Analysis
- max time kernel
44s - max time network
46s - platform
windows7_x64 - resource
win7-20220331-en - submitted
07/04/2022, 16:23
General
- Target New Purchas Order.exe
- Size 563KB
- Sample220407-tvsrxaaeb7
- SHA256 05a096d0b32ba6a4ef81bdf3794aaaffbae69c71c7bbe9506db9ebe30e168e4e
Malware Config
Extracted
-
formbook
-
4.1
-
d1n3
-
scrubbinsisters.com
-
kawuldim.com
-
pyttoin.xyz
-
iyraproperties.com
-
miaurora.net
-
cricutonlinesales.store
-
huangsanguai.com
-
chayaelements.store
-
giftexpress15.xyz
-
antiwardrobe.com
-
wiggly.site
-
avrecommendwiki.com
-
galabet472.com
-
invtips.com
-
tvpoy.xyz
-
raidencity.net
-
ripper66.com
-
ipoyce.online
-
xn--h6q362bj4mp5c.com
-
rooplaza.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Purchas Order.exe"C:\Users\Admin\AppData\Local\Temp\New Purchas Order.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\New Purchas Order.exe"C:\Users\Admin\AppData\Local\Temp\New Purchas Order.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1096 -s 363⤵
- Program crash
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1096-58-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1096-59-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1096-61-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1812-54-0x00000000008A0000-0x0000000000932000-memory.dmp
memory/1812-55-0x00000000003F0000-0x00000000003FA000-memory.dmp
memory/1812-56-0x00000000051B0000-0x0000000005228000-memory.dmp
memory/1812-57-0x0000000002170000-0x00000000021A4000-memory.dmp