Analysis
- max time kernel
132s - max time network
146s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
12/01/2022, 11:00
General
- Target dee44580791ad105a240b06fab1bb1a5.exe
- Size 412KB
- Sample220112-m3z3macch5
- SHA256 243bf6298e6d09d6b1defc371150fa5e0b34942eb6f2d616c187fa3fd7f44fbb
Malware Config
Extracted
-
formbook
-
4.1
-
bt33
-
mbaonlinefreedegress.info
-
myforevermaid.com
-
daoyi365.com
-
weientm.com
-
legal-mx.com
-
formationrigging.com
-
heidiet.xyz
-
school-prosto.store
-
healthvitaminnutrition.com
-
digitalsolutionusa.com
-
little-bazar.com
-
jnbeautycanada.com
-
optoelek.com
-
learntoairmail.com
-
hawkminer.com
-
kingofearth.love
-
ktnstay.xyz
-
zouxin.love
-
mainlandpr.com
-
mamm-hummel.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dee44580791ad105a240b06fab1bb1a5.exe"C:\Users\Admin\AppData\Local\Temp\dee44580791ad105a240b06fab1bb1a5.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dee44580791ad105a240b06fab1bb1a5.exe"C:\Users\Admin\AppData\Local\Temp\dee44580791ad105a240b06fab1bb1a5.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2476-115-0x0000000000210000-0x000000000027E000-memory.dmp
memory/2476-116-0x0000000000210000-0x000000000027E000-memory.dmp
memory/2476-117-0x0000000005090000-0x000000000558E000-memory.dmp
memory/2476-118-0x0000000004B90000-0x0000000004C22000-memory.dmp
memory/2476-119-0x0000000004B90000-0x000000000508E000-memory.dmp
memory/2476-120-0x0000000004B60000-0x0000000004B6A000-memory.dmp
memory/2476-121-0x0000000004D10000-0x0000000004D1E000-memory.dmp
memory/2476-122-0x0000000006EF0000-0x0000000006F3B000-memory.dmp
memory/2476-123-0x0000000007260000-0x00000000072FC000-memory.dmp
memory/2476-124-0x0000000007300000-0x0000000007366000-memory.dmp
memory/3696-125-0x0000000000400000-0x000000000042F000-memory.dmp
memory/3696-127-0x0000000001100000-0x0000000001420000-memory.dmp