Analysis
- max time kernel
63s - max time network
148s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
11/11/2021, 16:54
General
- Target ab00b875e9d7ec4065d7dbbda08d474a.exe
- Size 510KB
- Sample211111-vejpqsbfh9
- SHA256 0789b4aec138cf9c5bc3b01774fc8ed075dadf40c8ecf97058c201c9de22160e
Malware Config
Extracted
-
formbook
-
4.1
-
e6b3
-
http://www.xn--7tq168cfwa.xn--6qq986b3xl/e6b3/
-
kojiphotography.press
-
segunadebayoestates.com
-
app330.com
-
drivenwaxshop.com
-
bocatasystem.com
-
lagalamasin.com
-
vsajobs.net
-
logos-performance.com
-
leadershuttle.net
-
kubanitka.com
-
teamosu.club
-
w0lgzcir2.com
-
cornwall-surf.com
-
melokuq.xyz
-
angelob.xyz
-
gnomelf.com
-
whale-capture19700823.space
-
highclear.xyz
-
hwadamgallery.com
-
teayes2014.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ab00b875e9d7ec4065d7dbbda08d474a.exe"C:\Users\Admin\AppData\Local\Temp\ab00b875e9d7ec4065d7dbbda08d474a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ab00b875e9d7ec4065d7dbbda08d474a.exeC:\Users\Admin\AppData\Local\Temp\ab00b875e9d7ec4065d7dbbda08d474a.exe2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1480-122-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1480-124-0x0000000001890000-0x0000000001BB0000-memory.dmp
memory/3592-115-0x0000000000F90000-0x0000000000F91000-memory.dmp
memory/3592-117-0x0000000005840000-0x0000000005841000-memory.dmp
memory/3592-118-0x0000000005870000-0x00000000058D9000-memory.dmp
memory/3592-119-0x0000000005950000-0x0000000005951000-memory.dmp
memory/3592-120-0x0000000006100000-0x0000000006101000-memory.dmp
memory/3592-121-0x0000000005920000-0x000000000594F000-memory.dmp