Analysis
- max time kernel
122s - max time network
45s - platform
windows7_x64 - resource
win7-20220331-en - submitted
08/04/2022, 09:38
General
- Target 87869f39271a39790c4be28e50cf8ce5.exe
- Size 776KB
- Sample220408-ll2pfsbfb7
- SHA256 c0760105fed05b99698c3f1e5bb6ed6e2e9b386315d0e187cd075b8ed5ea7fe5
Malware Config
Extracted
-
formbook
-
4.1
-
ce20
-
tiendacbdsevilla.com
-
cambodianairlines.net
-
xtypelife.online
-
8568008.com
-
truelanguageacademy.com
-
fibverse.com
-
thhhh.xyz
-
maskschool.com
-
missbrazilsc.com
-
suonas.com
-
esteel24.com
-
dreamoffkartal.com
-
errebasics.com
-
novaworldmarinacity.com
-
sailingt.com
-
8ylady.com
-
d5lb1.club
-
mexicovegetal.com
-
ahfsaleleaseback.com
-
sjcad11.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\87869f39271a39790c4be28e50cf8ce5.exe"C:\Users\Admin\AppData\Local\Temp\87869f39271a39790c4be28e50cf8ce5.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\87869f39271a39790c4be28e50cf8ce5.exe"C:\Users\Admin\AppData\Local\Temp\87869f39271a39790c4be28e50cf8ce5.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 363⤵
- Program crash
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1376-54-0x0000000000300000-0x00000000003CC000-memory.dmp
memory/1376-55-0x0000000000280000-0x000000000028A000-memory.dmp
memory/1376-56-0x0000000005730000-0x00000000057E0000-memory.dmp
memory/1376-57-0x0000000004EF0000-0x0000000004F60000-memory.dmp
memory/2044-58-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2044-59-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2044-61-0x0000000000400000-0x000000000042F000-memory.dmp