Analysis
- max time kernel
137s - max time network
138s - platform
windows7_x64 - resource
win7-en - submitted
07/09/2021, 10:09
General
- Target 2c6f2b4f3cf82baa0211f254b07dae0f.exe
- Size 679KB
- Sample210907-l6sbhsffap
- SHA256 c0447d2efa01433e46c26f66e24b9d35fa30c19c13667dc4867c478b71bb95d5
Malware Config
Extracted
-
formbook
-
4.1
-
if60
-
http://www.lanhaiguotou.com/if60/
-
dutaaksarawedar.com
-
conflicttech.com
-
growinfant.com
-
desingchiro.com
-
juicykingcrabexpress1111.com
-
christal-capital.com
-
mythicspacex.com
-
eezeecompliance.com
-
smartpro-apps.com
-
foliapaper.com
-
decor-galorec.com
-
wednesdaywinetime.com
-
ecnstore.com
-
icitycompany.com
-
kokaabrows.com
-
edwardmillerplumbing.com
-
nasiratusa.net
-
thaicafeirvine.com
-
serviceinnovation.net
-
freedigilife.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c6f2b4f3cf82baa0211f254b07dae0f.exe"C:\Users\Admin\AppData\Local\Temp\2c6f2b4f3cf82baa0211f254b07dae0f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2c6f2b4f3cf82baa0211f254b07dae0f.exe"C:\Users\Admin\AppData\Local\Temp\2c6f2b4f3cf82baa0211f254b07dae0f.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/528-58-0x0000000000400000-0x000000000042E000-memory.dmp
memory/528-60-0x0000000000AF0000-0x0000000000DF3000-memory.dmp
memory/1984-52-0x00000000008B0000-0x00000000008B1000-memory.dmp
memory/1984-54-0x0000000004CF0000-0x0000000004CF1000-memory.dmp
memory/1984-55-0x00000000004B0000-0x00000000004C6000-memory.dmp
memory/1984-56-0x0000000005A30000-0x0000000005A95000-memory.dmp
memory/1984-57-0x0000000002240000-0x000000000226F000-memory.dmp