formbook | 6282a84266a87aa1e62b1304913bfdc8ce4c122f59f5731503f78655beaaa27e

Analysis

max time kernel
139s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
15/11/2023, 07:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.BackDoor.SpyBotNET.62.14069.25378.exe
Size 364KB
Sample231115-h4x77seb53
SHA256 6282a84266a87aa1e62b1304913bfdc8ce4c122f59f5731503f78655beaaa27e
MD5 ded48ea6682f8f29cb3486111e54279b
SHA1 a9209dceca3d007846f487bce01fa02de0e0b4b3
SHA512 9b52178ac53b37ac13beb9d13a694d6a01562a31cd052ef401e176b43f5a59e191b25081210b68cf507130c7fd43e866c7892b64c9872e610765994e7542e97d
SSDEEP 6144:5Dmad57XeKl33j30xq6L4gWTWv/cbq3iR6HzTaFh++zXDDcHd8QQw1Jw1g3:5KD5L4gaWvkbqSRGWsIadoW3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook o11y rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

o11y

Decoy

bilenoer.online
1gocasino.click
bm9qn.top
wzefoy.com
5-minutemoney.com
tx5288.com
ssteaq.com
ztxsm2gxqvl.asia
familyfishing.world
moocytrading.com
dondebusques.com
dtservicesillinois.com
korpativnighs.com
resilientjoy.com
greensclps.com
actionkillsfear.com
siwu81.com
localorion.online
spoke99.com
taxinhanh24h.site
viptop77.pro
okriches.com
steakf990.gay
synicationrescuefunds.com
teambaddiesent.com
sierarhodes.com
web-it.digital
agileadgen.com
keepjimbo.com
zslhthui.com
loganlawanda.com
kidssestablish.com
gamebaidoithuong51.vip
insungflex.com
christaafful.com
nextwavekorea.com
cmbw.club
caturdaily.com
ndbth.fun
valorant-rich.com
gripspeedofficial.com
psniederrhein.com
thriveil-stores.com
xb633.vip
viqvp.fun
fashiusta.com
mxvoly.xyz
lyttoncosmetics.com
5q3.info
yid999.com
kingstoniansupportersclub.com
nivara.diamonds
iptvbooth.com
savagelogisticsandservices.com
thevurp.com
fjkvv3.top
mzwcn.com
pumpkinspicedonuts.com
capitalloanssolution.com
sug2news.online
wile7.net
nordpost.shop
vastcapybarra.com
xyzb0451.com
shelterinds.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/4512-7-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5108 set thread context of 4512	5108	SecuriteInfo.com.BackDoor.SpyBotNET.62.14069.25378.exe	88

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4512	SecuriteInfo.com.BackDoor.SpyBotNET.62.14069.25378.exe
4512	SecuriteInfo.com.BackDoor.SpyBotNET.62.14069.25378.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5108 wrote to memory of 4512	5108	SecuriteInfo.com.BackDoor.SpyBotNET.62.14069.25378.exe	88
PID 5108 wrote to memory of 4512	5108	SecuriteInfo.com.BackDoor.SpyBotNET.62.14069.25378.exe	88
PID 5108 wrote to memory of 4512	5108	SecuriteInfo.com.BackDoor.SpyBotNET.62.14069.25378.exe	88
PID 5108 wrote to memory of 4512	5108	SecuriteInfo.com.BackDoor.SpyBotNET.62.14069.25378.exe	88
PID 5108 wrote to memory of 4512	5108	SecuriteInfo.com.BackDoor.SpyBotNET.62.14069.25378.exe	88
PID 5108 wrote to memory of 4512	5108	SecuriteInfo.com.BackDoor.SpyBotNET.62.14069.25378.exe	88

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BackDoor.SpyBotNET.62.14069.25378.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BackDoor.SpyBotNET.62.14069.25378.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5108
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BackDoor.SpyBotNET.62.14069.25378.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BackDoor.SpyBotNET.62.14069.25378.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4512

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4512-7-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4512-10-0x0000000001130000-0x000000000147A000-memory.dmp

Download

memory/5108-0-0x0000000000580000-0x00000000005E2000-memory.dmp

Download

memory/5108-1-0x00000000748C0000-0x0000000075070000-memory.dmp

Download

memory/5108-2-0x0000000005690000-0x0000000005C34000-memory.dmp

Download

memory/5108-3-0x0000000004FD0000-0x0000000005062000-memory.dmp

Download

memory/5108-4-0x0000000005070000-0x00000000050B4000-memory.dmp

Download

memory/5108-5-0x00000000051B0000-0x00000000051C0000-memory.dmp

Download

memory/5108-6-0x0000000004F40000-0x0000000004F4A000-memory.dmp

Download

memory/5108-9-0x00000000748C0000-0x0000000075070000-memory.dmp

Download