Analysis
- max time kernel
121s - max time network
122s - platform
windows10_x64 - resource
win10-en-20211104 - submitted
17/11/2021, 15:35
General
- Target dafce59283b215958f71191b6ec0fc7c.exe
- Size 782KB
- Sample211117-s1ea2aabdj
- SHA256 754a9c7607d3b754e5adab5f2a54a78d7596d2f73096bf4d529012e705cb1230
Malware Config
Extracted
-
formbook
-
4.1
-
ob7y
-
http://www.metanewsroom.net/ob7y/
-
ipsdjf.com
-
mlphntec.com
-
restaurant-day.store
-
writeramylong.com
-
flokigamefi.com
-
usetianyi.xyz
-
punishstrikebreaker.quest
-
ericnfleming.com
-
dhhwtieen.xyz
-
milfhackers.com
-
fewefie.store
-
pithstsdiet.store
-
kirsten-hemmerich.com
-
casinolopoca.com
-
sigag.xyz
-
geilepoes.com
-
metawhatsapp.art
-
sarjin.xyz
-
toprabatte.net
-
lotofbrave.club
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dafce59283b215958f71191b6ec0fc7c.exe"C:\Users\Admin\AppData\Local\Temp\dafce59283b215958f71191b6ec0fc7c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dafce59283b215958f71191b6ec0fc7c.exe"C:\Users\Admin\AppData\Local\Temp\dafce59283b215958f71191b6ec0fc7c.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\dafce59283b215958f71191b6ec0fc7c.exe"C:\Users\Admin\AppData\Local\Temp\dafce59283b215958f71191b6ec0fc7c.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1136-128-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1136-130-0x0000000001700000-0x0000000001A20000-memory.dmp
memory/3348-118-0x00000000008E0000-0x00000000008E1000-memory.dmp
memory/3348-120-0x00000000058E0000-0x00000000058E1000-memory.dmp
memory/3348-121-0x00000000051E0000-0x00000000051E1000-memory.dmp
memory/3348-122-0x0000000002D80000-0x0000000002D81000-memory.dmp
memory/3348-123-0x0000000005350000-0x0000000005351000-memory.dmp
memory/3348-124-0x00000000053C0000-0x00000000053C7000-memory.dmp
memory/3348-125-0x0000000007910000-0x0000000007911000-memory.dmp
memory/3348-126-0x0000000007B00000-0x0000000007B9C000-memory.dmp
memory/3348-127-0x0000000007BA0000-0x0000000007C1A000-memory.dmp