Analysis
- max time kernel
119s - max time network
125s - platform
windows7_x64 - resource
win7-en-20211104 - submitted
12/11/2021, 11:17
General
- Target a183768631f68d124acdc41ae7f952ae.exe
- Size 367KB
- Sample211112-ndp2ssdcf8
- SHA256 4bde2d0abed748c6fb8620ab890cbb09fa5749c4ef749e8cd5c6c7dd40cfd37b
Malware Config
Extracted
-
formbook
-
4.1
-
9gr5
-
http://www.cuteprofessionalscrubs.com/9gr5/
-
newleafcosmetix.com
-
richermanscastle.com
-
ru-remonton.com
-
2diandongche.com
-
federaldados.design
-
jeffreycookweb.com
-
facecs.online
-
xmeclarn.xyz
-
olgasmith.xyz
-
sneakersonlinesale.com
-
playboyshiba.com
-
angelamiglioli.com
-
diitaldefynd.com
-
whenevergames.com
-
mtheartcustom.com
-
vitalactivesupply.com
-
twistblogr.com
-
xn--i8s140at3d6u7c.tel
-
baudelaireelhakim.com
-
real-estate-miami-searcher.site
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a183768631f68d124acdc41ae7f952ae.exe"C:\Users\Admin\AppData\Local\Temp\a183768631f68d124acdc41ae7f952ae.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a183768631f68d124acdc41ae7f952ae.exe"C:\Users\Admin\AppData\Local\Temp\a183768631f68d124acdc41ae7f952ae.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/736-55-0x0000000000DE0000-0x0000000000DE1000-memory.dmp
memory/736-57-0x0000000076341000-0x0000000076343000-memory.dmp
memory/736-58-0x00000000023B0000-0x00000000023B1000-memory.dmp
memory/736-59-0x0000000000530000-0x0000000000535000-memory.dmp
memory/736-60-0x0000000000860000-0x00000000008AC000-memory.dmp
memory/1384-61-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1384-62-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1384-63-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1384-65-0x00000000008C0000-0x0000000000BC3000-memory.dmp