Analysis
- max time kernel
113s - max time network
104s - platform
windows10_x64 - resource
win10v20201028 - submitted
19/02/2021, 13:49
General
- Target 2bf4191dc9c78a5e47045e779a653ad5.exe
- Size 1.9MB
- Sample210219-q1axtnyn6j
- SHA256 1107284bdeebfe9255dcc17fcf19787a299307bf34e733f149430d334ddeda6a
Malware Config
Extracted
-
formbook
-
http://www.paeonystore.com/kre/
-
alpacaksa.com
-
ravneetkhurana.com
-
neverstopip.com
-
sunarrallc.com
-
lojag3wire.com
-
kiffbrother.com
-
pawantakespawn.com
-
sadarbarta.com
-
blogdoruan.life
-
jadeitesecurity.com
-
edcincorp.com
-
xjp168.com
-
babylist.info
-
ennobleempiremarketing.com
-
amazon-co-jp.store
-
regenlighting.com
-
zhengqiantv.com
-
carbeloy.com
-
lemenzz.com
-
enigmacombine.icu
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2bf4191dc9c78a5e47045e779a653ad5.exe"C:\Users\Admin\AppData\Local\Temp\2bf4191dc9c78a5e47045e779a653ad5.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2bf4191dc9c78a5e47045e779a653ad5.exe"C:\Users\Admin\AppData\Local\Temp\2bf4191dc9c78a5e47045e779a653ad5.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2bf4191dc9c78a5e47045e779a653ad5.exe"C:\Users\Admin\AppData\Local\Temp\2bf4191dc9c78a5e47045e779a653ad5.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2bf4191dc9c78a5e47045e779a653ad5.exe"C:\Users\Admin\AppData\Local\Temp\2bf4191dc9c78a5e47045e779a653ad5.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2bf4191dc9c78a5e47045e779a653ad5.exe"C:\Users\Admin\AppData\Local\Temp\2bf4191dc9c78a5e47045e779a653ad5.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/652-16-0x0000000001830000-0x0000000001B50000-memory.dmp
memory/652-13-0x0000000000400000-0x000000000042E000-memory.dmp
memory/4768-9-0x00000000054F0000-0x00000000054F1000-memory.dmp
memory/4768-7-0x00000000052E0000-0x00000000052E1000-memory.dmp
memory/4768-8-0x0000000005250000-0x0000000005251000-memory.dmp
memory/4768-2-0x00000000732D0000-0x00000000739BE000-memory.dmp
memory/4768-10-0x0000000005410000-0x0000000005414000-memory.dmp
memory/4768-11-0x0000000005420000-0x0000000005421000-memory.dmp
memory/4768-12-0x00000000010A0000-0x00000000010F4000-memory.dmp
memory/4768-6-0x0000000005740000-0x0000000005741000-memory.dmp
memory/4768-5-0x00000000051A0000-0x00000000051A1000-memory.dmp
memory/4768-3-0x00000000007A0000-0x00000000007A1000-memory.dmp