Analysis
- max time kernel
126s - max time network
129s - platform
windows10_x64 - resource
win10-en-20211104 - submitted
22/11/2021, 14:25
General
- Target e9948eccd83e0ad940ba95b465b8d8ca.exe
- Size 720KB
- Sample211122-rrae2sffhr
- SHA256 ecc6439ff97e4b77f3af320e4c224f712478610fd28a1b6e6a03573c4b90f405
Malware Config
Extracted
-
formbook
-
4.1
-
a34b
-
http://www.hdetpnipa.xyz/a34b/
-
mesonarte.com
-
eksiwakun9.xyz
-
dustcollectionconsultant.com
-
heliosarchitecture.com
-
chinaanalysisgroup.com
-
nimbinhillshemp.com
-
ychain.biz
-
mountshastaart.com
-
monstermangoloco.com
-
bodhiandbear.com
-
rootednft.xyz
-
metayema.com
-
zw21.xyz
-
criccketworld.com
-
segurobarato.net
-
ananyacap.com
-
momo-momo.xyz
-
ezrealestatedeals.com
-
ghrde.xyz
-
idimol.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e9948eccd83e0ad940ba95b465b8d8ca.exe"C:\Users\Admin\AppData\Local\Temp\e9948eccd83e0ad940ba95b465b8d8ca.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e9948eccd83e0ad940ba95b465b8d8ca.exe"C:\Users\Admin\AppData\Local\Temp\e9948eccd83e0ad940ba95b465b8d8ca.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\e9948eccd83e0ad940ba95b465b8d8ca.exe"C:\Users\Admin\AppData\Local\Temp\e9948eccd83e0ad940ba95b465b8d8ca.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3628-118-0x0000000000860000-0x0000000000861000-memory.dmp
memory/3628-120-0x0000000005690000-0x0000000005691000-memory.dmp
memory/3628-121-0x0000000005190000-0x0000000005191000-memory.dmp
memory/3628-122-0x0000000005130000-0x0000000005131000-memory.dmp
memory/3628-123-0x0000000005160000-0x0000000005164000-memory.dmp
memory/3628-124-0x00000000055A0000-0x00000000055A1000-memory.dmp
memory/3628-125-0x0000000005190000-0x000000000568E000-memory.dmp
memory/3628-126-0x0000000006030000-0x0000000006031000-memory.dmp
memory/3628-127-0x00000000060D0000-0x0000000006130000-memory.dmp
memory/4364-128-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4364-130-0x0000000000F00000-0x0000000001220000-memory.dmp