Analysis
- max time kernel
121s - max time network
124s - platform
windows10_x64 - resource
win10-en-20211104 - submitted
11/11/2021, 18:48
General
- Target 5951b00de1dbba519c0bbef33494ced3.exe
- Size 598KB
- Sample211111-xfsedahafj
- SHA256 cf8ab312ec2e263777fd777cdc2f714c18d259241bfeec9dbe6eb4ac62708f7f
Malware Config
Extracted
-
formbook
-
4.1
-
ad6n
-
http://www.didimthebestkuafor.com/ad6n/
-
silzqmz.xyz
-
westwardcraftcompany.com
-
roomandroofrealtors.com
-
yellayellayella.com
-
cichoice.com
-
xxtjzmzzahg.com
-
getmavin.com
-
homestylewood.com
-
vlab.group
-
klaesi.net
-
casainbox.com
-
hbjj2a.com
-
viettelbinhduongsieutoc4.online
-
itftravelcoach.com
-
6fapp142.com
-
before-hage.com
-
onbiine.sbs
-
lyhdyhc.com
-
matt-nagy.com
-
ipwertoe.xyz
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5951b00de1dbba519c0bbef33494ced3.exe"C:\Users\Admin\AppData\Local\Temp\5951b00de1dbba519c0bbef33494ced3.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5951b00de1dbba519c0bbef33494ced3.exe"C:\Users\Admin\AppData\Local\Temp\5951b00de1dbba519c0bbef33494ced3.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/432-127-0x0000000000400000-0x000000000042F000-memory.dmp
memory/432-129-0x00000000011B0000-0x00000000014D0000-memory.dmp
memory/3748-118-0x0000000000120000-0x0000000000121000-memory.dmp
memory/3748-120-0x0000000005020000-0x0000000005021000-memory.dmp
memory/3748-121-0x0000000004A20000-0x0000000004A21000-memory.dmp
memory/3748-122-0x00000000049F0000-0x00000000049F1000-memory.dmp
memory/3748-123-0x0000000004B20000-0x000000000501E000-memory.dmp
memory/3748-124-0x0000000004F50000-0x0000000004F55000-memory.dmp
memory/3748-125-0x00000000057C0000-0x00000000057C1000-memory.dmp
memory/3748-126-0x0000000005770000-0x00000000057BD000-memory.dmp