formbook | 37a397d43ff8bcecd5150fe9caa35d3c9425cc59d04a9d3ce2a65b633893a3a1

General

Target

37a397d43ff8bcecd5150fe9caa35d3c9425cc59d04a9d3ce2a65b633893a3a1_NeikiAnalytics.exe
Size

902KB
MD5

44e94e89abcd77681bfd1a84f6403250
SHA1

4044c94c9044733cbdf419277b972b27549b49fe
SHA256

37a397d43ff8bcecd5150fe9caa35d3c9425cc59d04a9d3ce2a65b633893a3a1
SHA512

c2f204410644dc0137444d861c1033042f223ebdbe55661c93bb9e1afc208ef16f803707d32459e5e6a47307c533dd9352c63463d4b25b17186979313543e06b
SSDEEP

12288:EW7WUfJDx4490h83M5s1FsknZ70VfwIYqYsuObT1XnwAzMHGc81:h9uWGs1aw70VIImsnbp3wIM

Score

10^/10

formbook dy13 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dy13

Decoy

manga-house.com

kjsdhklssk51.xyz

b0ba138.xyz

bt365033.com

ccbsinc.net

mrwine.xyz

nrxkrd527o.xyz

hoshi.social

1912ai.com

serco2020.com

byfchfyr.xyz

imuschestvostorgov.online

austinheafey.com

mrdfa.club

883106.photos

profitablefxmarkets.com

taini00.net

brye.top

ginsm.com

sportglid.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Formbook payload 1 IoCs
rat

Processes:

resource yara_rule

behavioral1/memory/1760-15-0x0000000000400000-0x000000000042F000-memory.dmp formbook

resource	yara_rule
behavioral1/memory/1760-15-0x0000000000400000-0x000000000042F000-memory.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

37a397d43ff8bcecd5150fe9caa35d3c9425cc59d04a9d3ce2a65b633893a3a1_NeikiAnalytics.exe

description	pid	process	target process
PID 2872 set thread context of 1760	2872	37a397d43ff8bcecd5150fe9caa35d3c9425cc59d04a9d3ce2a65b633893a3a1_NeikiAnalytics.exe	37a397d43ff8bcecd5150fe9caa35d3c9425cc59d04a9d3ce2a65b633893a3a1_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

37a397d43ff8bcecd5150fe9caa35d3c9425cc59d04a9d3ce2a65b633893a3a1_NeikiAnalytics.exe

pid process

1760 37a397d43ff8bcecd5150fe9caa35d3c9425cc59d04a9d3ce2a65b633893a3a1_NeikiAnalytics.exe

pid	process
1760	37a397d43ff8bcecd5150fe9caa35d3c9425cc59d04a9d3ce2a65b633893a3a1_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

37a397d43ff8bcecd5150fe9caa35d3c9425cc59d04a9d3ce2a65b633893a3a1_NeikiAnalytics.exe

description	pid	process	target process
PID 2872 wrote to memory of 1760	2872	37a397d43ff8bcecd5150fe9caa35d3c9425cc59d04a9d3ce2a65b633893a3a1_NeikiAnalytics.exe	37a397d43ff8bcecd5150fe9caa35d3c9425cc59d04a9d3ce2a65b633893a3a1_NeikiAnalytics.exe
PID 2872 wrote to memory of 1760	2872	37a397d43ff8bcecd5150fe9caa35d3c9425cc59d04a9d3ce2a65b633893a3a1_NeikiAnalytics.exe	37a397d43ff8bcecd5150fe9caa35d3c9425cc59d04a9d3ce2a65b633893a3a1_NeikiAnalytics.exe
PID 2872 wrote to memory of 1760	2872	37a397d43ff8bcecd5150fe9caa35d3c9425cc59d04a9d3ce2a65b633893a3a1_NeikiAnalytics.exe	37a397d43ff8bcecd5150fe9caa35d3c9425cc59d04a9d3ce2a65b633893a3a1_NeikiAnalytics.exe
PID 2872 wrote to memory of 1760	2872	37a397d43ff8bcecd5150fe9caa35d3c9425cc59d04a9d3ce2a65b633893a3a1_NeikiAnalytics.exe	37a397d43ff8bcecd5150fe9caa35d3c9425cc59d04a9d3ce2a65b633893a3a1_NeikiAnalytics.exe
PID 2872 wrote to memory of 1760	2872	37a397d43ff8bcecd5150fe9caa35d3c9425cc59d04a9d3ce2a65b633893a3a1_NeikiAnalytics.exe	37a397d43ff8bcecd5150fe9caa35d3c9425cc59d04a9d3ce2a65b633893a3a1_NeikiAnalytics.exe
PID 2872 wrote to memory of 1760	2872	37a397d43ff8bcecd5150fe9caa35d3c9425cc59d04a9d3ce2a65b633893a3a1_NeikiAnalytics.exe	37a397d43ff8bcecd5150fe9caa35d3c9425cc59d04a9d3ce2a65b633893a3a1_NeikiAnalytics.exe
PID 2872 wrote to memory of 1760	2872	37a397d43ff8bcecd5150fe9caa35d3c9425cc59d04a9d3ce2a65b633893a3a1_NeikiAnalytics.exe	37a397d43ff8bcecd5150fe9caa35d3c9425cc59d04a9d3ce2a65b633893a3a1_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\37a397d43ff8bcecd5150fe9caa35d3c9425cc59d04a9d3ce2a65b633893a3a1_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\37a397d43ff8bcecd5150fe9caa35d3c9425cc59d04a9d3ce2a65b633893a3a1_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2872

C:\Users\Admin\AppData\Local\Temp\37a397d43ff8bcecd5150fe9caa35d3c9425cc59d04a9d3ce2a65b633893a3a1_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\37a397d43ff8bcecd5150fe9caa35d3c9425cc59d04a9d3ce2a65b633893a3a1_NeikiAnalytics.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1760

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1760-8-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1760-17-0x0000000000A60000-0x0000000000D63000-memory.dmp

Filesize
3.0MB

Download
memory/1760-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1760-15-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1760-10-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2872-3-0x00000000004C0000-0x00000000004D2000-memory.dmp

Filesize
72KB

Download
memory/2872-6-0x00000000043C0000-0x0000000004446000-memory.dmp

Filesize
536KB

Download
memory/2872-7-0x0000000005630000-0x00000000056A6000-memory.dmp

Filesize
472KB

Download
memory/2872-5-0x0000000000810000-0x000000000081C000-memory.dmp

Filesize
48KB

Download
memory/2872-4-0x0000000000800000-0x0000000000808000-memory.dmp

Filesize
32KB

Download
memory/2872-0-0x0000000074A2E000-0x0000000074A2F000-memory.dmp

Filesize
4KB

Download
memory/2872-2-0x0000000074A20000-0x000000007510E000-memory.dmp

Filesize
6.9MB

Download
memory/2872-16-0x0000000074A20000-0x000000007510E000-memory.dmp

Filesize
6.9MB

Download
memory/2872-1-0x0000000000970000-0x0000000000A58000-memory.dmp

Filesize
928KB

Download

Analysis

Sharing