Analysis
- max time kernel
41s - max time network
112s - platform
windows10_x64 - resource
win10v20201028 - submitted
11/01/2021, 07:41
General
- Target 7aca33a06ea660d4e2540da8b2c0bed2.exe
- Size 766KB
- Sample210111-twempwmflx
- SHA256 c9bc1c7f21e628959622a569b2a4221b8a4cbcc34f3d01684da97bea5cd9caf7
Malware Config
Extracted
-
formbook
-
http://www.theatomicshots.com/xle/
-
tknbr.com
-
loyaloneconstruction.com
-
what-where.com
-
matebacapital.com
-
marriedandmore.com
-
qiemfsolutions.com
-
graececonsulting.com
-
www7456.com
-
littlefreecherokeelibrary.com
-
tailgatepawkinglot.com
-
musheet.com
-
tesfamariamtb.com
-
1728025.com
-
xceltechuae.com
-
harperandchloe.com
-
thepamperedbarber.com
-
5050alberta.com
-
supplychainstrainer.com
-
lacorte.group
-
ringingbear.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7aca33a06ea660d4e2540da8b2c0bed2.exe"C:\Users\Admin\AppData\Local\Temp\7aca33a06ea660d4e2540da8b2c0bed2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7aca33a06ea660d4e2540da8b2c0bed2.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2604-2-0x0000000073940000-0x000000007402E000-memory.dmp
memory/2604-3-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/2604-5-0x0000000005BF0000-0x0000000005BF1000-memory.dmp
memory/2604-6-0x0000000005630000-0x0000000005631000-memory.dmp
memory/2604-7-0x00000000057B0000-0x00000000057B1000-memory.dmp
memory/2604-8-0x0000000005840000-0x000000000584E000-memory.dmp
memory/2604-9-0x0000000006390000-0x0000000006425000-memory.dmp
memory/2604-10-0x00000000064D0000-0x00000000064D1000-memory.dmp
memory/2748-11-0x0000000000400000-0x000000000042E000-memory.dmp