formbook | 14ac214aee66557d77577da7211f5fa6476753b38ff8b40738c660a88c8ffd35

Analysis

max time kernel
43s
max time network
32s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
07/07/2023, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Win32.PWSX-gen.29568.1554.exe
Size 693KB
Sample230707-e3netsgd2y
SHA256 14ac214aee66557d77577da7211f5fa6476753b38ff8b40738c660a88c8ffd35
MD5 ddf0bc0858e70faa7fb6999894f79451
SHA1 e70a7b7acf9a69a5eeac2950020e0113879f9369
SHA512 ea9fbac73852e916f5c2771c0a077edf4128cbb2c22637ed27e45c1c633d61dc78fb73517903426c3dd76d3f7129e55b590dbe9134505490c03ad59758981d69
SSDEEP 6144:Wp6IiHkwkXyu0WxTpRJr07RWTIxvQqqEPgraUYLaauPpzFpxST1hnDqQSPY1nEUo:HkT52UTjqxPgraTspFL0DqQSuEgvy
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook he2a rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

he2a

Decoy

connectioncompass.store
zekicharge.com
dp77.shop
guninfo.guru
mamaeconomics.net
narcisme.coach
redtopassociates.com
ezezn.com
theoregondog.com
pagosmultired.online
emsculptcenterofne.com
meet-friends.online
pf326.com
wealthjigsaw.xyz
arsajib.com
kickassholdings.online
avaturre.biz
dtslogs.com
lb92.tech
pittalam.com
cyberlegion.group
24eu-ru-startup.xyz
theaustralianbrisketboard.com
bavrnimn.site
xn--groupe-gorg-lbb.com
hg08139.com
myjbtest.net
cyg8wm3zfb.xyz
mimi2023.monster
ruixiangg.com
smokintires.net
out-boundlabs.net
matrix-promotions.com
botfolk.com
6o20r.beauty
cpohlelaw.com
zamupoi.fun
eletrobrasilvendas.com
desire-dating.com
678ap.com
bioprost.club
hfaer4.xyz
yuwangjing.com
359brigham.com
misstamar.mobi
lucasbrownviolinstudio.com
mybet668.com
giuila.online
mathews.buzz
dcmdot.com
epeople.store
totneshotdesk.com
jaehub.com
notbokin.online
trongiv.xyz
adept-expert-comptable.net
4tvaccounting.com
saledotfate.live
canadiantrafficmanagement.net
oktravelhi.com
taylorranchtrail.com
tempahwebsites.com
b-store.shop
paintellensburg.com
qfs-capital.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/1580-62-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2396 set thread context of 1580	2396	SecuriteInfo.com.Win32.PWSX-gen.29568.1554.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1580	SecuriteInfo.com.Win32.PWSX-gen.29568.1554.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 1580	2396	SecuriteInfo.com.Win32.PWSX-gen.29568.1554.exe	28
PID 2396 wrote to memory of 1580	2396	SecuriteInfo.com.Win32.PWSX-gen.29568.1554.exe	28
PID 2396 wrote to memory of 1580	2396	SecuriteInfo.com.Win32.PWSX-gen.29568.1554.exe	28
PID 2396 wrote to memory of 1580	2396	SecuriteInfo.com.Win32.PWSX-gen.29568.1554.exe	28
PID 2396 wrote to memory of 1580	2396	SecuriteInfo.com.Win32.PWSX-gen.29568.1554.exe	28
PID 2396 wrote to memory of 1580	2396	SecuriteInfo.com.Win32.PWSX-gen.29568.1554.exe	28
PID 2396 wrote to memory of 1580	2396	SecuriteInfo.com.Win32.PWSX-gen.29568.1554.exe	28

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.29568.1554.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.29568.1554.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.29568.1554.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.29568.1554.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1580

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1580-59-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1580-60-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1580-61-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/1580-62-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1580-63-0x0000000000910000-0x0000000000C13000-memory.dmp

Download

memory/2396-54-0x0000000001200000-0x00000000012B2000-memory.dmp

Download

memory/2396-55-0x0000000000640000-0x0000000000680000-memory.dmp

Download

memory/2396-56-0x0000000000390000-0x000000000039C000-memory.dmp

Download

memory/2396-57-0x0000000000560000-0x000000000056C000-memory.dmp

Download

memory/2396-58-0x0000000005010000-0x000000000507E000-memory.dmp

Download