Analysis
- max time kernel
136s - max time network
145s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
26/01/2022, 15:36
General
- Target 26006717388ba82289d13403ed220f37.exe
- Size 847KB
- Sample220126-s1xsdafbe5
- SHA256 fccb02b0403cae9441c58753519e4c216735cf2bdce838c8ad2b26b35fd59493
Malware Config
Extracted
-
formbook
-
4.1
-
qugo
-
sathapornstainlesssteel.com
-
everythingisaninvestment.com
-
appsbyraf.com
-
superhornygirl.club
-
christmastreeclass.com
-
cheatdayztogo.com
-
aadent7.com
-
divinitypath.com
-
figuli563.com
-
distanzalojistik.com
-
pricelesslookyto-looktoday.info
-
pcaaems.com
-
itsnewmovie.com
-
4kx.claims
-
rental-aruyo.com
-
psiek.com
-
justnobleempress.com
-
40daysfor40nights.com
-
91266w.com
-
csi-texas.biz
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\26006717388ba82289d13403ed220f37.exe"C:\Users\Admin\AppData\Local\Temp\26006717388ba82289d13403ed220f37.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\26006717388ba82289d13403ed220f37.exe"C:\Users\Admin\AppData\Local\Temp\26006717388ba82289d13403ed220f37.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1480-118-0x0000000000990000-0x0000000000A6C000-memory.dmp
memory/1480-119-0x0000000005820000-0x0000000005D1E000-memory.dmp
memory/1480-120-0x0000000005320000-0x00000000053B2000-memory.dmp
memory/1480-121-0x0000000005320000-0x000000000581E000-memory.dmp
memory/1480-122-0x0000000005410000-0x000000000541A000-memory.dmp
memory/1480-123-0x0000000005510000-0x000000000551C000-memory.dmp
memory/1480-124-0x0000000007C10000-0x0000000007CAC000-memory.dmp
memory/1480-125-0x0000000007CB0000-0x0000000007D1A000-memory.dmp
memory/4216-126-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4216-127-0x00000000014F0000-0x0000000001810000-memory.dmp