Analysis
- max time kernel
74s - max time network
23s - platform
windows7_x64 - resource
win7-en-20210920 - submitted
27/09/2021, 08:30
General
- Target 7572fbc5de30359e833d6f382db286fa.exe
- Size 843KB
- Sample210927-kd8blagbd9
- SHA256 1758a9b18032ce82f4e95249413ee1a8cbade1ef2cb773bc958502801f3af738
Malware Config
Extracted
-
formbook
-
4.1
-
if60
-
http://www.handelsbetriebposavec.com/if60/
-
babyjames.space
-
dtjug.com
-
bhagteri.com
-
havplan.com
-
gentlesuccess.net
-
negativeminus.com
-
utesm.com
-
ngomen.online
-
abohemianeducation.com
-
hyper-quote.com
-
poseidonflooring.com
-
theshopdental.com
-
consumelocaloficial.com
-
tineue.com
-
traerpolio.com
-
somnambulantfarms.com
-
sugarhillclassiccars.com
-
brasseriedufayard.com
-
replacerglass.net
-
lazyguysmarketing.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7572fbc5de30359e833d6f382db286fa.exe"C:\Users\Admin\AppData\Local\Temp\7572fbc5de30359e833d6f382db286fa.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7572fbc5de30359e833d6f382db286fa.exe"C:\Users\Admin\AppData\Local\Temp\7572fbc5de30359e833d6f382db286fa.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/848-53-0x0000000000250000-0x0000000000251000-memory.dmp
memory/848-55-0x0000000000440000-0x0000000000441000-memory.dmp
memory/848-56-0x0000000000480000-0x0000000000487000-memory.dmp
memory/848-57-0x0000000007E50000-0x0000000007EB4000-memory.dmp
memory/848-58-0x0000000000840000-0x0000000000874000-memory.dmp
memory/1544-59-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1544-61-0x0000000000AC0000-0x0000000000DC3000-memory.dmp