Analysis
- max time kernel
63s - max time network
110s - platform
windows10_x64 - resource
win10v20201028 - submitted
04/12/2020, 10:07
General
- Target SecuriteInfo.com.Trojan.PackedNET.475.29445.3816.exe
- Size 840KB
- Sample201204-ha883kdmbs
- SHA256 fb9ff8cbde506cb2cfdb40e88fe3fd6877a2e9945a71f07c7252647271763e71
Malware Config
Extracted
-
formbook
-
http://www.mommabearmoney.com/et2d/
-
wcaconline.com
-
travelbackpackss.com
-
ao-m-nishinomiya.com
-
tilania.com
-
vegbydesign.net
-
mybabysisterscloset.com
-
sanctitude-cuspidated.com
-
russtybeats.com
-
dichvubangchuan.com
-
su-seikatu.info
-
eratosantorini.com
-
ninetofivemama.com
-
delishany.com
-
pawchamamapet.net
-
nissicloud.com
-
strictlyotaku.net
-
kissmanga.pro
-
appalachianfx.com
-
aralending.com
-
forbrighterlife.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.475.29445.3816.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.475.29445.3816.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.475.29445.3816.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.475.29445.3816.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.475.29445.3816.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.475.29445.3816.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/816-2-0x0000000074070000-0x000000007475E000-memory.dmp
memory/816-3-0x0000000000380000-0x0000000000381000-memory.dmp
memory/816-5-0x0000000004E20000-0x0000000004E21000-memory.dmp
memory/816-6-0x00000000053C0000-0x00000000053C1000-memory.dmp
memory/816-7-0x0000000004EC0000-0x0000000004EC1000-memory.dmp
memory/816-8-0x0000000004DC0000-0x0000000004DC1000-memory.dmp
memory/816-9-0x0000000005080000-0x0000000005081000-memory.dmp
memory/816-10-0x00000000262A0000-0x0000000046288000-memory.dmp
memory/816-11-0x0000000005350000-0x000000000539F000-memory.dmp
memory/816-12-0x0000000004E10000-0x0000000004E18000-memory.dmp
memory/816-14-0x0000000046620000-0x0000000046651000-memory.dmp
memory/2120-15-0x0000000000400000-0x000000000042E000-memory.dmp