Analysis
- max time kernel
55s - max time network
102s - platform
windows10_x64 - resource
win10v20201028 - submitted
17/11/2020, 11:27
General
- Target 06ff0fff9de08e2cca89bc274bc5a2c2.exe
- Size 708KB
- Sample201117-447pfg6ehj
- SHA256 c698f5ef823adc2c3079ee359ea6d80e7c8e800d742d8f63c4c6f697131dd763
Malware Config
Extracted
-
formbook
-
http://www.thehappyhourtimes.com/z0po/
-
trouverunartisanserieux.com
-
dawn-niece.xyz
-
smalltree2021.com
-
asiansforliberty.com
-
suyeaimwnd.com
-
67630pp.com
-
drinkdeliveryservices.com
-
icollect-auctions.com
-
transformintecture.com
-
systemaircn.com
-
bluemonkeyhealingenergy.com
-
joebartonproducts.com
-
sacredclouddesigns.com
-
discovertravelco.com
-
haxb33.xyz
-
soldadorprofissional.com
-
disruptergen.com
-
senvias12.com
-
culinaryrambler.net
-
hnhlsm.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\06ff0fff9de08e2cca89bc274bc5a2c2.exe"C:\Users\Admin\AppData\Local\Temp\06ff0fff9de08e2cca89bc274bc5a2c2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\06ff0fff9de08e2cca89bc274bc5a2c2.exe"C:\Users\Admin\AppData\Local\Temp\06ff0fff9de08e2cca89bc274bc5a2c2.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\06ff0fff9de08e2cca89bc274bc5a2c2.exe"C:\Users\Admin\AppData\Local\Temp\06ff0fff9de08e2cca89bc274bc5a2c2.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/848-0-0x0000000073940000-0x000000007402E000-memory.dmp
memory/848-1-0x0000000000B50000-0x0000000000B51000-memory.dmp
memory/848-3-0x0000000005470000-0x0000000005471000-memory.dmp
memory/848-4-0x0000000005A10000-0x0000000005A11000-memory.dmp
memory/848-5-0x00000000055B0000-0x00000000055B1000-memory.dmp
memory/848-6-0x0000000005410000-0x0000000005411000-memory.dmp
memory/848-7-0x0000000005710000-0x0000000005711000-memory.dmp
memory/848-8-0x0000000005580000-0x0000000005594000-memory.dmp
memory/848-9-0x00000000062A0000-0x0000000006305000-memory.dmp
memory/848-10-0x0000000006320000-0x0000000006326000-memory.dmp
memory/848-11-0x0000000006330000-0x0000000006360000-memory.dmp
memory/2828-12-0x0000000000400000-0x000000000042E000-memory.dmp