Analysis
- max time kernel
118s - max time network
118s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
01/02/2022, 16:55
General
- Target c197813d47a7c48fc55e42b46d7de621.exe
- Size 682KB
- Sample220201-ve5bfaaaf4
- SHA256 96de11fc0f948fc3039f297475ba8abfcedaa7a9718634359286fe49156cd216
Malware Config
Extracted
-
formbook
-
4.1
-
qugo
-
sathapornstainlesssteel.com
-
everythingisaninvestment.com
-
appsbyraf.com
-
superhornygirl.club
-
christmastreeclass.com
-
cheatdayztogo.com
-
aadent7.com
-
divinitypath.com
-
figuli563.com
-
distanzalojistik.com
-
pricelesslookyto-looktoday.info
-
pcaaems.com
-
itsnewmovie.com
-
4kx.claims
-
rental-aruyo.com
-
psiek.com
-
justnobleempress.com
-
40daysfor40nights.com
-
91266w.com
-
csi-texas.biz
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c197813d47a7c48fc55e42b46d7de621.exe"C:\Users\Admin\AppData\Local\Temp\c197813d47a7c48fc55e42b46d7de621.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c197813d47a7c48fc55e42b46d7de621.exe"C:\Users\Admin\AppData\Local\Temp\c197813d47a7c48fc55e42b46d7de621.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/568-59-0x0000000000400000-0x000000000042F000-memory.dmp
memory/568-60-0x0000000000400000-0x000000000042F000-memory.dmp
memory/568-61-0x0000000000400000-0x000000000042F000-memory.dmp
memory/568-62-0x0000000000A20000-0x0000000000D23000-memory.dmp
memory/800-54-0x0000000000DA0000-0x0000000000E50000-memory.dmp
memory/800-55-0x0000000075F21000-0x0000000075F23000-memory.dmp
memory/800-56-0x0000000004E90000-0x0000000004E91000-memory.dmp
memory/800-57-0x00000000004F0000-0x0000000000504000-memory.dmp
memory/800-58-0x0000000004FE0000-0x0000000005046000-memory.dmp