Analysis
- max time kernel
120s - max time network
123s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
25/01/2022, 11:35
General
- Target 7731f93c1a2dd332bb7f511ced1ce236.exe
- Size 838KB
- Sample220125-np65fsfdc8
- SHA256 5fabf5c9fcceb520d7023eaf53122959f42bdb4b1c82bc916baa4bbb94f787ae
Malware Config
Extracted
-
formbook
-
4.1
-
fezu
-
palisadeshiking.com
-
lusteror.com
-
blogmisaficiones.com
-
firstprinciplesteam.com
-
theindoorfarmer.info
-
sddn55.xyz
-
womensclothingonlineshop.com
-
amourneim.com
-
getlumichargeserver.com
-
mynegociodev.com
-
xn--riq159j.com
-
the-social-hub.com
-
buypremiumvpn.xyz
-
brightnes.info
-
catmanshopper.com
-
michellepalacdesigns.com
-
moveventurecapital.com
-
nzhzygba.com
-
papahungry.com
-
electric-classic-bike.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7731f93c1a2dd332bb7f511ced1ce236.exe"C:\Users\Admin\AppData\Local\Temp\7731f93c1a2dd332bb7f511ced1ce236.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7731f93c1a2dd332bb7f511ced1ce236.exe"C:\Users\Admin\AppData\Local\Temp\7731f93c1a2dd332bb7f511ced1ce236.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3664-115-0x0000000000FE0000-0x00000000010B8000-memory.dmp
memory/3664-116-0x0000000006000000-0x00000000064FE000-memory.dmp
memory/3664-117-0x0000000005B00000-0x0000000005B92000-memory.dmp
memory/3664-118-0x0000000005B00000-0x0000000005FFE000-memory.dmp
memory/3664-119-0x0000000005BA0000-0x0000000005BAA000-memory.dmp
memory/3664-120-0x0000000005C60000-0x0000000005CFC000-memory.dmp
memory/3664-121-0x0000000005FE0000-0x0000000005FEE000-memory.dmp
memory/3664-122-0x000000007FB40000-0x000000007FB41000-memory.dmp
memory/3664-123-0x00000000069E0000-0x0000000006A8A000-memory.dmp
memory/4384-124-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4384-125-0x0000000001280000-0x00000000015A0000-memory.dmp