formbook | 35e53fdc9e554c33ffa134b23eb74b04b2bc07a2eaca797f4af2e467979eb34d

Analysis

max time kernel
140s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2023, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Win32.PWSX-gen.21818.32445.exe
Size 620KB
Sample230705-e3netsca8v
SHA256 35e53fdc9e554c33ffa134b23eb74b04b2bc07a2eaca797f4af2e467979eb34d
MD5 cb95bd3e75320744ed90c83c6dc9ef68
SHA1 81b6d6567d3d9dfa0b82633c4b7fe48abf7012c7
SHA512 2c8c3b730541e9bee34e3d18f130f0d485dd7f23ae2b6d79ef0ba43ae5f5b5f7d430ad653c519f4200b6be2b5eeab8562f3e875d4def26b2a83b79315209421e
SSDEEP 12288:1SHCcDGsYqNfQbi8CaPGIogjH5mhMlWPQmR2Qd+yY:AHCBqNIibaZREhMDMd+J
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook jy95 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

jy95

Decoy

do-si-dough.com
cchapmanganato.com
04it.icu
kawebdesign.site
oasisconnects.com
op091.com
psychicstandupcomedy.com
harveylee.online
x55568.com
orbinlopez.one
45745931.buzz
undiereleaseco.com
cludybot.net
sailtmtbar.com
siennashih.com
premintxyz.net
xn--bj4bt9j.com
giornalaiditalia.com
colorfullemonade.com
baddiebearz.com
xbkgstd.top
codecultr.com
muenols.xyz
creditors.online
xn--tecnologahbrida-cpbc.com
gotmot.com
physiowithamina.com
smartshoppinghub.store
magis-bo.com
ebayqerbaf.top
hospitalmode.com
strydasoles.store
savvieseller.com
arketha.com
biotherm159.online
fiveclost.sbs
nicholasthemarketer.com
coinpod.app
kassel-strafrecht.com
bbcbcb555.online
voxlinx.online
afm.ventures
yiniao.site
mrsmacksshortbread.com
crashcoursechatgpt.com
fetus.fun
forumconstructioninc.com
finanzas1.com
ussinners.com
conservingjudaism.live
surferscompass.com
blacklifecoachcompany.com
awadhsamachar.com
geektechtalks.com
cryptubank.accountants
hzqywzhs.com
kendradoggrooming.com
isbuae.com
taiyienergyhealing.com
oficial-site-promocao.com
parfermelha.store
digitalshop.biz
crackmyway.com
bretanastore.com
sassnass.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/3052-140-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3616 set thread context of 3052	3616	SecuriteInfo.com.Win32.PWSX-gen.21818.32445.exe	94

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3052	SecuriteInfo.com.Win32.PWSX-gen.21818.32445.exe
3052	SecuriteInfo.com.Win32.PWSX-gen.21818.32445.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3616 wrote to memory of 3052	3616	SecuriteInfo.com.Win32.PWSX-gen.21818.32445.exe	94
PID 3616 wrote to memory of 3052	3616	SecuriteInfo.com.Win32.PWSX-gen.21818.32445.exe	94
PID 3616 wrote to memory of 3052	3616	SecuriteInfo.com.Win32.PWSX-gen.21818.32445.exe	94
PID 3616 wrote to memory of 3052	3616	SecuriteInfo.com.Win32.PWSX-gen.21818.32445.exe	94
PID 3616 wrote to memory of 3052	3616	SecuriteInfo.com.Win32.PWSX-gen.21818.32445.exe	94
PID 3616 wrote to memory of 3052	3616	SecuriteInfo.com.Win32.PWSX-gen.21818.32445.exe	94

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.21818.32445.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.21818.32445.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3616
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.21818.32445.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.21818.32445.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3052

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3052-140-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3052-142-0x0000000001100000-0x000000000144A000-memory.dmp

Download

memory/3616-133-0x00000000005B0000-0x0000000000652000-memory.dmp

Download

memory/3616-134-0x0000000005560000-0x0000000005B04000-memory.dmp

Download

memory/3616-135-0x0000000005050000-0x00000000050E2000-memory.dmp

Download

memory/3616-136-0x0000000005260000-0x0000000005270000-memory.dmp

Download

memory/3616-137-0x0000000005000000-0x000000000500A000-memory.dmp

Download

memory/3616-138-0x0000000005260000-0x0000000005270000-memory.dmp

Download

memory/3616-139-0x0000000008EB0000-0x0000000008F4C000-memory.dmp

Download