Analysis
- max time kernel
54s - max time network
45s - platform
windows7_x64 - resource
win7v20210408 - submitted
08/09/2021, 11:02
General
- Target 1762e252c0b3c0fa4690e7a4f829a989.exe
- Size 878KB
- Sample210908-m45phahedn
- SHA256 a56e9e3fc6d7b412b1e9cf5dff739358849779b3c80df268ade3d9da79bd5da5
Malware Config
Extracted
-
formbook
-
4.1
-
gz92
-
http://www.peggeorge.com/gz92/
-
ayurvedichealthformulas.com
-
plazaconstrutora.com
-
nat-hetong.info
-
eapdigital.com
-
ibluebaytvwdshop.com
-
committable.com
-
escapesbyek.com
-
mywebdesigner.pro
-
jianianhong.com
-
benvenutoqui.com
-
beiyet.com
-
theartofgifs.com
-
mbwvyksnk.icu
-
nshahwelfare.com
-
hhhservice.com
-
thechaibali.com
-
travelscreen.expert
-
best123-movies.com
-
leiahin.com
-
runplay11.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1762e252c0b3c0fa4690e7a4f829a989.exe"C:\Users\Admin\AppData\Local\Temp\1762e252c0b3c0fa4690e7a4f829a989.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1762e252c0b3c0fa4690e7a4f829a989.exe"C:\Users\Admin\AppData\Local\Temp\1762e252c0b3c0fa4690e7a4f829a989.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/848-66-0x0000000000400000-0x000000000042E000-memory.dmp
memory/848-68-0x0000000000A00000-0x0000000000D03000-memory.dmp
memory/1824-60-0x00000000010F0000-0x00000000010F1000-memory.dmp
memory/1824-62-0x0000000004E60000-0x0000000004E61000-memory.dmp
memory/1824-63-0x00000000003F0000-0x0000000000406000-memory.dmp
memory/1824-64-0x0000000004DE0000-0x0000000004E40000-memory.dmp
memory/1824-65-0x0000000000CA0000-0x0000000000CCF000-memory.dmp