Analysis
- max time kernel
120s - max time network
128s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
09/02/2022, 16:20
General
- Target 259804c409e6b0863afa760aa54e9004.exe
- Size 811KB
- Sample220209-ts4rdsbbaj
- SHA256 76fb4deca980cbc985a590ac1f8481bc1b08cd9ab19fd24c902cc58347e792f6
Malware Config
Extracted
-
formbook
-
4.1
-
d7ln
-
bulut-imza.com
-
gotastebuds.com
-
shutupmags.com
-
clocksport.com
-
toweryachtcounsel.com
-
kingcopier.com
-
pluspersona.com
-
inchallahe.com
-
unclonedconsulting.com
-
ccdt168.com
-
tonyzheng.xyz
-
voiceoftheepeople.com
-
cicapital.xyz
-
offxpro.com
-
loyatiproductions.com
-
makemebuystuff.com
-
incuba8labs.com
-
remparka.com
-
newstft.com
-
bgame.pro
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\259804c409e6b0863afa760aa54e9004.exe"C:\Users\Admin\AppData\Local\Temp\259804c409e6b0863afa760aa54e9004.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\259804c409e6b0863afa760aa54e9004.exe"C:\Users\Admin\AppData\Local\Temp\259804c409e6b0863afa760aa54e9004.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1428-59-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1428-60-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1428-61-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1428-62-0x00000000008F0000-0x0000000000BF3000-memory.dmp
memory/1892-54-0x0000000073F8E000-0x0000000073F8F000-memory.dmp
memory/1892-55-0x0000000000F00000-0x0000000000FD0000-memory.dmp
memory/1892-56-0x0000000004800000-0x0000000004801000-memory.dmp
memory/1892-57-0x0000000000660000-0x000000000066C000-memory.dmp
memory/1892-58-0x0000000005510000-0x00000000055B0000-memory.dmp