Analysis
- max time kernel
46s - max time network
148s - platform
windows10_x64 - resource
win10-en - submitted
07/09/2021, 10:09
General
- Target 2c6f2b4f3cf82baa0211f254b07dae0f.exe
- Size 679KB
- Sample210907-l6sbhsffap
- SHA256 c0447d2efa01433e46c26f66e24b9d35fa30c19c13667dc4867c478b71bb95d5
Malware Config
Extracted
-
formbook
-
4.1
-
if60
-
http://www.lanhaiguotou.com/if60/
-
dutaaksarawedar.com
-
conflicttech.com
-
growinfant.com
-
desingchiro.com
-
juicykingcrabexpress1111.com
-
christal-capital.com
-
mythicspacex.com
-
eezeecompliance.com
-
smartpro-apps.com
-
foliapaper.com
-
decor-galorec.com
-
wednesdaywinetime.com
-
ecnstore.com
-
icitycompany.com
-
kokaabrows.com
-
edwardmillerplumbing.com
-
nasiratusa.net
-
thaicafeirvine.com
-
serviceinnovation.net
-
freedigilife.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c6f2b4f3cf82baa0211f254b07dae0f.exe"C:\Users\Admin\AppData\Local\Temp\2c6f2b4f3cf82baa0211f254b07dae0f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2c6f2b4f3cf82baa0211f254b07dae0f.exe"C:\Users\Admin\AppData\Local\Temp\2c6f2b4f3cf82baa0211f254b07dae0f.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4316-125-0x0000000000400000-0x000000000042E000-memory.dmp
memory/4316-127-0x00000000014B0000-0x00000000017D0000-memory.dmp
memory/4684-115-0x0000000000850000-0x0000000000851000-memory.dmp
memory/4684-117-0x0000000005790000-0x0000000005791000-memory.dmp
memory/4684-118-0x0000000002E70000-0x0000000002E71000-memory.dmp
memory/4684-119-0x0000000002CC0000-0x0000000002D52000-memory.dmp
memory/4684-120-0x0000000002CD0000-0x0000000002CD1000-memory.dmp
memory/4684-121-0x0000000005390000-0x00000000053A6000-memory.dmp
memory/4684-122-0x0000000006D90000-0x0000000006D91000-memory.dmp
memory/4684-123-0x000000000C8E0000-0x000000000C945000-memory.dmp
memory/4684-124-0x000000000F3E0000-0x000000000F40F000-memory.dmp