formbook | 5d4ef95e2d68ad71b54c79a6a8fcfdee4d64ac4187e30a9b8523e0dc6cdedd10

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
27/11/2023, 02:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Win32.CrypterX-gen.14086.12579.exe
Size 559KB
Sample231127-defveadh82
SHA256 5d4ef95e2d68ad71b54c79a6a8fcfdee4d64ac4187e30a9b8523e0dc6cdedd10
MD5 37a5de12dd069405abac60b790787c89
SHA1 077cb5c8339d955d36fc028cf2d62249f1f76fd2
SHA512 436759ec4909518e15fd83410736e5ee1e10ede078bb345d8f9ecb93a063995d5662411f7c2a34ed1b421eabb770b8c80722063826a9557d1accff3a05c970be
SSDEEP 12288:aP72CANvm8cyUoTtiSlRyWqlme2+IhCm/IdM:7O8ZUowS/5vtgd
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook vl53 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

vl53

Decoy

bushypussypi.com
alzentori.com
pearlmassagecentre.com
zag6.com
workadumail.com
ferreelectricosdaniel.com
takethislolypopo.com
maylanicornier.com
nptstudio.com
dunasgolf.com
guangshangjituan.com
cj6p.lat
camloi.xyz
goldcoastkayakfishing.com
hiasannatal.site
safesnipper.com
adamssecurities.com
productizewithmalu.com
oral-nursing.online
adultproducts.top
giaiphapmxh.com
shaoxinghehui.work
lasikeyesurgery.college
charliepayne.site
hbbtzz.com
louveljewelry.com
diversifiedmultimedia.com
roda-verde.com
chungyoolkim.site
123moviesfree.vip
yy37443.com
betappbr4575.com
gory911.com
arkansaspeeracademy.com
pksflorida.com
sykoconsulting.com
jenniferemurray.xyz
ag1115v.com
cetrahealth.com
cottonopoly.com
luckyeyeclinic.com
haoguimi.xyz
happy-kattet.xyz
seddesigners.com
top-amazing.com
chaney.xyz
matgross.xyz
lindabelalingerie.com
ppptech.online
cheaterremoval.com
mobpazar.store
gxihptvb.com
yxscqpx.top
decijinamestaj.com
dlycaptions.com
mediaorion.site
ytirfx.top
traxretaill.com
freeonlineclasses8.online
vente-instantanee.com
qd4you.com
senior-living-49837.bond
xn--n3caj3f6eza.com
coolermaster.xyz
ome-haisen.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/2232-11-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2244 set thread context of 2232	2244	SecuriteInfo.com.Win32.CrypterX-gen.14086.12579.exe	30

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2232	SecuriteInfo.com.Win32.CrypterX-gen.14086.12579.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2232	2244	SecuriteInfo.com.Win32.CrypterX-gen.14086.12579.exe	30
PID 2244 wrote to memory of 2232	2244	SecuriteInfo.com.Win32.CrypterX-gen.14086.12579.exe	30
PID 2244 wrote to memory of 2232	2244	SecuriteInfo.com.Win32.CrypterX-gen.14086.12579.exe	30
PID 2244 wrote to memory of 2232	2244	SecuriteInfo.com.Win32.CrypterX-gen.14086.12579.exe	30
PID 2244 wrote to memory of 2232	2244	SecuriteInfo.com.Win32.CrypterX-gen.14086.12579.exe	30
PID 2244 wrote to memory of 2232	2244	SecuriteInfo.com.Win32.CrypterX-gen.14086.12579.exe	30
PID 2244 wrote to memory of 2232	2244	SecuriteInfo.com.Win32.CrypterX-gen.14086.12579.exe	30

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterX-gen.14086.12579.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterX-gen.14086.12579.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterX-gen.14086.12579.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterX-gen.14086.12579.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2232

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2232-7-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2232-13-0x00000000009C0000-0x0000000000CC3000-memory.dmp

Download

memory/2232-11-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2232-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2232-8-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2244-3-0x0000000001E80000-0x0000000001E98000-memory.dmp

Download

memory/2244-6-0x0000000004F40000-0x0000000004FAE000-memory.dmp

Download

memory/2244-5-0x0000000001EF0000-0x0000000001EFA000-memory.dmp

Download

memory/2244-4-0x00000000006A0000-0x00000000006A6000-memory.dmp

Download

memory/2244-0-0x0000000000250000-0x00000000002E2000-memory.dmp

Download

memory/2244-2-0x0000000004990000-0x00000000049D0000-memory.dmp

Download

memory/2244-12-0x0000000073F10000-0x00000000745FE000-memory.dmp

Download

memory/2244-1-0x0000000073F10000-0x00000000745FE000-memory.dmp

Download