Analysis
- max time kernel
166s - max time network
169s - platform
windows10-2004_x64 - resource
win10v2004-20220331-en - submitted
12/04/2022, 15:40
General
- Target 96c7077889ab23b8df01bca77a45a4df.exe
- Size 715KB
- Sample220412-s37elagcc5
- SHA256 2dac503b9c06d06387e62a41fe9f9e179df1aba575a3b2aece6d508b7c2e0d4f
Malware Config
Extracted
-
formbook
-
4.1
-
g9s4
-
visitmechanic.com
-
xn--kck4a7gpd474vx6i.com
-
prozdorovie.online
-
omatpupa.xyz
-
zamokwakhekhumalo.com
-
mayuraandchris.com
-
wanasahstore.com
-
bicicletas.win
-
yhdm61.com
-
mortgageattract.com
-
centuryofbio.com
-
xtdkgjt.com
-
nhahangnetnghe.com
-
whatsappsemcontato.com
-
onlinemarketing-teamwebus.com
-
zuevu.com
-
dancaronmusic.com
-
tingseo.com
-
uniflapline.com
-
setuppharmaweb.online
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\96c7077889ab23b8df01bca77a45a4df.exe"C:\Users\Admin\AppData\Local\Temp\96c7077889ab23b8df01bca77a45a4df.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\96c7077889ab23b8df01bca77a45a4df.exe"C:\Users\Admin\AppData\Local\Temp\96c7077889ab23b8df01bca77a45a4df.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1996-131-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1996-132-0x0000000001720000-0x0000000001A6A000-memory.dmp
memory/4820-124-0x0000000000EF0000-0x0000000000FA8000-memory.dmp
memory/4820-125-0x0000000005D60000-0x0000000006304000-memory.dmp
memory/4820-126-0x0000000005850000-0x00000000058E2000-memory.dmp
memory/4820-127-0x0000000005830000-0x000000000583A000-memory.dmp
memory/4820-128-0x0000000009450000-0x00000000094EC000-memory.dmp
memory/4820-129-0x0000000009680000-0x00000000096E6000-memory.dmp