Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
05-05-2021 05:44
General
-
Target
SecuriteInfo.com.Trojan.Win32.Save.a.1760.6134.exe
-
Size
2.4MB
-
MD5
6da8e0e9d3f4d31afc310050825cea27
-
SHA1
47512cec2a0608c17b01e9fdf40776ec99743cf0
-
SHA256
9c9dfbf8c44bbe594498ebf93efd84fcf73d66d9c6d5b86e9979afe5e9e9330c
-
SHA512
bb45fadb068eb2e2aaec99c609ebd3256ac038a506a548085d24191d1d9a993d627c0791e190aef561344bcb1897511e90f4bac96707e5099d07ec218af8871b
Malware Config
Extracted
formbook
4.1
http://www.intelliedgeclinical.net/god/
aprendiz.digital
baby-rosy.com
buzzstreetnews.com
restoredscore.com
fullbeingphysician.com
gameonaustralia.com
famdns.com
compassionatecare-llc.com
yureb.com
bike-abruzzo.com
hibiskuricity.site
hindusetu.com
searchingkitsapcountyhomes.com
trespal.com
forenvid.com
gangnamstationithacany.com
roshan-prime.com
fsmstudio.com
bilecikvinckiralama.com
cash4urhousekeys.com
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Win32.Save.a.1760.6134.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Win32.Save.a.1760.6134.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Win32.Save.a.1760.6134.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Win32.Save.a.1760.6134.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
5.0MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
56KB
-
Filesize
504KB
-
Filesize
212KB
-
-
Filesize
184KB
-
Filesize
3.1MB