Analysis
-
max time kernel
151s -
max time network
148s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
09-05-2021 10:03
General
-
Target
Confirm!!!.exe
-
Size
1.1MB
-
MD5
7afd3b350ea6451b47be2058c07365de
-
SHA1
8186d625b6f406d71a27aa8ef51f52902c5c26f0
-
SHA256
540021aa05d8985bf6eca783d86cdada2727b5ed0b1a943cb9cdfb224a4e50f1
-
SHA512
02a7ec42b3d9c9f6e6b1538406b08fccd1a661c05d62b89a211443bad25acf520d78711906009f1215647971e6d7e8a65fddbe06efcc32c438e0b7e8b53d34d1
Malware Config
Extracted
formbook
4.1
http://www.deuxus.com/t052/
ladybug-learning.com
unforgottenstory.com
oldmopaiv.xyz
natashaexim.com
hannahmcelgunn.com
retargetingmachines.info
njoconline.com
unicornlankadelivery.com
giftkerala.com
englishfordoctors.online
schatzilandrvresort.com
brujoisaac.com
basiccampinggear.com
escapees.today
dgyxsy888.com
stevebana.xyz
mimozakebap.com
ezdoff.com
pluumyspalace.com
shaoshanshan.com
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload 3 IoCs
-
Suspicious use of SetThreadContext 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 21 IoCs
-
Suspicious behavior: MapViewOfSection 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Confirm!!!.exe"C:\Users\Admin\AppData\Local\Temp\Confirm!!!.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Confirm!!!.exe"C:\Users\Admin\AppData\Local\Temp\Confirm!!!.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Confirm!!!.exe"C:\Users\Admin\AppData\Local\Temp\Confirm!!!.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Confirm!!!.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
56KB
-
Filesize
500KB
-
Filesize
224KB
-
Filesize
4KB
-
-
Filesize
932KB
-
Filesize
1.3MB
-
Filesize
184KB
-
Filesize
1.3MB
-
Filesize
3.1MB
-
-
-
Filesize
184KB
-
Filesize
48KB
-
Filesize
3.1MB
-
Filesize
588KB