Analysis
- max time kernel
119s - max time network
122s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
18/01/2022, 17:32
General
- Target 250d5a609ef789d81a32fa3acee75e41.exe
- Size 398KB
- Sample220118-v4a4wsccb6
- SHA256 9b0e4c0a6259aa239b6c344b705dea5fbb487b680bd754453f07b9b016ec581e
Malware Config
Extracted
-
formbook
-
4.1
-
qugo
-
sathapornstainlesssteel.com
-
everythingisaninvestment.com
-
appsbyraf.com
-
superhornygirl.club
-
christmastreeclass.com
-
cheatdayztogo.com
-
aadent7.com
-
divinitypath.com
-
figuli563.com
-
distanzalojistik.com
-
pricelesslookyto-looktoday.info
-
pcaaems.com
-
itsnewmovie.com
-
4kx.claims
-
rental-aruyo.com
-
psiek.com
-
justnobleempress.com
-
40daysfor40nights.com
-
91266w.com
-
csi-texas.biz
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\250d5a609ef789d81a32fa3acee75e41.exe"C:\Users\Admin\AppData\Local\Temp\250d5a609ef789d81a32fa3acee75e41.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\250d5a609ef789d81a32fa3acee75e41.exe"C:\Users\Admin\AppData\Local\Temp\250d5a609ef789d81a32fa3acee75e41.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/760-60-0x0000000000400000-0x000000000042F000-memory.dmp
memory/760-61-0x0000000000400000-0x000000000042F000-memory.dmp
memory/760-62-0x0000000000400000-0x000000000042F000-memory.dmp
memory/760-63-0x00000000008E0000-0x0000000000BE3000-memory.dmp
memory/1628-55-0x0000000000870000-0x00000000008DA000-memory.dmp
memory/1628-56-0x0000000075021000-0x0000000075023000-memory.dmp
memory/1628-57-0x0000000004AD0000-0x0000000004AD1000-memory.dmp
memory/1628-58-0x0000000000450000-0x0000000000460000-memory.dmp
memory/1628-59-0x0000000005050000-0x00000000050B6000-memory.dmp