formbook | 14ac214aee66557d77577da7211f5fa6476753b38ff8b40738c660a88c8ffd35

Analysis

max time kernel
127s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
07/07/2023, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Win32.PWSX-gen.29568.1554.exe
Size 693KB
Sample230707-e3netsgd2y
SHA256 14ac214aee66557d77577da7211f5fa6476753b38ff8b40738c660a88c8ffd35
MD5 ddf0bc0858e70faa7fb6999894f79451
SHA1 e70a7b7acf9a69a5eeac2950020e0113879f9369
SHA512 ea9fbac73852e916f5c2771c0a077edf4128cbb2c22637ed27e45c1c633d61dc78fb73517903426c3dd76d3f7129e55b590dbe9134505490c03ad59758981d69
SSDEEP 6144:Wp6IiHkwkXyu0WxTpRJr07RWTIxvQqqEPgraUYLaauPpzFpxST1hnDqQSPY1nEUo:HkT52UTjqxPgraTspFL0DqQSuEgvy
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook he2a rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

he2a

Decoy

connectioncompass.store
zekicharge.com
dp77.shop
guninfo.guru
mamaeconomics.net
narcisme.coach
redtopassociates.com
ezezn.com
theoregondog.com
pagosmultired.online
emsculptcenterofne.com
meet-friends.online
pf326.com
wealthjigsaw.xyz
arsajib.com
kickassholdings.online
avaturre.biz
dtslogs.com
lb92.tech
pittalam.com
cyberlegion.group
24eu-ru-startup.xyz
theaustralianbrisketboard.com
bavrnimn.site
xn--groupe-gorg-lbb.com
hg08139.com
myjbtest.net
cyg8wm3zfb.xyz
mimi2023.monster
ruixiangg.com
smokintires.net
out-boundlabs.net
matrix-promotions.com
botfolk.com
6o20r.beauty
cpohlelaw.com
zamupoi.fun
eletrobrasilvendas.com
desire-dating.com
678ap.com
bioprost.club
hfaer4.xyz
yuwangjing.com
359brigham.com
misstamar.mobi
lucasbrownviolinstudio.com
mybet668.com
giuila.online
mathews.buzz
dcmdot.com
epeople.store
totneshotdesk.com
jaehub.com
notbokin.online
trongiv.xyz
adept-expert-comptable.net
4tvaccounting.com
saledotfate.live
canadiantrafficmanagement.net
oktravelhi.com
taylorranchtrail.com
tempahwebsites.com
b-store.shop
paintellensburg.com
qfs-capital.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/4960-140-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3556 set thread context of 4960	3556	SecuriteInfo.com.Win32.PWSX-gen.29568.1554.exe	83

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4960	SecuriteInfo.com.Win32.PWSX-gen.29568.1554.exe
4960	SecuriteInfo.com.Win32.PWSX-gen.29568.1554.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3556 wrote to memory of 4960	3556	SecuriteInfo.com.Win32.PWSX-gen.29568.1554.exe	83
PID 3556 wrote to memory of 4960	3556	SecuriteInfo.com.Win32.PWSX-gen.29568.1554.exe	83
PID 3556 wrote to memory of 4960	3556	SecuriteInfo.com.Win32.PWSX-gen.29568.1554.exe	83
PID 3556 wrote to memory of 4960	3556	SecuriteInfo.com.Win32.PWSX-gen.29568.1554.exe	83
PID 3556 wrote to memory of 4960	3556	SecuriteInfo.com.Win32.PWSX-gen.29568.1554.exe	83
PID 3556 wrote to memory of 4960	3556	SecuriteInfo.com.Win32.PWSX-gen.29568.1554.exe	83

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.29568.1554.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.29568.1554.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3556
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.29568.1554.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.29568.1554.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3556-133-0x00000000000D0000-0x0000000000182000-memory.dmp

Download

memory/3556-134-0x00000000050F0000-0x0000000005694000-memory.dmp

Download

memory/3556-135-0x0000000004BE0000-0x0000000004C72000-memory.dmp

Download

memory/3556-136-0x0000000000D50000-0x0000000000D60000-memory.dmp

Download

memory/3556-137-0x0000000004B40000-0x0000000004B4A000-memory.dmp

Download

memory/3556-138-0x0000000000D50000-0x0000000000D60000-memory.dmp

Download

memory/3556-139-0x000000000A290000-0x000000000A32C000-memory.dmp

Download

memory/4960-140-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4960-142-0x0000000001AB0000-0x0000000001DFA000-memory.dmp

Download