Analysis
- max time kernel
141s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20220331-en - submitted
12/04/2022, 12:49
General
- Target 8c3fe5b3177bdef904c64cb1b65d1009.exe
- Size 772KB
- Sample220412-p2b1hsbdgr
- SHA256 e9a5fa1e217bd7dbbb5b055250c3818d3372a77cfe3cb2f397e251583accfd6f
Malware Config
Extracted
-
formbook
-
4.1
-
g02e
-
rankwrestles.com
-
dm285.com
-
0824e.com
-
smaduread.com
-
staygoodbossedup.com
-
actacricket.xyz
-
djpauloso.com
-
collingwoodwellbabyclinic.com
-
fazzamedia.com
-
faento.online
-
devoteddixons.com
-
ljconcierto.com
-
dallasmorningpost.com
-
changledi.com
-
sz-lyfw.com
-
askdigiguru.com
-
aihongyan.com
-
educanet12.com
-
accedabancsabadell.com
-
vetkoekworld.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8c3fe5b3177bdef904c64cb1b65d1009.exe"C:\Users\Admin\AppData\Local\Temp\8c3fe5b3177bdef904c64cb1b65d1009.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8c3fe5b3177bdef904c64cb1b65d1009.exe"C:\Users\Admin\AppData\Local\Temp\8c3fe5b3177bdef904c64cb1b65d1009.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/532-124-0x0000000000C50000-0x0000000000D18000-memory.dmp
memory/532-125-0x0000000005C40000-0x00000000061E4000-memory.dmp
memory/532-126-0x0000000005730000-0x00000000057C2000-memory.dmp
memory/532-127-0x00000000056D0000-0x00000000056DA000-memory.dmp
memory/532-128-0x0000000007C60000-0x0000000007CFC000-memory.dmp
memory/532-129-0x0000000007FD0000-0x0000000008036000-memory.dmp
memory/1068-131-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1068-132-0x0000000001370000-0x00000000016BA000-memory.dmp