Analysis
- max time kernel
4294181s - max time network
127s - platform
windows7_x64 - resource
win7-20220223-en - submitted
10/03/2022, 15:38
General
- Target doc.exe
- Size 1.0MB
- Sample220310-s24bjsbfbr
- SHA256 c08090499272c9eb85fa61570bfd62799b3c3bd1441b1a86f2720bd03a17dfd5
Malware Config
Extracted
-
formbook
-
4.1
-
ld23
-
lms22j.com
-
es-autentificacion.com
-
lottoprevisioni.com
-
yvw3z.xyz
-
womenupclub.com
-
phoenixeducationcentreni.com
-
metaversegurme.com
-
candymediaaa.com
-
virginiafamilyhealth.com
-
scasus.com
-
wide-hub.com
-
176218.com
-
huayidg.com
-
ticknft.site
-
sulfaa.com
-
system42.info
-
naturalhigh.love
-
taoshouyouac.xyz
-
lacasadeifolli.com
-
kotan3.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- .NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Formbook Payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\doc.exe"C:\Users\Admin\AppData\Local\Temp\doc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\doc.exe"C:\Users\Admin\AppData\Local\Temp\doc.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 363⤵
- Program crash
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/664-60-0x0000000000400000-0x000000000042F000-memory.dmp
memory/664-62-0x0000000000400000-0x000000000042F000-memory.dmp
memory/664-64-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1128-54-0x0000000000A70000-0x0000000000B7C000-memory.dmp
memory/1128-55-0x0000000074250000-0x000000007493E000-memory.dmp
memory/1128-56-0x0000000004D50000-0x0000000004D51000-memory.dmp
memory/1128-57-0x00000000004B0000-0x00000000004C8000-memory.dmp
memory/1128-58-0x0000000005870000-0x000000000594A000-memory.dmp
memory/1128-59-0x0000000002130000-0x000000000218C000-memory.dmp