Analysis
- max time kernel
4294179s - max time network
123s - platform
windows7_x64 - resource
win7-20220311-en - submitted
21/03/2022, 10:08
General
- Target 14ba954e55194b6aeaad53ed548500f2.exe
- Size 1000KB
- Sample220321-l58bcabbg4
- SHA256 9621e6459dc138fb11bc279b6583fc68eed0db7b284e198c74dda8385db8ce0d
Malware Config
Extracted
-
formbook
-
4.1
-
w26e
-
alexispageart.com
-
69253.win
-
luckytimelondon.com
-
289788.icu
-
houserepairservice.com
-
z-i-z.com
-
onlinediyetsitem.com
-
birkinmetaverse.com
-
unual.com
-
doorbundle.com
-
unplugpropertymanagement.com
-
go-fastcargo.com
-
therestore.agency
-
rubyyyjones.com
-
bavtin.xyz
-
jktwatchweek.com
-
atendimento-app.cloud
-
inavi.xyz
-
topinsurancesecrets.com
-
webgplsolucoes.xyz
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\14ba954e55194b6aeaad53ed548500f2.exe"C:\Users\Admin\AppData\Local\Temp\14ba954e55194b6aeaad53ed548500f2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\14ba954e55194b6aeaad53ed548500f2.exe"C:\Users\Admin\AppData\Local\Temp\14ba954e55194b6aeaad53ed548500f2.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 363⤵
- Program crash
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/952-54-0x0000000000CA0000-0x0000000000DA0000-memory.dmp
memory/952-55-0x0000000074860000-0x0000000074F4E000-memory.dmp
memory/952-56-0x0000000004C20000-0x0000000004C21000-memory.dmp
memory/952-57-0x00000000008A0000-0x00000000008B8000-memory.dmp
memory/952-58-0x0000000005A30000-0x0000000005B2E000-memory.dmp
memory/952-59-0x0000000004C60000-0x0000000004C94000-memory.dmp
memory/1660-60-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1660-62-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1660-64-0x0000000000400000-0x000000000042F000-memory.dmp