Analysis
- max time kernel
79s - max time network
21s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
05/02/2022, 12:18
General
- Target 9dbc516af20f71e02a4a9d1c7bc6acdaeaccc37258a4ebeecaa9e670f05c13e7.exe
- Size 544KB
- Sample220205-pgtd3abdhr
- SHA256 9dbc516af20f71e02a4a9d1c7bc6acdaeaccc37258a4ebeecaa9e670f05c13e7
Malware Config
Extracted
-
formbook
-
3.9
-
dw5
-
rincondeguyabitos.com
-
huawei.services
-
atria-securities.com
-
illect-mail.com
-
cerberus.digital
-
benefitsnursingvip.win
-
jimmywilliamsmusic1990.com
-
peabodyathleticclub.com
-
supporetuythub.online
-
supportf.net
-
arthurlazaryan.com
-
royalsparkfacility.com
-
wgshd.com
-
hzb-design.net
-
games-max.com
-
heatfreecurls.com
-
cryptocoinax.com
-
exoawk.com
-
gabbyoz.com
-
andibearing.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9dbc516af20f71e02a4a9d1c7bc6acdaeaccc37258a4ebeecaa9e670f05c13e7.exe"C:\Users\Admin\AppData\Local\Temp\9dbc516af20f71e02a4a9d1c7bc6acdaeaccc37258a4ebeecaa9e670f05c13e7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9dbc516af20f71e02a4a9d1c7bc6acdaeaccc37258a4ebeecaa9e670f05c13e7.exe"C:\Users\Admin\AppData\Local\Temp\9dbc516af20f71e02a4a9d1c7bc6acdaeaccc37258a4ebeecaa9e670f05c13e7.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1128-55-0x00000000003C0000-0x00000000003C7000-memory.dmp
memory/1128-56-0x0000000076121000-0x0000000076123000-memory.dmp
memory/1128-57-0x0000000077590000-0x0000000077739000-memory.dmp
memory/1128-58-0x0000000077770000-0x00000000778F0000-memory.dmp
memory/1540-61-0x0000000000400000-0x000000000042A000-memory.dmp
memory/1540-60-0x0000000000400000-0x000000000048A000-memory.dmp
memory/1540-62-0x0000000077590000-0x0000000077739000-memory.dmp
memory/1540-63-0x0000000077770000-0x00000000778F0000-memory.dmp
memory/1540-64-0x000000001EAD0000-0x000000001EDD3000-memory.dmp