Analysis
-
max time kernel
117s -
max time network
112s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
06-05-2021 07:28
General
-
Target
0282fb6d3422cdebf88ba2d9ce0831af.exe
-
Size
751KB
-
MD5
0282fb6d3422cdebf88ba2d9ce0831af
-
SHA1
f0c80f1d6ace27df947df38aae7b11ed4b6d7144
-
SHA256
4fb3bfa3afd4fd027aff55a6cbbc8c3d92fb5dd84bca9d88ff893928a41b9a0a
-
SHA512
ab8df1a2b5feb03c0df351a215d6e9bb16c3b92853aab0fe7c96308fa94e1eefc362a23cff5e61da2a3e93f28e44a9954b23e363ff6dbc72ac90da95c5f8e6de
Malware Config
Extracted
formbook
4.1
http://www.projectx-dev.net/hci/
0357shop.com
cinargenerator.com
freshwes.com
dance-pods.com
cptinsano.com
animaltales1.com
ridernationusa.com
christophergagnon.com
bzjp.icu
culturefap.com
illustrationtees.com
handwritingwork.com
thebullrunranch.com
wujingli.com
wifihouten.online
okavagegroup.com
makaladiggsfitness.com
ruvapy.com
customergirl.com
guangzhoushujukuzxtftf.com
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0282fb6d3422cdebf88ba2d9ce0831af.exe"C:\Users\Admin\AppData\Local\Temp\0282fb6d3422cdebf88ba2d9ce0831af.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0282fb6d3422cdebf88ba2d9ce0831af.exe"C:\Users\Admin\AppData\Local\Temp\0282fb6d3422cdebf88ba2d9ce0831af.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
184KB
-
-
Filesize
3.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
56KB
-
Filesize
4KB
-
Filesize
716KB
-
Filesize
436KB