Analysis
- max time kernel
10s - max time network
124s - platform
windows10_x64 - resource
win10v20210410 - submitted
02/08/2021, 06:16
General
- Target 9f61af191c20dc0eb90a92558e74059f.exe
- Size 1.1MB
- Sample210802-2pl6b1d222
- SHA256 b21eb6d14eae70e233132e7fa4e99fb282209f1c6ea8ba4d984e9585ee965e87
Malware Config
Extracted
-
formbook
-
4.1
-
http://www.fortmyerscruisevacation.com/dd2v/
-
jkrqzmeyd.icu
-
cbluedottvwdshop.com
-
yhchen.space
-
premierhealthnwellness.com
-
szkuyaju.com
-
harvestmoonloans.net
-
dadematerial.com
-
mariaclarahairstudio.com
-
hwunvy.online
-
puloutjbmere.com
-
kossu1989.com
-
dubbedos.com
-
ncylis.com
-
hybrid-sol.com
-
travelature.com
-
gracefulcounts.com
-
66secretgarden.com
-
eslonyourcell.com
-
wisersponsorship.com
-
sepn3.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9f61af191c20dc0eb90a92558e74059f.exe"C:\Users\Admin\AppData\Local\Temp\9f61af191c20dc0eb90a92558e74059f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9f61af191c20dc0eb90a92558e74059f.exe"C:\Users\Admin\AppData\Local\Temp\9f61af191c20dc0eb90a92558e74059f.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3300-124-0x0000000000400000-0x000000000042E000-memory.dmp
memory/3300-126-0x00000000010D0000-0x00000000013F0000-memory.dmp
memory/4428-114-0x0000000000900000-0x0000000000901000-memory.dmp
memory/4428-116-0x0000000005740000-0x0000000005741000-memory.dmp
memory/4428-117-0x00000000052E0000-0x00000000052E1000-memory.dmp
memory/4428-118-0x0000000005380000-0x0000000005381000-memory.dmp
memory/4428-119-0x0000000005400000-0x0000000005401000-memory.dmp
memory/4428-120-0x0000000005240000-0x0000000005241000-memory.dmp
memory/4428-121-0x0000000005240000-0x000000000573E000-memory.dmp
memory/4428-122-0x00000000054A0000-0x000000000552B000-memory.dmp
memory/4428-123-0x00000000052B0000-0x00000000052BF000-memory.dmp