Analysis
- max time kernel
121s - max time network
126s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
14/12/2021, 16:49
General
- Target 5a5121a0040f1f9492b661b709ce42a6.exe
- Size 1.3MB
- Sample211214-vbnvaagbc3
- SHA256 58d05ac8e9716f4322f5d39d676a3415c7f499e99c8fa5d920bbbecdb4a616b7
Malware Config
Extracted
-
formbook
-
4.1
-
c3f6
-
http://www.www-supportfindmy.com/c3f6/
-
blocksswap.com
-
handywomanpr.com
-
zonderstore.com
-
mertradingbv.com
-
rounuatedanximum.com
-
atozfinance.store
-
pokercoaching.pro
-
spypackz9.com
-
emonk.xyz
-
brendayesteban.com
-
monster-area.com
-
choosetruewellness.com
-
outletint.xyz
-
kurashiki-menkyo.com
-
tooktamilnadu.com
-
wxt08.xyz
-
lojascomprasonline.com
-
suufj.xyz
-
louisebrimble.com
-
jodkmans.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a5121a0040f1f9492b661b709ce42a6.exe"C:\Users\Admin\AppData\Local\Temp\5a5121a0040f1f9492b661b709ce42a6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5a5121a0040f1f9492b661b709ce42a6.exe"C:\Users\Admin\AppData\Local\Temp\5a5121a0040f1f9492b661b709ce42a6.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/528-115-0x00000000003C0000-0x00000000003C1000-memory.dmp
memory/528-117-0x0000000005350000-0x0000000005351000-memory.dmp
memory/528-118-0x0000000004D60000-0x0000000004D61000-memory.dmp
memory/528-119-0x0000000004E50000-0x000000000534E000-memory.dmp
memory/528-120-0x0000000004D40000-0x0000000004D41000-memory.dmp
memory/528-121-0x0000000004FE0000-0x0000000004FE8000-memory.dmp
memory/528-122-0x00000000071D0000-0x00000000071D1000-memory.dmp
memory/528-123-0x0000000007540000-0x0000000007541000-memory.dmp
memory/528-124-0x0000000007870000-0x00000000079CA000-memory.dmp
memory/668-125-0x0000000000400000-0x000000000042F000-memory.dmp
memory/668-127-0x0000000001400000-0x0000000001720000-memory.dmp