Analysis
- max time kernel
49s - max time network
114s - platform
windows10_x64 - resource
win10v20210410 - submitted
18/08/2021, 14:30
General
- Target c0d461ef0985e5200de25a231d15845e.exe
- Size 901KB
- Sample210818-dmenb7g46n
- SHA256 006dac8da13a28a8c98c6ec8ef112ee55544e0c4676cd2ffb393cb3cd66ebe15
Malware Config
Extracted
-
formbook
-
4.1
-
gz92
-
http://www.peggeorge.com/gz92/
-
ayurvedichealthformulas.com
-
plazaconstrutora.com
-
nat-hetong.info
-
eapdigital.com
-
ibluebaytvwdshop.com
-
committable.com
-
escapesbyek.com
-
mywebdesigner.pro
-
jianianhong.com
-
benvenutoqui.com
-
beiyet.com
-
theartofgifs.com
-
mbwvyksnk.icu
-
nshahwelfare.com
-
hhhservice.com
-
thechaibali.com
-
travelscreen.expert
-
best123-movies.com
-
leiahin.com
-
runplay11.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c0d461ef0985e5200de25a231d15845e.exe"C:\Users\Admin\AppData\Local\Temp\c0d461ef0985e5200de25a231d15845e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c0d461ef0985e5200de25a231d15845e.exe"C:\Users\Admin\AppData\Local\Temp\c0d461ef0985e5200de25a231d15845e.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3916-124-0x0000000000400000-0x000000000042E000-memory.dmp
memory/3916-126-0x0000000001280000-0x00000000015A0000-memory.dmp
memory/3928-114-0x0000000000880000-0x0000000000881000-memory.dmp
memory/3928-116-0x00000000056B0000-0x00000000056B1000-memory.dmp
memory/3928-117-0x00000000051B0000-0x00000000051B1000-memory.dmp
memory/3928-118-0x0000000005310000-0x0000000005311000-memory.dmp
memory/3928-119-0x0000000005460000-0x0000000005461000-memory.dmp
memory/3928-120-0x0000000005320000-0x0000000005331000-memory.dmp
memory/3928-121-0x00000000051B0000-0x00000000056AE000-memory.dmp
memory/3928-122-0x0000000006020000-0x00000000060D1000-memory.dmp
memory/3928-123-0x00000000085A0000-0x00000000085E3000-memory.dmp