Analysis
- max time kernel
95s - max time network
45s - platform
windows7_x64 - resource
win7-20220331-en - submitted
08/04/2022, 09:38
General
- Target 25c18c9e08ee26ca5155c09eaa020377.exe
- Size 762KB
- Sample220408-ll2pfsbfb6
- SHA256 2a48c2b3780f6b0f3fd3f3f05f54066f465870e6f534237a5d283ee079882828
Malware Config
Extracted
-
formbook
-
4.1
-
s20a
-
kingdomscouncil.com
-
calavera.ink
-
99bds.com
-
newbetsites.com
-
foldandrelax.com
-
liumilac.com
-
hightidestattoo.com
-
hoschtonplumbers.com
-
deoranjewinter.com
-
awinterart.com
-
zmpeudz.icu
-
jsemw105.com
-
landrover-africa.com
-
371018.com
-
mhasale.com
-
philipmawford.com
-
acorn97.com
-
kexin158.com
-
dxhjtsq.com
-
lekarbg.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\25c18c9e08ee26ca5155c09eaa020377.exe"C:\Users\Admin\AppData\Local\Temp\25c18c9e08ee26ca5155c09eaa020377.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\25c18c9e08ee26ca5155c09eaa020377.exe"C:\Users\Admin\AppData\Local\Temp\25c18c9e08ee26ca5155c09eaa020377.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 812 -s 363⤵
- Program crash
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/812-58-0x0000000000400000-0x000000000042F000-memory.dmp
memory/812-59-0x0000000000400000-0x000000000042F000-memory.dmp
memory/812-61-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1616-54-0x0000000000BF0000-0x0000000000CB8000-memory.dmp
memory/1616-55-0x00000000009E0000-0x00000000009EA000-memory.dmp
memory/1616-56-0x00000000053F0000-0x000000000549C000-memory.dmp
memory/1616-57-0x00000000049E0000-0x0000000004A4A000-memory.dmp