Analysis
- max time kernel
41s - max time network
68s - platform
windows10_x64 - resource
win10v20201028 - submitted
02/02/2021, 08:48
General
- Target 484565bd236a0a3ff8e0ec762116d707.exe
- Size 653KB
- Sample210202-j5y4tmshvx
- SHA256 95bd2c8256fc15082b1e8e0431439c226847bcb284871bdac55584abcab3af24
Malware Config
Extracted
-
formbook
-
http://www.theatomicshots.com/xle/
-
tknbr.com
-
loyaloneconstruction.com
-
what-where.com
-
matebacapital.com
-
marriedandmore.com
-
qiemfsolutions.com
-
graececonsulting.com
-
www7456.com
-
littlefreecherokeelibrary.com
-
tailgatepawkinglot.com
-
musheet.com
-
tesfamariamtb.com
-
1728025.com
-
xceltechuae.com
-
harperandchloe.com
-
thepamperedbarber.com
-
5050alberta.com
-
supplychainstrainer.com
-
lacorte.group
-
ringingbear.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\484565bd236a0a3ff8e0ec762116d707.exe"C:\Users\Admin\AppData\Local\Temp\484565bd236a0a3ff8e0ec762116d707.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\484565bd236a0a3ff8e0ec762116d707.exe"{path}"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\484565bd236a0a3ff8e0ec762116d707.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/720-12-0x0000000000400000-0x000000000042E000-memory.dmp
memory/720-15-0x00000000019E0000-0x0000000001D00000-memory.dmp
memory/1048-2-0x0000000073A30000-0x000000007411E000-memory.dmp
memory/1048-3-0x00000000007C0000-0x00000000007C1000-memory.dmp
memory/1048-5-0x0000000005630000-0x0000000005631000-memory.dmp
memory/1048-6-0x0000000005130000-0x0000000005131000-memory.dmp
memory/1048-7-0x0000000005380000-0x0000000005381000-memory.dmp
memory/1048-8-0x0000000005200000-0x0000000005201000-memory.dmp
memory/1048-9-0x0000000005580000-0x0000000005584000-memory.dmp
memory/1048-10-0x0000000008800000-0x000000000887E000-memory.dmp
memory/1048-11-0x0000000008920000-0x0000000008921000-memory.dmp