Analysis
- max time kernel
146s - max time network
135s - platform
windows10_x64 - resource
win10v20210408 - submitted
13/10/2021, 09:42
General
- Target 7b57c26a8208756f37e8df8331f94610.exe
- Size 605KB
- Sample211013-lpc59sdhe7
- SHA256 0cf11de8a0ce67a46203ae419f2aa7bb988ae3088dc4f33158dccc55b97e4a7d
Malware Config
Extracted
-
formbook
-
4.1
-
kzk9
-
http://www.yourmajordomo.com/kzk9/
-
tianconghuo.club
-
1996-page.com
-
ourtownmax.net
-
conservativetreehose.com
-
synth.repair
-
donnachicacreperia.com
-
tentfull.com
-
weapp.download
-
surfersink.com
-
gattlebusinessservices.com
-
sebastian249.com
-
anhphuc.company
-
betternatureproducts.net
-
defroplate.com
-
seattlesquidsquad.com
-
polarjob.com
-
lendingadvantage.com
-
angelsondope.com
-
goportjitney.com
-
tiendagrupojagr.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b57c26a8208756f37e8df8331f94610.exe"C:\Users\Admin\AppData\Local\Temp\7b57c26a8208756f37e8df8331f94610.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7b57c26a8208756f37e8df8331f94610.exe"C:\Users\Admin\AppData\Local\Temp\7b57c26a8208756f37e8df8331f94610.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/860-114-0x0000000000D10000-0x0000000000D11000-memory.dmp
memory/860-116-0x0000000005C20000-0x0000000005C21000-memory.dmp
memory/860-117-0x00000000057C0000-0x00000000057C1000-memory.dmp
memory/860-118-0x0000000005720000-0x0000000005721000-memory.dmp
memory/860-119-0x0000000005720000-0x0000000005C1E000-memory.dmp
memory/860-120-0x00000000058F0000-0x00000000058F5000-memory.dmp
memory/860-121-0x0000000007B70000-0x0000000007B71000-memory.dmp
memory/860-122-0x0000000007C90000-0x0000000007D04000-memory.dmp
memory/1888-123-0x0000000000400000-0x000000000042E000-memory.dmp
memory/1888-125-0x00000000019C0000-0x0000000001CE0000-memory.dmp