Analysis
- max time kernel
105s - max time network
125s - platform
windows10_x64 - resource
win10-en-20211104 - submitted
22/11/2021, 13:41
General
- Target 897cd255db770c4a0e0ef4b5e01e65c3.exe
- Size 724KB
- Sample211122-qy4f2affap
- SHA256 4253f88eb5e931720c16e56f49babfbf8db93eaa8b6f85146cc2d690aee2b9d2
Malware Config
Extracted
-
formbook
-
4.1
-
cy88
-
http://www.jamesobrien.school/cy88/
-
kj4senate.com
-
emaratishayclub.com
-
digitalpathologytodayuk.com
-
solofirepits.com
-
electronicsflare.com
-
antlersinternational.biz
-
aspirastic.com
-
aqrd.top
-
riversidebest.com
-
jointly.men
-
hostelstyle.com
-
lineupfacts.com
-
shibawire.com
-
africhips.com
-
zbyrhb.com
-
safelywininfo.online
-
antidesign.xyz
-
miramar.press
-
truthaboutjointhealth.com
-
chinadaen.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\897cd255db770c4a0e0ef4b5e01e65c3.exe"C:\Users\Admin\AppData\Local\Temp\897cd255db770c4a0e0ef4b5e01e65c3.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\897cd255db770c4a0e0ef4b5e01e65c3.exe"C:\Users\Admin\AppData\Local\Temp\897cd255db770c4a0e0ef4b5e01e65c3.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\897cd255db770c4a0e0ef4b5e01e65c3.exe"C:\Users\Admin\AppData\Local\Temp\897cd255db770c4a0e0ef4b5e01e65c3.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2032-128-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2032-130-0x0000000001580000-0x00000000018A0000-memory.dmp
memory/2672-118-0x00000000007A0000-0x00000000007A1000-memory.dmp
memory/2672-120-0x0000000005650000-0x0000000005651000-memory.dmp
memory/2672-121-0x00000000051F0000-0x00000000051F1000-memory.dmp
memory/2672-122-0x00000000051C0000-0x00000000051C1000-memory.dmp
memory/2672-123-0x00000000051E0000-0x00000000051E4000-memory.dmp
memory/2672-124-0x00000000054C0000-0x00000000054C1000-memory.dmp
memory/2672-125-0x0000000005150000-0x000000000564E000-memory.dmp
memory/2672-126-0x00000000060F0000-0x00000000060F1000-memory.dmp
memory/2672-127-0x0000000006190000-0x00000000061F0000-memory.dmp