Analysis
-
max time kernel
39s -
max time network
110s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
11-01-2021 10:54
General
-
Target
SecuriteInfo.com.Trojan.Siggen11.57608.25639.22942.exe
-
Size
767KB
-
MD5
28525bacbafaf67335c51e61e0888ceb
-
SHA1
b47ec9082db6695b8d40294dce928579911b716a
-
SHA256
da42b1ff5f54cd474134945accc49d5fddb9b27ccf84772219dc64bee8c43bbc
-
SHA512
e9d7e63f24aceba247d5b9e782f827c88708665eda5903cd71eca437ccfe6332ee94f290fa7e7c60df213a1e73a7c236c06469c476d563bf786e22d7400e4502
Malware Config
Extracted
formbook
http://www.theatomicshots.com/xle/
tknbr.com
loyaloneconstruction.com
what-where.com
matebacapital.com
marriedandmore.com
qiemfsolutions.com
graececonsulting.com
www7456.com
littlefreecherokeelibrary.com
tailgatepawkinglot.com
musheet.com
tesfamariamtb.com
1728025.com
xceltechuae.com
harperandchloe.com
thepamperedbarber.com
5050alberta.com
supplychainstrainer.com
lacorte.group
ringingbear.com
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen11.57608.25639.22942.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen11.57608.25639.22942.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen11.57608.25639.22942.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
184KB
-
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
56KB
-
Filesize
596KB
-
Filesize
4KB