Analysis
- max time kernel
40s - max time network
110s - platform
windows10_x64 - resource
win10v20201028 - submitted
13/01/2021, 19:55
General
- Target d97a26894ec19dc562eec833ccb5607f.exe
- Size 1.0MB
- Sample210113-pez6ktb96j
- SHA256 2fdfbfc735f43a4e2dce0c849b41ab83dd17228f6df983f7a95d6e427cdc77b0
Malware Config
Extracted
-
formbook
-
http://www.theatomicshots.com/xle/
-
tknbr.com
-
loyaloneconstruction.com
-
what-where.com
-
matebacapital.com
-
marriedandmore.com
-
qiemfsolutions.com
-
graececonsulting.com
-
www7456.com
-
littlefreecherokeelibrary.com
-
tailgatepawkinglot.com
-
musheet.com
-
tesfamariamtb.com
-
1728025.com
-
xceltechuae.com
-
harperandchloe.com
-
thepamperedbarber.com
-
5050alberta.com
-
supplychainstrainer.com
-
lacorte.group
-
ringingbear.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d97a26894ec19dc562eec833ccb5607f.exe"C:\Users\Admin\AppData\Local\Temp\d97a26894ec19dc562eec833ccb5607f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d97a26894ec19dc562eec833ccb5607f.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1868-11-0x0000000000400000-0x000000000042E000-memory.dmp
memory/3940-2-0x0000000073BA0000-0x000000007428E000-memory.dmp
memory/3940-3-0x0000000000860000-0x0000000000861000-memory.dmp
memory/3940-5-0x0000000007BD0000-0x0000000007BD1000-memory.dmp
memory/3940-6-0x00000000077B0000-0x00000000077B1000-memory.dmp
memory/3940-7-0x0000000007940000-0x0000000007941000-memory.dmp
memory/3940-8-0x0000000007A10000-0x0000000007A1E000-memory.dmp
memory/3940-9-0x0000000004D30000-0x0000000004DB1000-memory.dmp
memory/3940-10-0x0000000009D70000-0x0000000009D71000-memory.dmp