Analysis
- max time kernel
147s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20220331-en - submitted
12/04/2022, 13:08
General
- Target 5d4fd662a91cb6f89ef88b7a609d5a53.exe
- Size 715KB
- Sample220412-qc774abedm
- SHA256 bce2bc3a55dfecfd388b134663893b70c3830b20a8afa395e36a28097e305943
Malware Config
Extracted
-
formbook
-
4.1
-
a2rs
-
hypex-mc.xyz
-
lionsofeurope.info
-
syomilikipiade-uraa.online
-
gharpetutor.com
-
369mfkp.com
-
menucart.biz
-
sdew.club
-
placidtalk.com
-
rus-service.com
-
laidudu.net
-
552342.com
-
sant-trust.com
-
thefaithpusher.website
-
homepaintherapybox.com
-
indezac.com
-
hiddenvalleybarns.com
-
haocolor.store
-
retiringwellcoach.com
-
lfcr.xyz
-
renzogracieinstitute.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d4fd662a91cb6f89ef88b7a609d5a53.exe"C:\Users\Admin\AppData\Local\Temp\5d4fd662a91cb6f89ef88b7a609d5a53.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5d4fd662a91cb6f89ef88b7a609d5a53.exe"C:\Users\Admin\AppData\Local\Temp\5d4fd662a91cb6f89ef88b7a609d5a53.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\5d4fd662a91cb6f89ef88b7a609d5a53.exe"C:\Users\Admin\AppData\Local\Temp\5d4fd662a91cb6f89ef88b7a609d5a53.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/932-132-0x0000000000400000-0x000000000042F000-memory.dmp
memory/932-133-0x0000000001460000-0x00000000017AA000-memory.dmp
memory/4876-124-0x0000000000410000-0x00000000004C8000-memory.dmp
memory/4876-125-0x00000000054E0000-0x0000000005A84000-memory.dmp
memory/4876-126-0x0000000004F30000-0x0000000004FC2000-memory.dmp
memory/4876-127-0x0000000002A40000-0x0000000002A4A000-memory.dmp
memory/4876-128-0x00000000089B0000-0x0000000008A4C000-memory.dmp
memory/4876-129-0x0000000008CF0000-0x0000000008D56000-memory.dmp