Analysis
-
max time kernel
136s -
max time network
139s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
10-05-2021 06:54
General
-
Target
Quotation_23642828687267892387.xls.exe
-
Size
710KB
-
MD5
f0e2e2dbb34dbdecb3ce6a3a885e89d5
-
SHA1
f52c0691574ac454d5bbd50cfe470218b6ad906f
-
SHA256
ee913da4f5fe43bc6f2457ce36d9364d4b9f7a79adb71dab617ca1dfde879377
-
SHA512
c3c7e4ba5006551649fd9c18ea8ba6464917746546054205b2839c5ae2f31070d7e27682d7ce90aaf84063fe1fb6f1c756967e755b7d5f8fac54f86605e4f2c4
Malware Config
Extracted
formbook
4.1
http://www.angelgirlm.com/c7jh/
melangearte.com
nuaphraka.com
sharongold.net
seriouslysimpledesigns.com
17mpacc.com
customwareperu.com
styleofbliss.com
myvardenafilok.com
anwarnews.net
therecruiterroute.net
wxgdds.com
bmgblve.com
hotel-montmartre.com
ujasiriisihawu.com
childs.farm
landscapesofcapital.com
carolecares.com
wesarzamin.com
yinleba.com
partnershrsolutions.com
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Quotation_23642828687267892387.xls.exe"C:\Users\Admin\AppData\Local\Temp\Quotation_23642828687267892387.xls.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Quotation_23642828687267892387.xls.exe"C:\Users\Admin\AppData\Local\Temp\Quotation_23642828687267892387.xls.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
184KB
-
Filesize
3.1MB
-
-
Filesize
5.0MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
56KB
-
Filesize
528KB
-
Filesize
244KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB