Overview

overview

10

Static

static

3

SecuriteIn...74.exe

windows7-x64

10

SecuriteIn...74.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    50s
  • max time network
    31s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    07-05-2023 09:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Variant.Barys.351838.17619.24374.exe

  • Size

    723KB

  • MD5

    487997704058f564b7516350315707f2

  • SHA1

    d44ef4767a7371c41c5738cf9c62a2e095dc5c70

  • SHA256

    61141d9453d13d203de8255903f1aec9fea4906616f000cca0b906a58d754cca

  • SHA512

    b21c9a7a30c602f56f6b66f45fbb8ba692dd8f82ce016117b8d59aacae2e81af7cc6154dc3f33e689e9661ac960a32898b7f10fd158ba77f0dc25b34b4747b7b

  • SSDEEP

    12288:wPOcW3TTaobLPsEfwrJ4SjHdr7O8ezsoKUgAyWCl8x+Y:wPOXzPsEfwDj9OF3T1Cl8AY

Score
10/10
formbookgtt8ratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

gtt8

Decoy

thesuccessbot.com

rittercivil.com

jt1.fun

d365extension.com

quqoxeq.top

visittworiverswi.com

bfprotienda.com

greenhabitsph.com

ladmere.com

clockboutiques.com

minwart.xyz

xinyuejiancai.online

eggsl.com

fetchingcandles.com

skywatiniya.com

hinkley.news

realityonlineenterprises.com

teamcroissant.com

esfera-pv.ch

herdadedosmontesbastos.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook
  • Formbook payload 1 IoCs
    rat
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Barys.351838.17619.24374.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Barys.351838.17619.24374.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1300
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Barys.351838.17619.24374.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Barys.351838.17619.24374.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:1028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1028-61-0x0000000000400000-0x000000000042F000-memory.dmp
    Filesize

    188KB

    Download
  • memory/1028-62-0x0000000000400000-0x000000000042F000-memory.dmp
    Filesize

    188KB

    Download
  • memory/1028-63-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1028-64-0x0000000000400000-0x000000000042F000-memory.dmp
    Filesize

    188KB

    Download
  • memory/1028-65-0x00000000008F0000-0x0000000000BF3000-memory.dmp
    Filesize

    3.0MB

    Download
  • memory/1300-54-0x0000000001310000-0x00000000013CC000-memory.dmp
    Filesize

    752KB

    Download
  • memory/1300-55-0x0000000004E00000-0x0000000004E40000-memory.dmp
    Filesize

    256KB

    Download
  • memory/1300-56-0x0000000000290000-0x00000000002A2000-memory.dmp
    Filesize

    72KB

    Download
  • memory/1300-57-0x0000000004E00000-0x0000000004E40000-memory.dmp
    Filesize

    256KB

    Download
  • memory/1300-58-0x00000000002B0000-0x00000000002BC000-memory.dmp
    Filesize

    48KB

    Download
  • memory/1300-59-0x0000000007FF0000-0x0000000008076000-memory.dmp
    Filesize

    536KB

    Download
  • memory/1300-60-0x0000000000C00000-0x0000000000C4E000-memory.dmp
    Filesize

    312KB

    Download