formbook | 2cea4635be71ebe2ff0d26948adfd11d7b8a945bce7ac4d459435f777bc4bf22

Analysis

max time kernel
99s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
29/06/2023, 08:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Win32.PWSX-gen.23331.23869.exe
Size 682KB
Sample230629-kd568scd96
SHA256 2cea4635be71ebe2ff0d26948adfd11d7b8a945bce7ac4d459435f777bc4bf22
MD5 f600ebb3137a4895dfbc6e25c52e9c66
SHA1 7352188730f2bb56ca6dc5b9a45b8647f2f356f4
SHA512 6a87b441ea77b9cd63bb6e3c06fe7edb7c23231de92ae6f1290f109aeb9604dcb28320ffdb274f6e93a0baa052e51c115fb335254e90eab4b80fb97c8924b418
SSDEEP 12288:FVp0K8s6owpD0wKG0ZuHSAQI6kil0ndh3t2rKVdZMtbGMfX:FVp0K8s6owpDP0ASAB6pW3t+KtMtV
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook jy95 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

jy95

Decoy

do-si-dough.com
cchapmanganato.com
04it.icu
kawebdesign.site
oasisconnects.com
op091.com
psychicstandupcomedy.com
harveylee.online
x55568.com
orbinlopez.one
45745931.buzz
undiereleaseco.com
cludybot.net
sailtmtbar.com
siennashih.com
premintxyz.net
xn--bj4bt9j.com
giornalaiditalia.com
colorfullemonade.com
baddiebearz.com
xbkgstd.top
codecultr.com
muenols.xyz
creditors.online
xn--tecnologahbrida-cpbc.com
gotmot.com
physiowithamina.com
smartshoppinghub.store
magis-bo.com
ebayqerbaf.top
hospitalmode.com
strydasoles.store
savvieseller.com
arketha.com
biotherm159.online
fiveclost.sbs
nicholasthemarketer.com
coinpod.app
kassel-strafrecht.com
bbcbcb555.online
voxlinx.online
afm.ventures
yiniao.site
mrsmacksshortbread.com
crashcoursechatgpt.com
fetus.fun
forumconstructioninc.com
finanzas1.com
ussinners.com
conservingjudaism.live
surferscompass.com
blacklifecoachcompany.com
awadhsamachar.com
geektechtalks.com
cryptubank.accountants
hzqywzhs.com
kendradoggrooming.com
isbuae.com
taiyienergyhealing.com
oficial-site-promocao.com
parfermelha.store
digitalshop.biz
crackmyway.com
bretanastore.com
sassnass.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/1736-140-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3208 set thread context of 1736	3208	SecuriteInfo.com.Win32.PWSX-gen.23331.23869.exe	100

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1736	SecuriteInfo.com.Win32.PWSX-gen.23331.23869.exe
1736	SecuriteInfo.com.Win32.PWSX-gen.23331.23869.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3208 wrote to memory of 1736	3208	SecuriteInfo.com.Win32.PWSX-gen.23331.23869.exe	100
PID 3208 wrote to memory of 1736	3208	SecuriteInfo.com.Win32.PWSX-gen.23331.23869.exe	100
PID 3208 wrote to memory of 1736	3208	SecuriteInfo.com.Win32.PWSX-gen.23331.23869.exe	100
PID 3208 wrote to memory of 1736	3208	SecuriteInfo.com.Win32.PWSX-gen.23331.23869.exe	100
PID 3208 wrote to memory of 1736	3208	SecuriteInfo.com.Win32.PWSX-gen.23331.23869.exe	100
PID 3208 wrote to memory of 1736	3208	SecuriteInfo.com.Win32.PWSX-gen.23331.23869.exe	100

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.23331.23869.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.23331.23869.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3208
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.23331.23869.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.23331.23869.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1736-140-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1736-142-0x00000000013B0000-0x00000000016FA000-memory.dmp

Download

memory/3208-133-0x0000000000990000-0x0000000000A40000-memory.dmp

Download

memory/3208-134-0x0000000005900000-0x0000000005EA4000-memory.dmp

Download

memory/3208-135-0x00000000053F0000-0x0000000005482000-memory.dmp

Download

memory/3208-136-0x0000000005670000-0x000000000567A000-memory.dmp

Download

memory/3208-137-0x0000000005750000-0x00000000057EC000-memory.dmp

Download

memory/3208-138-0x0000000005680000-0x0000000005690000-memory.dmp

Download

memory/3208-139-0x0000000005680000-0x0000000005690000-memory.dmp

Download