Analysis
- max time kernel
120s - max time network
122s - platform
windows10_x64 - resource
win10v20210410 - submitted
07/05/2021, 04:04
General
- Target SecuriteInfo.com.Trojan.Win32.Save.a.9130.4062.exe
- Size 913KB
- Sample210507-3m1wgew23e
- SHA256 7653e46e3326fbabf9e534cbd02600f87ad38b5c9e4e175a60e27a6d90c5e6fe
Malware Config
Extracted
-
formbook
-
4.1
-
http://www.conciergedoctx.com/ot8m/
-
digiclan.net
-
songlautramtuoii.online
-
miracleseedproducts.com
-
taniacastillo.com
-
essentialme.network
-
charmcitydetour.com
-
suprekopis.com
-
jimmycollier.com
-
thrifteee.com
-
rhmachinery.ltd
-
the05project.com
-
altfacebookalt.com
-
ein-herz-fuer-holz.com
-
kingohost.com
-
vmarines.com
-
2bestudio.com
-
triducdv.com
-
kp-transport.com
-
mybostonhwart.com
-
benzcat.net
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Win32.Save.a.9130.4062.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Win32.Save.a.9130.4062.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Win32.Save.a.9130.4062.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3028-124-0x0000000000400000-0x000000000042E000-memory.dmp
memory/3028-127-0x0000000001710000-0x0000000001A30000-memory.dmp
memory/3680-114-0x0000000000B10000-0x0000000000B11000-memory.dmp
memory/3680-116-0x00000000080C0000-0x00000000080C1000-memory.dmp
memory/3680-117-0x00000000079B0000-0x00000000079B1000-memory.dmp
memory/3680-118-0x0000000007CA0000-0x0000000007CA1000-memory.dmp
memory/3680-119-0x0000000007E10000-0x0000000007E11000-memory.dmp
memory/3680-120-0x000000000B2D0000-0x000000000B2D1000-memory.dmp
memory/3680-121-0x0000000002E70000-0x0000000002E7E000-memory.dmp
memory/3680-122-0x0000000005740000-0x00000000057CF000-memory.dmp
memory/3680-123-0x0000000005DD0000-0x0000000005E14000-memory.dmp