Analysis
- max time kernel
50s - max time network
137s - platform
windows10_x64 - resource
win10-en - submitted
03/09/2021, 19:10
General
- Target 5b5276e6117204297cf817fee27e16d4.exe
- Size 651KB
- Sample210903-xvc81agfgl
- SHA256 4c5fd4ed6d7eda044f08d5369dd3ac130ae1e7d2f8415a77ebbc8010e2fe7c11
Malware Config
Extracted
-
formbook
-
4.1
-
gz92
-
http://www.peggeorge.com/gz92/
-
ayurvedichealthformulas.com
-
plazaconstrutora.com
-
nat-hetong.info
-
eapdigital.com
-
ibluebaytvwdshop.com
-
committable.com
-
escapesbyek.com
-
mywebdesigner.pro
-
jianianhong.com
-
benvenutoqui.com
-
beiyet.com
-
theartofgifs.com
-
mbwvyksnk.icu
-
nshahwelfare.com
-
hhhservice.com
-
thechaibali.com
-
travelscreen.expert
-
best123-movies.com
-
leiahin.com
-
runplay11.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b5276e6117204297cf817fee27e16d4.exe"C:\Users\Admin\AppData\Local\Temp\5b5276e6117204297cf817fee27e16d4.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5b5276e6117204297cf817fee27e16d4.exe"C:\Users\Admin\AppData\Local\Temp\5b5276e6117204297cf817fee27e16d4.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\5b5276e6117204297cf817fee27e16d4.exe"C:\Users\Admin\AppData\Local\Temp\5b5276e6117204297cf817fee27e16d4.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1840-125-0x0000000000400000-0x000000000042E000-memory.dmp
memory/1840-127-0x0000000000FC0000-0x00000000012E0000-memory.dmp
memory/3168-115-0x0000000000C70000-0x0000000000C71000-memory.dmp
memory/3168-117-0x0000000005A00000-0x0000000005A01000-memory.dmp
memory/3168-118-0x00000000055A0000-0x00000000055A1000-memory.dmp
memory/3168-119-0x0000000005550000-0x0000000005551000-memory.dmp
memory/3168-120-0x0000000007960000-0x0000000007961000-memory.dmp
memory/3168-121-0x00000000057C0000-0x00000000057D6000-memory.dmp
memory/3168-122-0x0000000005500000-0x00000000059FE000-memory.dmp
memory/3168-123-0x0000000007B00000-0x0000000007B60000-memory.dmp
memory/3168-124-0x000000000A1A0000-0x000000000A1CF000-memory.dmp