Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20220331-en - submitted
08/04/2022, 09:38
General
- Target 25c18c9e08ee26ca5155c09eaa020377.exe
- Size 762KB
- Sample220408-ll2pfsbfb6
- SHA256 2a48c2b3780f6b0f3fd3f3f05f54066f465870e6f534237a5d283ee079882828
Malware Config
Extracted
-
formbook
-
4.1
-
s20a
-
kingdomscouncil.com
-
calavera.ink
-
99bds.com
-
newbetsites.com
-
foldandrelax.com
-
liumilac.com
-
hightidestattoo.com
-
hoschtonplumbers.com
-
deoranjewinter.com
-
awinterart.com
-
zmpeudz.icu
-
jsemw105.com
-
landrover-africa.com
-
371018.com
-
mhasale.com
-
philipmawford.com
-
acorn97.com
-
kexin158.com
-
dxhjtsq.com
-
lekarbg.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\25c18c9e08ee26ca5155c09eaa020377.exe"C:\Users\Admin\AppData\Local\Temp\25c18c9e08ee26ca5155c09eaa020377.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\25c18c9e08ee26ca5155c09eaa020377.exe"C:\Users\Admin\AppData\Local\Temp\25c18c9e08ee26ca5155c09eaa020377.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4596-124-0x00000000009D0000-0x0000000000A98000-memory.dmp
memory/4596-125-0x0000000005BE0000-0x0000000006184000-memory.dmp
memory/4596-126-0x00000000054D0000-0x0000000005562000-memory.dmp
memory/4596-127-0x0000000005570000-0x000000000560C000-memory.dmp
memory/4596-128-0x0000000005430000-0x000000000543A000-memory.dmp
memory/4596-129-0x00000000012A0000-0x0000000001306000-memory.dmp
memory/4664-131-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4664-132-0x0000000000FB0000-0x00000000012FA000-memory.dmp