Analysis
- max time kernel
122s - max time network
129s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
12/01/2022, 11:00
General
- Target dee44580791ad105a240b06fab1bb1a5.exe
- Size 412KB
- Sample220112-m3z3macch5
- SHA256 243bf6298e6d09d6b1defc371150fa5e0b34942eb6f2d616c187fa3fd7f44fbb
Malware Config
Extracted
-
formbook
-
4.1
-
bt33
-
mbaonlinefreedegress.info
-
myforevermaid.com
-
daoyi365.com
-
weientm.com
-
legal-mx.com
-
formationrigging.com
-
heidiet.xyz
-
school-prosto.store
-
healthvitaminnutrition.com
-
digitalsolutionusa.com
-
little-bazar.com
-
jnbeautycanada.com
-
optoelek.com
-
learntoairmail.com
-
hawkminer.com
-
kingofearth.love
-
ktnstay.xyz
-
zouxin.love
-
mainlandpr.com
-
mamm-hummel.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dee44580791ad105a240b06fab1bb1a5.exe"C:\Users\Admin\AppData\Local\Temp\dee44580791ad105a240b06fab1bb1a5.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dee44580791ad105a240b06fab1bb1a5.exe"C:\Users\Admin\AppData\Local\Temp\dee44580791ad105a240b06fab1bb1a5.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/860-60-0x0000000000400000-0x000000000042F000-memory.dmp
memory/860-61-0x0000000000400000-0x000000000042F000-memory.dmp
memory/860-62-0x0000000000400000-0x000000000042F000-memory.dmp
memory/860-64-0x00000000008E0000-0x0000000000BE3000-memory.dmp
memory/1520-54-0x0000000000D10000-0x0000000000D7E000-memory.dmp
memory/1520-55-0x0000000000D10000-0x0000000000D7E000-memory.dmp
memory/1520-56-0x0000000076371000-0x0000000076373000-memory.dmp
memory/1520-57-0x0000000004BB0000-0x0000000004BB1000-memory.dmp
memory/1520-58-0x0000000000580000-0x000000000058E000-memory.dmp
memory/1520-59-0x0000000005080000-0x00000000050E6000-memory.dmp