formbook | 3106ab616dc892b43c8d9c28a9fc9f83b3e4676b5e4e61dc0dd97bab8d6072e1

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
31/10/2023, 19:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Trojan.Inject4.59820.21926.10504.exe
Size

566KB
MD5

cd3ec269704050b2ef952e8d68d9e011
SHA1

c5fcc4e5d9936dd28b13d81dd8f51bcdab294f94
SHA256

3106ab616dc892b43c8d9c28a9fc9f83b3e4676b5e4e61dc0dd97bab8d6072e1
SHA512

8365e523facaeb0ac75d223d38649107ff8ad522523c4e9c153a9f1f2f36b8b7b640e90e15129c3dde7491c6cb3a849ceb33a2c79748feddedf0f1b7f8ceab37
SSDEEP

12288:p8i69yqL86aK8aP5MwXz631piSjEOyidgdMCNcEjv9l3HIbk:T6XCK24zE1p94dFcGFl3HIb

Score

10^/10

formbook cc73 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

cc73

Decoy

viptop77.biz

sell-home-fast-for-cash.xyz

wjbwebsite.top

ceramic.house

anthologymotors.com

acctwiseconsulting.com

xn--bj4blri6mqqan64b.com

roguester.com

blavkimped.com

mostbet-wih8.xyz

biellacapital.com

jasonmoorehead.online

wolrdtenis.com

huahuiblog.com

jonniprince.com

gohanyo.com

l4-j2.pro

coinyeard.com

fh8019.com

iltorlonia.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/1636-13-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2916 set thread context of 1636	2916	SecuriteInfo.com.Trojan.Inject4.59820.21926.10504.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2916	SecuriteInfo.com.Trojan.Inject4.59820.21926.10504.exe
1636	SecuriteInfo.com.Trojan.Inject4.59820.21926.10504.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2916	SecuriteInfo.com.Trojan.Inject4.59820.21926.10504.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2388	2916	SecuriteInfo.com.Trojan.Inject4.59820.21926.10504.exe	28
PID 2916 wrote to memory of 2388	2916	SecuriteInfo.com.Trojan.Inject4.59820.21926.10504.exe	28
PID 2916 wrote to memory of 2388	2916	SecuriteInfo.com.Trojan.Inject4.59820.21926.10504.exe	28
PID 2916 wrote to memory of 2388	2916	SecuriteInfo.com.Trojan.Inject4.59820.21926.10504.exe	28
PID 2916 wrote to memory of 1636	2916	SecuriteInfo.com.Trojan.Inject4.59820.21926.10504.exe	29
PID 2916 wrote to memory of 1636	2916	SecuriteInfo.com.Trojan.Inject4.59820.21926.10504.exe	29
PID 2916 wrote to memory of 1636	2916	SecuriteInfo.com.Trojan.Inject4.59820.21926.10504.exe	29
PID 2916 wrote to memory of 1636	2916	SecuriteInfo.com.Trojan.Inject4.59820.21926.10504.exe	29
PID 2916 wrote to memory of 1636	2916	SecuriteInfo.com.Trojan.Inject4.59820.21926.10504.exe	29
PID 2916 wrote to memory of 1636	2916	SecuriteInfo.com.Trojan.Inject4.59820.21926.10504.exe	29
PID 2916 wrote to memory of 1636	2916	SecuriteInfo.com.Trojan.Inject4.59820.21926.10504.exe	29

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.59820.21926.10504.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.59820.21926.10504.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.59820.21926.10504.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.59820.21926.10504.exe"
  2⤵
  PID:2388
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.59820.21926.10504.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.59820.21926.10504.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1636-9-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1636-15-0x0000000000B00000-0x0000000000E03000-memory.dmp

Filesize
3.0MB

Download
memory/1636-13-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1636-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1636-10-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2916-3-0x0000000000490000-0x00000000004A0000-memory.dmp

Filesize
64KB

Download
memory/2916-6-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/2916-7-0x00000000006B0000-0x00000000006BA000-memory.dmp

Filesize
40KB

Download
memory/2916-8-0x0000000004CE0000-0x0000000004D4E000-memory.dmp

Filesize
440KB

Download
memory/2916-5-0x00000000048B0000-0x00000000048F0000-memory.dmp

Filesize
256KB

Download
memory/2916-4-0x0000000074A10000-0x00000000750FE000-memory.dmp

Filesize
6.9MB

Download
memory/2916-0-0x0000000000820000-0x00000000008B2000-memory.dmp

Filesize
584KB

Download
memory/2916-2-0x00000000048B0000-0x00000000048F0000-memory.dmp

Filesize
256KB

Download
memory/2916-14-0x0000000074A10000-0x00000000750FE000-memory.dmp

Filesize
6.9MB

Download
memory/2916-1-0x0000000074A10000-0x00000000750FE000-memory.dmp

Filesize
6.9MB

Download