Analysis
- max time kernel
125s - max time network
16s - platform
windows7_x64 - resource
win7v20201028 - submitted
21/02/2021, 18:14
General
- Target do202120102_010010101001010.pdf.exe
- Size 883KB
- Sample210221-pspywbcmmj
- SHA256 878780dd4a45cd2ac3266e865c987933f7f6539fe93f6bc6b314188b2e5d2a45
Malware Config
Extracted
-
formbook
-
http://www.coincrush.net/fzd/
-
vn-mua-hang-onlike.site
-
creationsbylisaq.com
-
clouduwo.com
-
archlvedata.com
-
casanoriamaderas.com
-
plouceur.com
-
thrivewarrioracademy.com
-
saraviafirma.com
-
letstalktech.tech
-
rhetfox.com
-
clmssouth.com
-
thecatstits.net
-
mepain.space
-
thepapaya.xyz
-
gaplek.net
-
llcom.net
-
estrategassocial.com
-
sliming.life
-
progressofindia.com
-
fakedoctorsrealfriendsmerch.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\do202120102_010010101001010.pdf.exe"C:\Users\Admin\AppData\Local\Temp\do202120102_010010101001010.pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\do202120102_010010101001010.pdf.exe"C:\Users\Admin\AppData\Local\Temp\do202120102_010010101001010.pdf.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1064-2-0x00000000740B0000-0x000000007479E000-memory.dmp
memory/1064-3-0x0000000001060000-0x0000000001061000-memory.dmp
memory/1064-5-0x0000000004DA0000-0x0000000004DA1000-memory.dmp
memory/1064-6-0x0000000000370000-0x0000000000373000-memory.dmp
memory/1064-7-0x0000000000FF0000-0x0000000001045000-memory.dmp
memory/1600-8-0x0000000000400000-0x000000000042E000-memory.dmp
memory/1600-11-0x00000000008C0000-0x0000000000BC3000-memory.dmp