formbook | c49144d5230e65bdd212567dfc8dae95f41ae9ee4860344edc83555656dbc4c7

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 18:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea178499cdcfd15865978d5deb8f2c20_NeikiAnalytics.exe
Size

841KB
MD5

ea178499cdcfd15865978d5deb8f2c20
SHA1

abb69aa28efbcd0c4316092f86b4a7a8bfa46065
SHA256

c49144d5230e65bdd212567dfc8dae95f41ae9ee4860344edc83555656dbc4c7
SHA512

ebc012339713f31f420b6a1d3225646d6e051e79ffa7d656243909d399edbdfd27036a6b0a5e43229f0eff5440d2c1d02613700cc3b9d2c73ab3271164537407
SSDEEP

12288:mIhwd62Ykh5M7Evm38LIAufALnGTaSsMDY0igpaKNlcZ7JWV8u/UPnp:mIeMkh5oEukLG4hpgkKN47JWV8u/A

Score

10^/10

formbook cr12 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

cr12

Decoy

nff1291.com

satyainfra.com

hechiceradeamores.com

jfgminimalist.com

qut68q.com

pedandmore.com

sugardefender24-usa.us

somalse.com

lotusluxecandle.com

certificadobassetpro.com

veryaroma.com

thehistoryofindia.in

33155.cc

terastudy.net

84031.vip

heilsambegegnen.com

horizon-rg.info

junongpei.website

winstons.club

henslotalt.us

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2856-12-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

ea178499cdcfd15865978d5deb8f2c20_NeikiAnalytics.exe

description	pid	process	target process
PID 1176 set thread context of 2856	1176	ea178499cdcfd15865978d5deb8f2c20_NeikiAnalytics.exe	ea178499cdcfd15865978d5deb8f2c20_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

ea178499cdcfd15865978d5deb8f2c20_NeikiAnalytics.exe

pid process

2856 ea178499cdcfd15865978d5deb8f2c20_NeikiAnalytics.exe

pid	process
2856	ea178499cdcfd15865978d5deb8f2c20_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

ea178499cdcfd15865978d5deb8f2c20_NeikiAnalytics.exe

description	pid	process	target process
PID 1176 wrote to memory of 2856	1176	ea178499cdcfd15865978d5deb8f2c20_NeikiAnalytics.exe	ea178499cdcfd15865978d5deb8f2c20_NeikiAnalytics.exe
PID 1176 wrote to memory of 2856	1176	ea178499cdcfd15865978d5deb8f2c20_NeikiAnalytics.exe	ea178499cdcfd15865978d5deb8f2c20_NeikiAnalytics.exe
PID 1176 wrote to memory of 2856	1176	ea178499cdcfd15865978d5deb8f2c20_NeikiAnalytics.exe	ea178499cdcfd15865978d5deb8f2c20_NeikiAnalytics.exe
PID 1176 wrote to memory of 2856	1176	ea178499cdcfd15865978d5deb8f2c20_NeikiAnalytics.exe	ea178499cdcfd15865978d5deb8f2c20_NeikiAnalytics.exe
PID 1176 wrote to memory of 2856	1176	ea178499cdcfd15865978d5deb8f2c20_NeikiAnalytics.exe	ea178499cdcfd15865978d5deb8f2c20_NeikiAnalytics.exe
PID 1176 wrote to memory of 2856	1176	ea178499cdcfd15865978d5deb8f2c20_NeikiAnalytics.exe	ea178499cdcfd15865978d5deb8f2c20_NeikiAnalytics.exe
PID 1176 wrote to memory of 2856	1176	ea178499cdcfd15865978d5deb8f2c20_NeikiAnalytics.exe	ea178499cdcfd15865978d5deb8f2c20_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\ea178499cdcfd15865978d5deb8f2c20_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\ea178499cdcfd15865978d5deb8f2c20_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1176

C:\Users\Admin\AppData\Local\Temp\ea178499cdcfd15865978d5deb8f2c20_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\ea178499cdcfd15865978d5deb8f2c20_NeikiAnalytics.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2856

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1176-0-0x0000000074A0E000-0x0000000074A0F000-memory.dmp

Filesize
4KB

Download
memory/1176-1-0x0000000000240000-0x0000000000318000-memory.dmp

Filesize
864KB

Download
memory/1176-2-0x0000000074A00000-0x00000000750EE000-memory.dmp

Filesize
6.9MB

Download
memory/1176-3-0x0000000001EC0000-0x0000000001EDA000-memory.dmp

Filesize
104KB

Download
memory/1176-4-0x0000000001E50000-0x0000000001E60000-memory.dmp

Filesize
64KB

Download
memory/1176-5-0x0000000005340000-0x00000000053B6000-memory.dmp

Filesize
472KB

Download
memory/1176-13-0x0000000074A00000-0x00000000750EE000-memory.dmp

Filesize
6.9MB

Download
memory/2856-6-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2856-9-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2856-12-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2856-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2856-14-0x0000000000C40000-0x0000000000F43000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads