formbook | 249eaf070dfdfb8a8cdc2487a960ee487bafca7c385750f73579eb5ea6dc1997

Analysis

max time kernel
45s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/01/2023, 22:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Win32.MalwareX-gen.25622.30312.exe
Size 966KB
Sample230111-2fcfdaae2z
SHA256 249eaf070dfdfb8a8cdc2487a960ee487bafca7c385750f73579eb5ea6dc1997
MD5 03d21df7515d1156bbd82ff63c51035a
SHA1 7228b8c608cd025226a0e06143770a7e2a433d2b
SHA512 858cd0b87f2223bdd265c63ad761ffebf8ba69632cd3e845c60f09ac8487fb2cead59fa3a1820397a70a90e7bd26cc7de23164334f40ca54a40c6bd8cc31456f
SSDEEP 24576:i70v05KPCJzmcvWNrJrYTSKIKTn6AL5x:u5K6mFNd
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook g44n rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

g44n

Decoy

t60gB4YRvsDLttd9HG4=
xck8G7COQ+g7VIpX
BQQF3mmpLPskhQ==
eLWwmzNyK6ee+nF1jDvvkxuSGA==
3tlgNOzw8BBjpNOQMnc=
nOpNEJhoU0h+00S9E1YfgA==
xcvTpljkjIyEdvhp+VcGFtJC
bZxOHr5CtzY4
rOD304X0u1DN/m7cbA==
Knixl0HJyEOOiNckwk8GFtJC
S4JMDRNTUAol
Vp9wSwNZSfY7VIpX
0Nf/zlrpmpahnM+tpkYGFtJC
joXsuHiBcVp88DHEHMA7
yN8i9ppoZYHSSaqqk6NZnQ==
4UFEMfyKhSB4UovzjdabqolwhFtMH1M=
d3RiRcXCeR8wlgjEHMA7
eMUS8PSBPCe2rPg=
LCsR0X328UuSAmlf
/keifSXopayqjLt1EWQ=
x8Hdn0pOACh11lPPYXo=
NXkuHKtxYYAXG3hA
d5dE59banPxMmA==
0vJUL/UPu1HN/m7cbA==
cG3LiYu7/OkmhQ==
kcFYNbltO4XkzzLEHMA7
c3now24l3wQX9EW8E1YfgA==
6kE4FbVNNTmvwBldAWY=
KzTXxYN5AlmUlfA=
pN03EpAPvdoG3td9HG4=
HFxFE8xVAzYdmOSoxIRGsGfPrq2RWw==
QKMj+KSybRYojwTEHMA7
PYRSDRNTUAol
OU/wwlhkGLrLFHx6Y4tNmQ==
5SOc+gRCtzY4
Wpm/fyDn4/3+CVe5E1YfgA==
dYOdeSmnq2BbpQLEHMA7
5vBBzXlHCp/yEEZBRKetUjQ52IU0yTJk
bbmih0CBPMgoE2DLXmVpeGo=
4S2wkRvbxeLo00C8WmVpeGo=
uECyFReWXAol
jNu+mzKEhkrN/m7cbA==
4gAT76Z35fIJDFm5E1YfgA==
qADJh1HW2aS+D2Q1E1YfgA==
dcvSv2utZ/AJgMdevpFTnQ==
JTfVqz447pqn6T42UST9jGfPrq2RWw==
iY+7qTKHfAfwUMO7yWj3my2YHA==
WmeZXSgwNX67nd5C2U4GFtJC
7P/CoUpIP1lWSI3ch/yAAIOwONni
5+eJT9fhjh9hv9+SMWw=
Y3Z/PQTQl7DjzUC9SmVpeGo=
EiBDCpcTF6v40SzEHMA7
P2sC6LDSgQA7VIpX
5eWOfxDRj6Pp4VDbY2VpeGo=
dsEE1oKWIEAv
Ua2MVQydVIHU0DXEHMA7
hNkQ540Z0sNCG25K
b4tOMMbN0uY5lt+32djuHPtxAw==
teuvevj8CyJw4EUsE1YfgA==
tNsZ75ZlU1WpFoCBm1RaVsvskzc=
aLsI8IQZ0uL0yNd9HG4=
RUPKsWJ0gHa5LI2Nj0P5cFDOnsZ1AC62uw==
P5f+1WAqKEOSIzw7ZA==
Mdxb0fR4Aa8Zdu8=
carolinerosenstein.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 988 set thread context of 2004	988	SecuriteInfo.com.Win32.MalwareX-gen.25622.30312.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2004	SecuriteInfo.com.Win32.MalwareX-gen.25622.30312.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 988 wrote to memory of 2004	988	SecuriteInfo.com.Win32.MalwareX-gen.25622.30312.exe	27
PID 988 wrote to memory of 2004	988	SecuriteInfo.com.Win32.MalwareX-gen.25622.30312.exe	27
PID 988 wrote to memory of 2004	988	SecuriteInfo.com.Win32.MalwareX-gen.25622.30312.exe	27
PID 988 wrote to memory of 2004	988	SecuriteInfo.com.Win32.MalwareX-gen.25622.30312.exe	27
PID 988 wrote to memory of 2004	988	SecuriteInfo.com.Win32.MalwareX-gen.25622.30312.exe	27
PID 988 wrote to memory of 2004	988	SecuriteInfo.com.Win32.MalwareX-gen.25622.30312.exe	27
PID 988 wrote to memory of 2004	988	SecuriteInfo.com.Win32.MalwareX-gen.25622.30312.exe	27

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.MalwareX-gen.25622.30312.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.MalwareX-gen.25622.30312.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:988
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.MalwareX-gen.25622.30312.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.MalwareX-gen.25622.30312.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/988-54-0x00000000008D0000-0x00000000009C8000-memory.dmp

Download

memory/988-55-0x0000000075021000-0x0000000075023000-memory.dmp

Download

memory/988-56-0x00000000004C0000-0x00000000004D6000-memory.dmp

Download

memory/988-57-0x00000000005D0000-0x00000000005DA000-memory.dmp

Download

memory/988-58-0x0000000005AB0000-0x0000000005B34000-memory.dmp

Download

memory/988-59-0x0000000004880000-0x00000000048CA000-memory.dmp

Download

memory/2004-60-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2004-61-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2004-63-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2004-66-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2004-67-0x0000000000401000-0x000000000042F000-memory.dmp

Download

memory/2004-68-0x0000000000B60000-0x0000000000E63000-memory.dmp

Download