Analysis
- max time kernel
144s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
22/03/2022, 19:01
General
- Target 4f279b7fd35cb88bafb83912c82ae50b.exe
- Size 981KB
- Sample220322-xn824aggb4
- SHA256 e4d0ebfd2e92b3848aa302ff71782e2bb7b55b1340f340c89e263e9d1a2a6987
Malware Config
Extracted
-
formbook
-
4.1
-
w26e
-
alexispageart.com
-
69253.win
-
luckytimelondon.com
-
289788.icu
-
houserepairservice.com
-
z-i-z.com
-
onlinediyetsitem.com
-
birkinmetaverse.com
-
unual.com
-
doorbundle.com
-
unplugpropertymanagement.com
-
go-fastcargo.com
-
therestore.agency
-
rubyyyjones.com
-
bavtin.xyz
-
jktwatchweek.com
-
atendimento-app.cloud
-
inavi.xyz
-
topinsurancesecrets.com
-
webgplsolucoes.xyz
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f279b7fd35cb88bafb83912c82ae50b.exe"C:\Users\Admin\AppData\Local\Temp\4f279b7fd35cb88bafb83912c82ae50b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4f279b7fd35cb88bafb83912c82ae50b.exe"C:\Users\Admin\AppData\Local\Temp\4f279b7fd35cb88bafb83912c82ae50b.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\Upfc.exeC:\Windows\System32\Upfc.exe /launchtype periodic /cv 1TIW/OT8B0Cs5tLR2ucafg.01⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1996-130-0x0000000000850000-0x000000000094C000-memory.dmp
memory/1996-131-0x00000000743E0000-0x0000000074B90000-memory.dmp
memory/1996-132-0x0000000005740000-0x0000000005CE4000-memory.dmp
memory/1996-133-0x0000000005230000-0x00000000052C2000-memory.dmp
memory/1996-134-0x0000000005190000-0x0000000005734000-memory.dmp
memory/1996-135-0x00000000051B0000-0x00000000051BA000-memory.dmp
memory/1996-136-0x0000000008C60000-0x0000000008CFC000-memory.dmp
memory/2080-137-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2080-138-0x00000000010A0000-0x00000000013EA000-memory.dmp