formbook | a02026fbb721304677f2b4d6f58d9171d5e411727f6b6c06a8a2ef1792f4c2a8

Analysis

max time kernel
78s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 09:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Win32.PWSX-gen.12433.11759.exe
Size

726KB
MD5

01b2c837cf80bb287651473932aa1817
SHA1

d2473afbeaa54f4d35b2f8a205f59efc476bc8fa
SHA256

a02026fbb721304677f2b4d6f58d9171d5e411727f6b6c06a8a2ef1792f4c2a8
SHA512

0795a9bf9866da6a102c9779862c06bebd41de6ea4597607062088037c5a3868f12caf0b415ef46fee22d47f06b50fe1b13a32bba6506bb4f290e6e71fe3aaf6
SSDEEP

12288:7wlKAqmomPZefhvhfIkQvP67euBFuJxofaaNSPZb+joGsVaPtqvyuv/7:aomxihNlSPoBFMcaCCZbAtscQF37

Score

10^/10

formbook asdo rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

asdo

Decoy

31/RFVD/FFkpCuo=

LS2evkT1Hf54yJ3A01ZhjLFKSw==

Dw25w8eoM4HRQ9T8YA==

F2rI9TgH1uCf

VOuuxD/qTPifG/QDJ76coQ==

9smUEHwvvAcD3rnTM3IZg7fh

k4RlZq6jXYrfEg==

1+E7QsiGloB8qoio4Oh/

dALS/H0nMg+jCtM1RpZ+

thNv9GMouDLIFvESJ76coQ==

Tc54uifIU66mck2hvrtXnVbp

cINUAYgiqlkpCuo=

ma2AwPyPmpxd2bPRMksak0T7uEg9kA==

RlMlYJ9UpFIz7dg1RpZ+

klG+mNmHrHcFhmZ12SNGhmN+0f6MaMs=

V/nT2VgHD+hito+tBumEzTyVl5g=

0Zto8FjseN7v8MAW6ZkZg7fh

gbGlkddlXYrfEg==

pymXGHouvjhnKg8+qD8bLcY=

VelU01Tk/+CzegtywL4=

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

SecuriteInfo.com.Win32.PWSX-gen.12433.11759.exe

description	pid	process	target process
PID 1932 set thread context of 1996	1932	SecuriteInfo.com.Win32.PWSX-gen.12433.11759.exe	SecuriteInfo.com.Win32.PWSX-gen.12433.11759.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

SecuriteInfo.com.Win32.PWSX-gen.12433.11759.exe

pid process

1996 SecuriteInfo.com.Win32.PWSX-gen.12433.11759.exe

pid	process
1996	SecuriteInfo.com.Win32.PWSX-gen.12433.11759.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

SecuriteInfo.com.Win32.PWSX-gen.12433.11759.exe

description	pid	process	target process
PID 1932 wrote to memory of 1996	1932	SecuriteInfo.com.Win32.PWSX-gen.12433.11759.exe	SecuriteInfo.com.Win32.PWSX-gen.12433.11759.exe
PID 1932 wrote to memory of 1996	1932	SecuriteInfo.com.Win32.PWSX-gen.12433.11759.exe	SecuriteInfo.com.Win32.PWSX-gen.12433.11759.exe
PID 1932 wrote to memory of 1996	1932	SecuriteInfo.com.Win32.PWSX-gen.12433.11759.exe	SecuriteInfo.com.Win32.PWSX-gen.12433.11759.exe
PID 1932 wrote to memory of 1996	1932	SecuriteInfo.com.Win32.PWSX-gen.12433.11759.exe	SecuriteInfo.com.Win32.PWSX-gen.12433.11759.exe
PID 1932 wrote to memory of 1996	1932	SecuriteInfo.com.Win32.PWSX-gen.12433.11759.exe	SecuriteInfo.com.Win32.PWSX-gen.12433.11759.exe
PID 1932 wrote to memory of 1996	1932	SecuriteInfo.com.Win32.PWSX-gen.12433.11759.exe	SecuriteInfo.com.Win32.PWSX-gen.12433.11759.exe
PID 1932 wrote to memory of 1996	1932	SecuriteInfo.com.Win32.PWSX-gen.12433.11759.exe	SecuriteInfo.com.Win32.PWSX-gen.12433.11759.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.12433.11759.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.12433.11759.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1932

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.12433.11759.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.12433.11759.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1996

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1932-54-0x0000000000120000-0x00000000001DA000-memory.dmp

Filesize
744KB

Download
memory/1932-55-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

Filesize
8KB

Download
memory/1932-56-0x00000000004B0000-0x00000000004CA000-memory.dmp

Filesize
104KB

Download
memory/1932-57-0x0000000000490000-0x000000000049E000-memory.dmp

Filesize
56KB

Download
memory/1932-58-0x0000000005A60000-0x0000000005AD8000-memory.dmp

Filesize
480KB

Download
memory/1932-59-0x0000000004910000-0x000000000494E000-memory.dmp

Filesize
248KB

Download
memory/1996-60-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1996-61-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1996-63-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1996-64-0x00000000004012B0-mapping.dmp

Download
memory/1996-66-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1996-67-0x0000000000401000-0x000000000042F000-memory.dmp

Filesize
184KB

Download
memory/1996-68-0x0000000000BC0000-0x0000000000EC3000-memory.dmp

Filesize
3.0MB

Download