Analysis
- max time kernel
110s - max time network
124s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
21/10/2021, 19:48
General
- Target 664920ea617d6c5f15c228b7374aa15f.exe
- Size 482KB
- Sample211021-yh4e4abfbj
- SHA256 65acd8c73c518c97a1539bc8e3f62fb8f06431d7030c6cc1463c855aec0ec46f
Malware Config
Extracted
-
formbook
-
4.1
-
s18y
-
http://www.agentpathleurre.space/s18y/
-
jokes-online.com
-
dzzdjn.com
-
lizzieerhardtebnaryepptts.com
-
interfacehand.xyz
-
sale-m.site
-
block-facebook.com
-
dicasdamadrinha.com
-
maythewind.com
-
hasari.net
-
omnists.com
-
thevalley-eg.com
-
rdfj.xyz
-
szhfcy.com
-
alkalineage.club
-
fdf.xyz
-
absorplus.com
-
poldolongo.com
-
badassshirts.club
-
ferienwohnungenmv.com
-
bilboondokoak.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\664920ea617d6c5f15c228b7374aa15f.exe"C:\Users\Admin\AppData\Local\Temp\664920ea617d6c5f15c228b7374aa15f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\664920ea617d6c5f15c228b7374aa15f.exe"C:\Users\Admin\AppData\Local\Temp\664920ea617d6c5f15c228b7374aa15f.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/68-124-0x0000000000400000-0x000000000042F000-memory.dmp
memory/68-126-0x00000000014B0000-0x00000000017D0000-memory.dmp
memory/1172-115-0x0000000000350000-0x0000000000351000-memory.dmp
memory/1172-117-0x0000000005240000-0x0000000005241000-memory.dmp
memory/1172-118-0x0000000004C40000-0x0000000004C41000-memory.dmp
memory/1172-119-0x0000000004C00000-0x0000000004C01000-memory.dmp
memory/1172-120-0x0000000004D40000-0x000000000523E000-memory.dmp
memory/1172-121-0x0000000004C30000-0x0000000004C37000-memory.dmp
memory/1172-122-0x00000000059E0000-0x00000000059E1000-memory.dmp
memory/1172-123-0x00000000051F0000-0x0000000005240000-memory.dmp