Analysis
- max time kernel
6s - max time network
47s - platform
windows7_x64 - resource
win7v20210408 - submitted
02/08/2021, 06:16
General
- Target 9f61af191c20dc0eb90a92558e74059f.exe
- Size 1.1MB
- Sample210802-2pl6b1d222
- SHA256 b21eb6d14eae70e233132e7fa4e99fb282209f1c6ea8ba4d984e9585ee965e87
Malware Config
Extracted
-
formbook
-
4.1
-
http://www.fortmyerscruisevacation.com/dd2v/
-
jkrqzmeyd.icu
-
cbluedottvwdshop.com
-
yhchen.space
-
premierhealthnwellness.com
-
szkuyaju.com
-
harvestmoonloans.net
-
dadematerial.com
-
mariaclarahairstudio.com
-
hwunvy.online
-
puloutjbmere.com
-
kossu1989.com
-
dubbedos.com
-
ncylis.com
-
hybrid-sol.com
-
travelature.com
-
gracefulcounts.com
-
66secretgarden.com
-
eslonyourcell.com
-
wisersponsorship.com
-
sepn3.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9f61af191c20dc0eb90a92558e74059f.exe"C:\Users\Admin\AppData\Local\Temp\9f61af191c20dc0eb90a92558e74059f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9f61af191c20dc0eb90a92558e74059f.exe"C:\Users\Admin\AppData\Local\Temp\9f61af191c20dc0eb90a92558e74059f.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1808-60-0x0000000000AE0000-0x0000000000AE1000-memory.dmp
memory/1808-62-0x0000000004D10000-0x0000000004D11000-memory.dmp
memory/1808-63-0x0000000004B70000-0x0000000004BFB000-memory.dmp
memory/1808-64-0x0000000000280000-0x000000000028F000-memory.dmp
memory/1932-65-0x0000000000400000-0x000000000042E000-memory.dmp
memory/1932-67-0x0000000000C10000-0x0000000000F13000-memory.dmp