Analysis
- max time kernel
76s - max time network
77s - platform
windows10_x64 - resource
win10v20201028 - submitted
05/02/2021, 19:33
General
- Target 6430a88a4b8966baf1537d011d1a7b0e.exe
- Size 918KB
- Sample210205-qejwkfr5ce
- SHA256 ae6a16d4082c3082ad60db5ea9715ea44bbff9a97a5b751cb01d351230a5fc42
Malware Config
Extracted
-
formbook
-
http://www.theatomicshots.com/xle/
-
tknbr.com
-
loyaloneconstruction.com
-
what-where.com
-
matebacapital.com
-
marriedandmore.com
-
qiemfsolutions.com
-
graececonsulting.com
-
www7456.com
-
littlefreecherokeelibrary.com
-
tailgatepawkinglot.com
-
musheet.com
-
tesfamariamtb.com
-
1728025.com
-
xceltechuae.com
-
harperandchloe.com
-
thepamperedbarber.com
-
5050alberta.com
-
supplychainstrainer.com
-
lacorte.group
-
ringingbear.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6430a88a4b8966baf1537d011d1a7b0e.exe"C:\Users\Admin\AppData\Local\Temp\6430a88a4b8966baf1537d011d1a7b0e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6430a88a4b8966baf1537d011d1a7b0e.exe"{path}"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\6430a88a4b8966baf1537d011d1a7b0e.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1144-2-0x0000000073450000-0x0000000073B3E000-memory.dmp
memory/1144-3-0x0000000000300000-0x0000000000301000-memory.dmp
memory/1144-5-0x00000000075B0000-0x00000000075B1000-memory.dmp
memory/1144-6-0x0000000007150000-0x0000000007151000-memory.dmp
memory/1144-7-0x0000000007100000-0x0000000007101000-memory.dmp
memory/1144-8-0x00000000073A0000-0x00000000073A1000-memory.dmp
memory/1144-9-0x000000000A6E0000-0x000000000A6E4000-memory.dmp
memory/1144-10-0x0000000000D50000-0x0000000000DE9000-memory.dmp
memory/1144-11-0x000000000A830000-0x000000000A831000-memory.dmp
memory/2272-12-0x0000000000400000-0x000000000042E000-memory.dmp
memory/2272-15-0x0000000001250000-0x0000000001570000-memory.dmp