
memory/5064-132-0x0000000000700000-0x00000000007D8000-memory.dmp

Filesize
864KB

Download
memory/5064-133-0x0000000005610000-0x0000000005BB4000-memory.dmp

Filesize
5.6MB

Download
memory/5064-134-0x0000000005160000-0x00000000051F2000-memory.dmp

Filesize
584KB

Download
memory/5064-135-0x0000000005210000-0x000000000521A000-memory.dmp

Filesize
40KB

Download
memory/5064-136-0x0000000007B50000-0x0000000007BEC000-memory.dmp

Filesize
624KB

Download