Analysis
- max time kernel
91s - max time network
120s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
10/05/2022, 03:33
General
- Target SecuriteInfo.com.W32.AIDetectNet.01.10532.exe
- Size 869KB
- Sample220510-d37yssehd4
- SHA256 b49b339fee0e9543d77688426378faefab1b4fca1e310df88fb8ed376b5456d3
Malware Config
Extracted
-
formbook
-
4.1
-
w2k1
-
cpost24.com
-
paseba.store
-
movementstrategy.biz
-
bankof7seas.com
-
commwealth-cba-net.com
-
lexa.red
-
inovamarket.online
-
eiremaintenance.com
-
allstatesequipmentcompany.com
-
undercutthebroker.email
-
xn--gmai-eza.com
-
ssilver.site
-
factlifequiteresponsibility.biz
-
ueiad.info
-
lavoixinterieure.fr
-
minifaceliftmidtownnyc.com
-
southwestmed.net
-
hasbrogameplan.com
-
cawweb3.com
-
gass.kr
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.10532.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.10532.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.10532.exe"{path}"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.10532.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1480-137-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1480-138-0x0000000001190000-0x00000000014DA000-memory.dmp
memory/4456-130-0x00000000007E0000-0x00000000008BE000-memory.dmp
memory/4456-131-0x00000000058E0000-0x0000000005E84000-memory.dmp
memory/4456-132-0x0000000005330000-0x00000000053C2000-memory.dmp
memory/4456-133-0x00000000053D0000-0x000000000546C000-memory.dmp
memory/4456-134-0x0000000005240000-0x000000000524A000-memory.dmp