Analysis
- max time kernel
122s - max time network
125s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
25/01/2022, 11:35
General
- Target 7731f93c1a2dd332bb7f511ced1ce236.exe
- Size 838KB
- Sample220125-np65fsfdc8
- SHA256 5fabf5c9fcceb520d7023eaf53122959f42bdb4b1c82bc916baa4bbb94f787ae
Malware Config
Extracted
-
formbook
-
4.1
-
fezu
-
palisadeshiking.com
-
lusteror.com
-
blogmisaficiones.com
-
firstprinciplesteam.com
-
theindoorfarmer.info
-
sddn55.xyz
-
womensclothingonlineshop.com
-
amourneim.com
-
getlumichargeserver.com
-
mynegociodev.com
-
xn--riq159j.com
-
the-social-hub.com
-
buypremiumvpn.xyz
-
brightnes.info
-
catmanshopper.com
-
michellepalacdesigns.com
-
moveventurecapital.com
-
nzhzygba.com
-
papahungry.com
-
electric-classic-bike.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7731f93c1a2dd332bb7f511ced1ce236.exe"C:\Users\Admin\AppData\Local\Temp\7731f93c1a2dd332bb7f511ced1ce236.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7731f93c1a2dd332bb7f511ced1ce236.exe"C:\Users\Admin\AppData\Local\Temp\7731f93c1a2dd332bb7f511ced1ce236.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\7731f93c1a2dd332bb7f511ced1ce236.exe"C:\Users\Admin\AppData\Local\Temp\7731f93c1a2dd332bb7f511ced1ce236.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/564-60-0x0000000000400000-0x000000000042F000-memory.dmp
memory/564-61-0x0000000000400000-0x000000000042F000-memory.dmp
memory/564-62-0x0000000000400000-0x000000000042F000-memory.dmp
memory/564-63-0x0000000000C80000-0x0000000000F83000-memory.dmp
memory/1528-54-0x0000000000BA0000-0x0000000000C78000-memory.dmp
memory/1528-55-0x0000000076371000-0x0000000076373000-memory.dmp
memory/1528-56-0x0000000000B20000-0x0000000000B21000-memory.dmp
memory/1528-57-0x000000007EF40000-0x000000007EF41000-memory.dmp
memory/1528-58-0x0000000000630000-0x000000000063E000-memory.dmp
memory/1528-59-0x0000000005220000-0x00000000052CA000-memory.dmp