Analysis
- max time kernel
79s - max time network
126s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
12/01/2022, 10:59
General
- Target 6223b5805cc8ceb0fad786c4bd2f176b.exe
- Size 406KB
- Sample220112-m3efxsccg7
- SHA256 c3e318eafb968f401d5165bb17e765613339ce25e4e48e99ea734580fae06d84
Malware Config
Extracted
-
formbook
-
4.1
-
bt33
-
mbaonlinefreedegress.info
-
myforevermaid.com
-
daoyi365.com
-
weientm.com
-
legal-mx.com
-
formationrigging.com
-
heidiet.xyz
-
school-prosto.store
-
healthvitaminnutrition.com
-
digitalsolutionusa.com
-
little-bazar.com
-
jnbeautycanada.com
-
optoelek.com
-
learntoairmail.com
-
hawkminer.com
-
kingofearth.love
-
ktnstay.xyz
-
zouxin.love
-
mainlandpr.com
-
mamm-hummel.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6223b5805cc8ceb0fad786c4bd2f176b.exe"C:\Users\Admin\AppData\Local\Temp\6223b5805cc8ceb0fad786c4bd2f176b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6223b5805cc8ceb0fad786c4bd2f176b.exe"C:\Users\Admin\AppData\Local\Temp\6223b5805cc8ceb0fad786c4bd2f176b.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1400-125-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1400-127-0x0000000001590000-0x00000000018B0000-memory.dmp
memory/2620-121-0x00000000051F0000-0x000000000528C000-memory.dmp
memory/2620-119-0x0000000004E10000-0x000000000530E000-memory.dmp
memory/2620-120-0x0000000004EA0000-0x0000000004EAA000-memory.dmp
memory/2620-115-0x0000000000600000-0x000000000066C000-memory.dmp
memory/2620-122-0x0000000005180000-0x000000000518E000-memory.dmp
memory/2620-123-0x0000000007370000-0x00000000073BB000-memory.dmp
memory/2620-124-0x0000000006CF0000-0x0000000006D56000-memory.dmp
memory/2620-118-0x0000000004EB0000-0x0000000004F42000-memory.dmp
memory/2620-117-0x0000000005310000-0x000000000580E000-memory.dmp
memory/2620-116-0x0000000000600000-0x000000000066C000-memory.dmp