Analysis
- max time kernel
83s - max time network
115s - platform
windows10_x64 - resource
win10v20210410 - submitted
06/07/2021, 09:12
General
- Target c71f136a10c7c2f067f0a551a48f8ff6.exe
- Size 886KB
- Sample210706-ryfw9se35x
- SHA256 8a8cc0347be5e13c27bbb82822db989e8c47896d8e23944a8f5f419f4b6989ee
Malware Config
Extracted
-
formbook
-
4.1
-
http://www.share-event.info/wlns/
-
travelagentngapali.com
-
cassandraclub.com
-
yuanhenghuanwei.com
-
rellimsewil.com
-
servingsunshine.com
-
guniverse.net
-
livingonresidual.net
-
fourmid.com
-
batesandmills.com
-
produtos-servicos.website
-
pokemonteambuilder.team
-
ticeye.com
-
latituderc.com
-
xn--ok0bv0wfrj.com
-
strinix.com
-
nycmama.com
-
sljy8888.com
-
lifeinsurancerd.com
-
osdbapi.com
-
xydwnzavp.asia
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c71f136a10c7c2f067f0a551a48f8ff6.exe"C:\Users\Admin\AppData\Local\Temp\c71f136a10c7c2f067f0a551a48f8ff6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c71f136a10c7c2f067f0a551a48f8ff6.exe"C:\Users\Admin\AppData\Local\Temp\c71f136a10c7c2f067f0a551a48f8ff6.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3660-125-0x0000000000400000-0x000000000042E000-memory.dmp
memory/3660-128-0x00000000018F0000-0x0000000001C10000-memory.dmp
memory/3944-121-0x0000000005740000-0x0000000005C3E000-memory.dmp
memory/3944-119-0x00000000056C0000-0x00000000056C1000-memory.dmp
memory/3944-120-0x0000000005970000-0x0000000005971000-memory.dmp
memory/3944-114-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/3944-122-0x0000000005A10000-0x0000000005A1F000-memory.dmp
memory/3944-123-0x0000000008EB0000-0x0000000008F2A000-memory.dmp
memory/3944-124-0x000000000B520000-0x000000000B561000-memory.dmp
memory/3944-118-0x00000000057E0000-0x00000000057E1000-memory.dmp
memory/3944-117-0x0000000005C40000-0x0000000005C41000-memory.dmp
memory/3944-116-0x0000000005620000-0x0000000005621000-memory.dmp