Analysis
- max time kernel
126s - max time network
128s - platform
windows10_x64 - resource
win10-en-20210920 - submitted
30/10/2021, 06:46
General
- Target b87f81920e06301937deb513ff65bf91.exe
- Size 403KB
- Sample211030-hjns2aefa2
- SHA256 8aa346b87c8d3d53fb5265cd0c04bbd3c8c978b7e1eb7b2e0958c078322d75e9
Malware Config
Extracted
-
formbook
-
4.1
-
s18y
-
http://www.agentpathleurre.space/s18y/
-
jokes-online.com
-
dzzdjn.com
-
lizzieerhardtebnaryepptts.com
-
interfacehand.xyz
-
sale-m.site
-
block-facebook.com
-
dicasdamadrinha.com
-
maythewind.com
-
hasari.net
-
omnists.com
-
thevalley-eg.com
-
rdfj.xyz
-
szhfcy.com
-
alkalineage.club
-
fdf.xyz
-
absorplus.com
-
poldolongo.com
-
badassshirts.club
-
ferienwohnungenmv.com
-
bilboondokoak.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b87f81920e06301937deb513ff65bf91.exe"C:\Users\Admin\AppData\Local\Temp\b87f81920e06301937deb513ff65bf91.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b87f81920e06301937deb513ff65bf91.exe"C:\Users\Admin\AppData\Local\Temp\b87f81920e06301937deb513ff65bf91.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/704-115-0x0000000000BB0000-0x0000000000BB1000-memory.dmp
memory/704-117-0x0000000005A70000-0x0000000005A71000-memory.dmp
memory/704-118-0x0000000005490000-0x0000000005491000-memory.dmp
memory/704-119-0x0000000005570000-0x0000000005A6E000-memory.dmp
memory/704-120-0x0000000005540000-0x0000000005541000-memory.dmp
memory/704-121-0x0000000008AC0000-0x0000000008AC6000-memory.dmp
memory/704-122-0x0000000008AD0000-0x0000000008AD1000-memory.dmp
memory/704-123-0x0000000007250000-0x00000000072A0000-memory.dmp
memory/4656-124-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4656-126-0x00000000017D0000-0x0000000001AF0000-memory.dmp