formbook | c49144d5230e65bdd212567dfc8dae95f41ae9ee4860344edc83555656dbc4c7

Analysis

max time kernel
136s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 18:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea178499cdcfd15865978d5deb8f2c20_NeikiAnalytics.exe
Size

841KB
MD5

ea178499cdcfd15865978d5deb8f2c20
SHA1

abb69aa28efbcd0c4316092f86b4a7a8bfa46065
SHA256

c49144d5230e65bdd212567dfc8dae95f41ae9ee4860344edc83555656dbc4c7
SHA512

ebc012339713f31f420b6a1d3225646d6e051e79ffa7d656243909d399edbdfd27036a6b0a5e43229f0eff5440d2c1d02613700cc3b9d2c73ab3271164537407
SSDEEP

12288:mIhwd62Ykh5M7Evm38LIAufALnGTaSsMDY0igpaKNlcZ7JWV8u/UPnp:mIeMkh5oEukLG4hpgkKN47JWV8u/A

Score

10^/10

formbook cr12 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

cr12

Decoy

nff1291.com

satyainfra.com

hechiceradeamores.com

jfgminimalist.com

qut68q.com

pedandmore.com

sugardefender24-usa.us

somalse.com

lotusluxecandle.com

certificadobassetpro.com

veryaroma.com

thehistoryofindia.in

33155.cc

terastudy.net

84031.vip

heilsambegegnen.com

horizon-rg.info

junongpei.website

winstons.club

henslotalt.us

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1200-11-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

ea178499cdcfd15865978d5deb8f2c20_NeikiAnalytics.exe

description	pid	process	target process
PID 4180 set thread context of 1200	4180	ea178499cdcfd15865978d5deb8f2c20_NeikiAnalytics.exe	ea178499cdcfd15865978d5deb8f2c20_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

ea178499cdcfd15865978d5deb8f2c20_NeikiAnalytics.exe

pid process

1200 ea178499cdcfd15865978d5deb8f2c20_NeikiAnalytics.exe
1200 ea178499cdcfd15865978d5deb8f2c20_NeikiAnalytics.exe

pid	process
1200	ea178499cdcfd15865978d5deb8f2c20_NeikiAnalytics.exe
1200	ea178499cdcfd15865978d5deb8f2c20_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

ea178499cdcfd15865978d5deb8f2c20_NeikiAnalytics.exe

description	pid	process	target process
PID 4180 wrote to memory of 1200	4180	ea178499cdcfd15865978d5deb8f2c20_NeikiAnalytics.exe	ea178499cdcfd15865978d5deb8f2c20_NeikiAnalytics.exe
PID 4180 wrote to memory of 1200	4180	ea178499cdcfd15865978d5deb8f2c20_NeikiAnalytics.exe	ea178499cdcfd15865978d5deb8f2c20_NeikiAnalytics.exe
PID 4180 wrote to memory of 1200	4180	ea178499cdcfd15865978d5deb8f2c20_NeikiAnalytics.exe	ea178499cdcfd15865978d5deb8f2c20_NeikiAnalytics.exe
PID 4180 wrote to memory of 1200	4180	ea178499cdcfd15865978d5deb8f2c20_NeikiAnalytics.exe	ea178499cdcfd15865978d5deb8f2c20_NeikiAnalytics.exe
PID 4180 wrote to memory of 1200	4180	ea178499cdcfd15865978d5deb8f2c20_NeikiAnalytics.exe	ea178499cdcfd15865978d5deb8f2c20_NeikiAnalytics.exe
PID 4180 wrote to memory of 1200	4180	ea178499cdcfd15865978d5deb8f2c20_NeikiAnalytics.exe	ea178499cdcfd15865978d5deb8f2c20_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\ea178499cdcfd15865978d5deb8f2c20_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\ea178499cdcfd15865978d5deb8f2c20_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4180

C:\Users\Admin\AppData\Local\Temp\ea178499cdcfd15865978d5deb8f2c20_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\ea178499cdcfd15865978d5deb8f2c20_NeikiAnalytics.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1200

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1200-11-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1200-14-0x0000000001770000-0x0000000001ABA000-memory.dmp

Filesize
3.3MB

Download
memory/4180-6-0x0000000005BD0000-0x0000000005BDA000-memory.dmp

Filesize
40KB

Download
memory/4180-3-0x0000000005A50000-0x0000000005AE2000-memory.dmp

Filesize
584KB

Download
memory/4180-4-0x00000000065B0000-0x0000000006904000-memory.dmp

Filesize
3.3MB

Download
memory/4180-5-0x0000000074830000-0x0000000074FE0000-memory.dmp

Filesize
7.7MB

Download
memory/4180-0-0x000000007483E000-0x000000007483F000-memory.dmp

Filesize
4KB

Download
memory/4180-7-0x0000000005F40000-0x0000000005F5A000-memory.dmp

Filesize
104KB

Download
memory/4180-8-0x0000000005F60000-0x0000000005F70000-memory.dmp

Filesize
64KB

Download
memory/4180-9-0x00000000073B0000-0x0000000007426000-memory.dmp

Filesize
472KB

Download
memory/4180-10-0x000000000B3D0000-0x000000000B46C000-memory.dmp

Filesize
624KB

Download
memory/4180-2-0x0000000006000000-0x00000000065A4000-memory.dmp

Filesize
5.6MB

Download
memory/4180-13-0x0000000074830000-0x0000000074FE0000-memory.dmp

Filesize
7.7MB

Download
memory/4180-1-0x0000000000FA0000-0x0000000001078000-memory.dmp

Filesize
864KB

Download