Analysis
- max time kernel
82s - max time network
146s - platform
windows10_x64 - resource
win10-en - submitted
08/09/2021, 11:02
General
- Target 1762e252c0b3c0fa4690e7a4f829a989.exe
- Size 878KB
- Sample210908-m45phahedn
- SHA256 a56e9e3fc6d7b412b1e9cf5dff739358849779b3c80df268ade3d9da79bd5da5
Malware Config
Extracted
-
formbook
-
4.1
-
gz92
-
http://www.peggeorge.com/gz92/
-
ayurvedichealthformulas.com
-
plazaconstrutora.com
-
nat-hetong.info
-
eapdigital.com
-
ibluebaytvwdshop.com
-
committable.com
-
escapesbyek.com
-
mywebdesigner.pro
-
jianianhong.com
-
benvenutoqui.com
-
beiyet.com
-
theartofgifs.com
-
mbwvyksnk.icu
-
nshahwelfare.com
-
hhhservice.com
-
thechaibali.com
-
travelscreen.expert
-
best123-movies.com
-
leiahin.com
-
runplay11.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1762e252c0b3c0fa4690e7a4f829a989.exe"C:\Users\Admin\AppData\Local\Temp\1762e252c0b3c0fa4690e7a4f829a989.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1762e252c0b3c0fa4690e7a4f829a989.exe"C:\Users\Admin\AppData\Local\Temp\1762e252c0b3c0fa4690e7a4f829a989.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/764-125-0x0000000000400000-0x000000000042E000-memory.dmp
memory/764-127-0x00000000015F0000-0x0000000001910000-memory.dmp
memory/3556-115-0x00000000000C0000-0x00000000000C1000-memory.dmp
memory/3556-117-0x0000000004F60000-0x0000000004F61000-memory.dmp
memory/3556-118-0x0000000004B00000-0x0000000004B01000-memory.dmp
memory/3556-119-0x00000000025A0000-0x00000000025A1000-memory.dmp
memory/3556-120-0x0000000004AC0000-0x0000000004AD6000-memory.dmp
memory/3556-121-0x0000000006AD0000-0x0000000006AD1000-memory.dmp
memory/3556-122-0x0000000004A60000-0x0000000004F5E000-memory.dmp
memory/3556-123-0x0000000006F60000-0x0000000006FC0000-memory.dmp
memory/3556-124-0x0000000006AA0000-0x0000000006ACF000-memory.dmp