Analysis
- max time kernel
55s - max time network
124s - platform
windows10_x64 - resource
win10v20210408 - submitted
23/08/2021, 06:25
General
- Target a576607b8a3089dea60d25f123fedfe1.exe
- Size 844KB
- Sample210823-7ebmfhwln2
- SHA256 501242ffaabd951fbd62a6b12cfe8955915f65acc7d6c99effd41366054ccdca
Malware Config
Extracted
-
formbook
-
4.1
-
gz92
-
http://www.peggeorge.com/gz92/
-
ayurvedichealthformulas.com
-
plazaconstrutora.com
-
nat-hetong.info
-
eapdigital.com
-
ibluebaytvwdshop.com
-
committable.com
-
escapesbyek.com
-
mywebdesigner.pro
-
jianianhong.com
-
benvenutoqui.com
-
beiyet.com
-
theartofgifs.com
-
mbwvyksnk.icu
-
nshahwelfare.com
-
hhhservice.com
-
thechaibali.com
-
travelscreen.expert
-
best123-movies.com
-
leiahin.com
-
runplay11.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a576607b8a3089dea60d25f123fedfe1.exe"C:\Users\Admin\AppData\Local\Temp\a576607b8a3089dea60d25f123fedfe1.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a576607b8a3089dea60d25f123fedfe1.exe"C:\Users\Admin\AppData\Local\Temp\a576607b8a3089dea60d25f123fedfe1.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/628-114-0x0000000000150000-0x0000000000151000-memory.dmp
memory/628-116-0x0000000004A20000-0x0000000004A21000-memory.dmp
memory/628-117-0x0000000004FC0000-0x0000000004FC1000-memory.dmp
memory/628-118-0x0000000004B60000-0x0000000004B61000-memory.dmp
memory/628-119-0x0000000004AE0000-0x0000000004AE1000-memory.dmp
memory/628-120-0x0000000004D60000-0x0000000004D61000-memory.dmp
memory/628-121-0x0000000004AC0000-0x0000000004FBE000-memory.dmp
memory/628-122-0x0000000006F20000-0x0000000006F31000-memory.dmp
memory/628-123-0x00000000070D0000-0x0000000007176000-memory.dmp
memory/628-124-0x00000000097F0000-0x0000000009828000-memory.dmp
memory/2664-125-0x0000000000400000-0x000000000042E000-memory.dmp
memory/2664-127-0x00000000010F0000-0x0000000001410000-memory.dmp