Overview

overview

10

Static

static

SecuriteIn...12.exe

windows7-x64

10

SecuriteIn...12.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    62s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/01/2023, 22:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    SecuriteInfo.com.Win32.MalwareX-gen.25622.30312.exe
  • Size 966KB
  • Sample230111-2fcfdaae2z
  • SHA256 249eaf070dfdfb8a8cdc2487a960ee487bafca7c385750f73579eb5ea6dc1997
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookg44nratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Campaign

  • g44n

Decoy

  • t60gB4YRvsDLttd9HG4=

  • xck8G7COQ+g7VIpX

  • BQQF3mmpLPskhQ==

  • eLWwmzNyK6ee+nF1jDvvkxuSGA==

  • 3tlgNOzw8BBjpNOQMnc=

  • nOpNEJhoU0h+00S9E1YfgA==

  • xcvTpljkjIyEdvhp+VcGFtJC

  • bZxOHr5CtzY4

  • rOD304X0u1DN/m7cbA==

  • Knixl0HJyEOOiNckwk8GFtJC

  • S4JMDRNTUAol

  • Vp9wSwNZSfY7VIpX

  • 0Nf/zlrpmpahnM+tpkYGFtJC

  • joXsuHiBcVp88DHEHMA7

  • yN8i9ppoZYHSSaqqk6NZnQ==

  • 4UFEMfyKhSB4UovzjdabqolwhFtMH1M=

  • d3RiRcXCeR8wlgjEHMA7

  • eMUS8PSBPCe2rPg=

  • LCsR0X328UuSAmlf

  • /keifSXopayqjLt1EWQ=

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.MalwareX-gen.25622.30312.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.MalwareX-gen.25622.30312.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3608
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.MalwareX-gen.25622.30312.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.MalwareX-gen.25622.30312.exe"
      2⤵
        PID:4140
      • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.MalwareX-gen.25622.30312.exe
        "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.MalwareX-gen.25622.30312.exe"
        2⤵
          PID:1300
        • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.MalwareX-gen.25622.30312.exe
          "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.MalwareX-gen.25622.30312.exe"
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2620

      Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            memory/2620-140-0x0000000000400000-0x000000000042F000-memory.dmp
            Download

            memory/2620-144-0x0000000001850000-0x0000000001B9A000-memory.dmp
            Download

            memory/2620-143-0x0000000000401000-0x000000000042F000-memory.dmp
            Download

            memory/2620-142-0x0000000000400000-0x000000000042F000-memory.dmp
            Download

            memory/3608-132-0x0000000000220000-0x0000000000318000-memory.dmp
            Download

            memory/3608-133-0x00000000053C0000-0x0000000005964000-memory.dmp
            Download

            memory/3608-134-0x0000000004CB0000-0x0000000004D42000-memory.dmp
            Download

            memory/3608-135-0x0000000004CA0000-0x0000000004CAA000-memory.dmp
            Download

            memory/3608-136-0x00000000086E0000-0x000000000877C000-memory.dmp
            Download