formbook | 129156f77f3dca373d74c668a7e4250e0812fb36bdb926aeb2ef0dec4c122846

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2023, 07:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.BackDoor.SpyBotNET.62.3823.11325.exe
Size 364KB
Sample231121-jbsyfsda59
SHA256 129156f77f3dca373d74c668a7e4250e0812fb36bdb926aeb2ef0dec4c122846
MD5 d7acbf95f4a66ed84df86a0cba4fcec9
SHA1 2fc368b855365a62107294a4842b45273be19b58
SHA512 ac155c033b9365c2b5d7ec05df91a2de30a7495d8f66f4ad24a1afd227e5b9293ac3ed36558e7a40124599a46110ca244af723dd69ad1515f770e3460ca84f92
SSDEEP 6144:5Dmad57XeLl33j30xGRh08SgmmwfhYaStizah1U9csh/mGKwgR:5K0GRIgrwSPipBvgR
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook o11y rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

o11y

Decoy

bilenoer.online
1gocasino.click
bm9qn.top
wzefoy.com
5-minutemoney.com
tx5288.com
ssteaq.com
ztxsm2gxqvl.asia
familyfishing.world
moocytrading.com
dondebusques.com
dtservicesillinois.com
korpativnighs.com
resilientjoy.com
greensclps.com
actionkillsfear.com
siwu81.com
localorion.online
spoke99.com
taxinhanh24h.site
viptop77.pro
okriches.com
steakf990.gay
synicationrescuefunds.com
teambaddiesent.com
sierarhodes.com
web-it.digital
agileadgen.com
keepjimbo.com
zslhthui.com
loganlawanda.com
kidssestablish.com
gamebaidoithuong51.vip
insungflex.com
christaafful.com
nextwavekorea.com
cmbw.club
caturdaily.com
ndbth.fun
valorant-rich.com
gripspeedofficial.com
psniederrhein.com
thriveil-stores.com
xb633.vip
viqvp.fun
fashiusta.com
mxvoly.xyz
lyttoncosmetics.com
5q3.info
yid999.com
kingstoniansupportersclub.com
nivara.diamonds
iptvbooth.com
savagelogisticsandservices.com
thevurp.com
fjkvv3.top
mzwcn.com
pumpkinspicedonuts.com
capitalloanssolution.com
sug2news.online
wile7.net
nordpost.shop
vastcapybarra.com
xyzb0451.com
shelterinds.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/4660-7-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4616 set thread context of 4660	4616	SecuriteInfo.com.BackDoor.SpyBotNET.62.3823.11325.exe	86

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4660	SecuriteInfo.com.BackDoor.SpyBotNET.62.3823.11325.exe
4660	SecuriteInfo.com.BackDoor.SpyBotNET.62.3823.11325.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 4660	4616	SecuriteInfo.com.BackDoor.SpyBotNET.62.3823.11325.exe	86
PID 4616 wrote to memory of 4660	4616	SecuriteInfo.com.BackDoor.SpyBotNET.62.3823.11325.exe	86
PID 4616 wrote to memory of 4660	4616	SecuriteInfo.com.BackDoor.SpyBotNET.62.3823.11325.exe	86
PID 4616 wrote to memory of 4660	4616	SecuriteInfo.com.BackDoor.SpyBotNET.62.3823.11325.exe	86
PID 4616 wrote to memory of 4660	4616	SecuriteInfo.com.BackDoor.SpyBotNET.62.3823.11325.exe	86
PID 4616 wrote to memory of 4660	4616	SecuriteInfo.com.BackDoor.SpyBotNET.62.3823.11325.exe	86

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BackDoor.SpyBotNET.62.3823.11325.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BackDoor.SpyBotNET.62.3823.11325.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BackDoor.SpyBotNET.62.3823.11325.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BackDoor.SpyBotNET.62.3823.11325.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4616-0-0x0000000000170000-0x00000000001D2000-memory.dmp

Download

memory/4616-1-0x00000000751D0000-0x0000000075980000-memory.dmp

Download

memory/4616-2-0x0000000005270000-0x0000000005814000-memory.dmp

Download

memory/4616-3-0x0000000004BC0000-0x0000000004C52000-memory.dmp

Download

memory/4616-4-0x0000000004C60000-0x0000000004CA4000-memory.dmp

Download

memory/4616-5-0x0000000004D40000-0x0000000004D50000-memory.dmp

Download

memory/4616-6-0x0000000004B30000-0x0000000004B3A000-memory.dmp

Download

memory/4616-9-0x00000000751D0000-0x0000000075980000-memory.dmp

Download

memory/4660-7-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4660-10-0x0000000001310000-0x000000000165A000-memory.dmp

Download