formbook | 35e53fdc9e554c33ffa134b23eb74b04b2bc07a2eaca797f4af2e467979eb34d

Analysis

max time kernel
43s
max time network
30s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
05/07/2023, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Win32.PWSX-gen.21818.32445.exe
Size 620KB
Sample230705-e3netsca8v
SHA256 35e53fdc9e554c33ffa134b23eb74b04b2bc07a2eaca797f4af2e467979eb34d
MD5 cb95bd3e75320744ed90c83c6dc9ef68
SHA1 81b6d6567d3d9dfa0b82633c4b7fe48abf7012c7
SHA512 2c8c3b730541e9bee34e3d18f130f0d485dd7f23ae2b6d79ef0ba43ae5f5b5f7d430ad653c519f4200b6be2b5eeab8562f3e875d4def26b2a83b79315209421e
SSDEEP 12288:1SHCcDGsYqNfQbi8CaPGIogjH5mhMlWPQmR2Qd+yY:AHCBqNIibaZREhMDMd+J
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook jy95 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

jy95

Decoy

do-si-dough.com
cchapmanganato.com
04it.icu
kawebdesign.site
oasisconnects.com
op091.com
psychicstandupcomedy.com
harveylee.online
x55568.com
orbinlopez.one
45745931.buzz
undiereleaseco.com
cludybot.net
sailtmtbar.com
siennashih.com
premintxyz.net
xn--bj4bt9j.com
giornalaiditalia.com
colorfullemonade.com
baddiebearz.com
xbkgstd.top
codecultr.com
muenols.xyz
creditors.online
xn--tecnologahbrida-cpbc.com
gotmot.com
physiowithamina.com
smartshoppinghub.store
magis-bo.com
ebayqerbaf.top
hospitalmode.com
strydasoles.store
savvieseller.com
arketha.com
biotherm159.online
fiveclost.sbs
nicholasthemarketer.com
coinpod.app
kassel-strafrecht.com
bbcbcb555.online
voxlinx.online
afm.ventures
yiniao.site
mrsmacksshortbread.com
crashcoursechatgpt.com
fetus.fun
forumconstructioninc.com
finanzas1.com
ussinners.com
conservingjudaism.live
surferscompass.com
blacklifecoachcompany.com
awadhsamachar.com
geektechtalks.com
cryptubank.accountants
hzqywzhs.com
kendradoggrooming.com
isbuae.com
taiyienergyhealing.com
oficial-site-promocao.com
parfermelha.store
digitalshop.biz
crackmyway.com
bretanastore.com
sassnass.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/3056-63-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1384 set thread context of 3056	1384	SecuriteInfo.com.Win32.PWSX-gen.21818.32445.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3056	SecuriteInfo.com.Win32.PWSX-gen.21818.32445.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 3056	1384	SecuriteInfo.com.Win32.PWSX-gen.21818.32445.exe	28
PID 1384 wrote to memory of 3056	1384	SecuriteInfo.com.Win32.PWSX-gen.21818.32445.exe	28
PID 1384 wrote to memory of 3056	1384	SecuriteInfo.com.Win32.PWSX-gen.21818.32445.exe	28
PID 1384 wrote to memory of 3056	1384	SecuriteInfo.com.Win32.PWSX-gen.21818.32445.exe	28
PID 1384 wrote to memory of 3056	1384	SecuriteInfo.com.Win32.PWSX-gen.21818.32445.exe	28
PID 1384 wrote to memory of 3056	1384	SecuriteInfo.com.Win32.PWSX-gen.21818.32445.exe	28
PID 1384 wrote to memory of 3056	1384	SecuriteInfo.com.Win32.PWSX-gen.21818.32445.exe	28

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.21818.32445.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.21818.32445.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.21818.32445.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.21818.32445.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1384-54-0x0000000000D10000-0x0000000000DB2000-memory.dmp

Download

memory/1384-55-0x0000000000520000-0x0000000000560000-memory.dmp

Download

memory/1384-56-0x0000000000510000-0x000000000051C000-memory.dmp

Download

memory/1384-57-0x0000000000520000-0x0000000000560000-memory.dmp

Download

memory/1384-58-0x0000000000570000-0x000000000057C000-memory.dmp

Download

memory/1384-59-0x0000000004CF0000-0x0000000004D5E000-memory.dmp

Download

memory/3056-60-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3056-61-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3056-62-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/3056-63-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3056-64-0x0000000000870000-0x0000000000B73000-memory.dmp

Download