Analysis
- max time kernel
68s - max time network
71s - platform
windows10_x64 - resource
win10v20210408 - submitted
27/09/2021, 08:30
General
- Target 7572fbc5de30359e833d6f382db286fa.exe
- Size 843KB
- Sample210927-kd8blagbd9
- SHA256 1758a9b18032ce82f4e95249413ee1a8cbade1ef2cb773bc958502801f3af738
Malware Config
Extracted
-
formbook
-
4.1
-
if60
-
http://www.handelsbetriebposavec.com/if60/
-
babyjames.space
-
dtjug.com
-
bhagteri.com
-
havplan.com
-
gentlesuccess.net
-
negativeminus.com
-
utesm.com
-
ngomen.online
-
abohemianeducation.com
-
hyper-quote.com
-
poseidonflooring.com
-
theshopdental.com
-
consumelocaloficial.com
-
tineue.com
-
traerpolio.com
-
somnambulantfarms.com
-
sugarhillclassiccars.com
-
brasseriedufayard.com
-
replacerglass.net
-
lazyguysmarketing.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7572fbc5de30359e833d6f382db286fa.exe"C:\Users\Admin\AppData\Local\Temp\7572fbc5de30359e833d6f382db286fa.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7572fbc5de30359e833d6f382db286fa.exe"C:\Users\Admin\AppData\Local\Temp\7572fbc5de30359e833d6f382db286fa.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/628-114-0x0000000000150000-0x0000000000151000-memory.dmp
memory/628-116-0x0000000004F90000-0x0000000004F91000-memory.dmp
memory/628-117-0x0000000004A90000-0x0000000004A91000-memory.dmp
memory/628-118-0x0000000004A90000-0x0000000004F8E000-memory.dmp
memory/628-119-0x0000000004A60000-0x0000000004A61000-memory.dmp
memory/628-120-0x0000000008080000-0x0000000008081000-memory.dmp
memory/628-121-0x0000000004E60000-0x0000000004E67000-memory.dmp
memory/628-122-0x0000000008700000-0x0000000008701000-memory.dmp
memory/628-123-0x00000000085B0000-0x0000000008614000-memory.dmp
memory/628-124-0x0000000008630000-0x0000000008664000-memory.dmp
memory/768-125-0x0000000000400000-0x000000000042F000-memory.dmp
memory/768-127-0x0000000001A10000-0x0000000001D30000-memory.dmp