Analysis
- max time kernel
47s - max time network
113s - platform
windows10_x64 - resource
win10v20210410 - submitted
10/08/2021, 13:58
General
- Target 790939840cb426b9f163776c2c478966.exe
- Size 831KB
- Sample210810-95fdejpr8e
- SHA256 0ea81e325568a6d5c8ecde8ce0198dabe9553e237ef46b328240d7f51231d3bb
Malware Config
Extracted
-
formbook
-
4.1
-
mxwf
-
http://www.zahnimplantatangebotede.com/mxwf/
-
orders-cialis.info
-
auctionorbuy.com
-
meanmugsamore.com
-
yachtcrewmark.com
-
sacredkashilifestudio.net
-
themintyard.com
-
bragafoods.com
-
sierp.com
-
hausofdeme.com
-
anthonyjames915.com
-
bajardepesoencasa.com
-
marciaroyal.com
-
earringlifter.com
-
dsdjfhd9ddksa1as.info
-
bmzproekt.com
-
employmentbc.com
-
ptsdtreatment.space
-
vrchance.com
-
cnrongding.com
-
welovelit.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\790939840cb426b9f163776c2c478966.exe"C:\Users\Admin\AppData\Local\Temp\790939840cb426b9f163776c2c478966.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\790939840cb426b9f163776c2c478966.exe"C:\Users\Admin\AppData\Local\Temp\790939840cb426b9f163776c2c478966.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4016-126-0x0000000000400000-0x000000000042E000-memory.dmp
memory/4016-128-0x0000000001530000-0x0000000001850000-memory.dmp
memory/4440-121-0x000000000A210000-0x000000000A211000-memory.dmp
memory/4440-119-0x000000000A2B0000-0x000000000A2B1000-memory.dmp
memory/4440-120-0x0000000000C90000-0x0000000000C91000-memory.dmp
memory/4440-114-0x00000000002C0000-0x00000000002C1000-memory.dmp
memory/4440-122-0x0000000004C30000-0x0000000004C31000-memory.dmp
memory/4440-123-0x000000000A6E0000-0x000000000A6F1000-memory.dmp
memory/4440-124-0x000000000D820000-0x000000000D8BE000-memory.dmp
memory/4440-125-0x0000000004F30000-0x0000000004F60000-memory.dmp
memory/4440-118-0x000000000A710000-0x000000000A711000-memory.dmp
memory/4440-117-0x000000000A170000-0x000000000A171000-memory.dmp
memory/4440-116-0x0000000004B80000-0x0000000004C17000-memory.dmp