Analysis
-
max time kernel
44s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
-
submitted
08-12-2022 09:38
General
-
Target
SecuriteInfo.com.Win32.RATX-gen.2018.30304.exe
-
Size
946KB
-
MD5
591e345ed1a7fa929b80cce8790e460f
-
SHA1
9992eadbc531dce1185f22b360410cbd11bd1989
-
SHA256
663d25f6a1e39bebdacdb5164e441faaa4466a00ed636b360c1d981a5f92c5d8
-
SHA512
f765de77da52cb578a3a2a7ab0f3d8a34baa96db982f972dbe3bead73e418992ea5bf018b3619556ef83a9d05342b7c176579982fd017b9eeee3c75269dd7863
-
SSDEEP
24576:sqndl9aebRk+T7CYWL1wCE7HuzsthZmBHG:Ld3pbq+nnWL1w3TTthSH
Malware Config
Extracted
formbook
4.1
ndgi
vuicotvxrejp3il.xyz
w3fa6.net
sappuno02.com
konstruksirumah.xyz
usalifehealth.com
and1f.xyz
atenmentfstinfdow.beauty
primepipe.net
roundhouseny.com
alexandermcqueen.icu
transporteavalos.com
spankmetaverse.xyz
jhccowholesale.com
bielefeldgebaeudereinigung.com
saintraphaelschool.com
larifaa.online
dejabrew.info
izabelaeraphael.com
granniestoneet.com
greensourceseed.com
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.2018.30304.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.2018.30304.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.2018.30304.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.2018.30304.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
968KB
-
Filesize
8KB
-
Filesize
136KB
-
Filesize
56KB
-
Filesize
448KB
-
Filesize
208KB
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
188KB
-
-
Filesize
3.0MB