Analysis
- max time kernel
53s - max time network
46s - platform
windows7_x64 - resource
win7-20220414-en - submitted
30/05/2022, 04:21
General
- Target 3f86ffdbdaa69708bf989c5067102721.exe
- Size 642KB
- Sample220530-eynvsshghr
- SHA256 cec1e3475be480dcec7b887edfab3389da89c696c99fc99927682f3bc99e208b
Malware Config
Extracted
-
formbook
-
4.1
-
e63z
-
solariefy.com
-
zw323.top
-
somei8.com
-
rukbrook.com
-
iu5w.icu
-
escrow-hk.com
-
onlinereviewmonitor.com
-
maxxaktiv.com
-
directecole.com
-
walkinmovies.com
-
zxxiangr.com
-
prvmagapromo.com
-
mozogaotaxi.com
-
paralegaltraining.life
-
hayatkulturvakifi.com
-
beltmnn.com
-
olqlovea.com
-
theupsstore881.com
-
galmfrenchbulldogsny.com
-
stphilcc.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f86ffdbdaa69708bf989c5067102721.exe"C:\Users\Admin\AppData\Local\Temp\3f86ffdbdaa69708bf989c5067102721.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3f86ffdbdaa69708bf989c5067102721.exe"C:\Users\Admin\AppData\Local\Temp\3f86ffdbdaa69708bf989c5067102721.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1292-71-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1292-81-0x0000000000870000-0x0000000000B73000-memory.dmp
memory/1292-74-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1292-72-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1720-69-0x0000000007F10000-0x0000000007FA2000-memory.dmp
memory/1720-70-0x00000000006C0000-0x00000000006F4000-memory.dmp
memory/1720-61-0x0000000073BF0000-0x0000000073CEC000-memory.dmp
memory/1720-62-0x000000006FA70000-0x00000000701AE000-memory.dmp
memory/1720-63-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1720-64-0x00000000720C0000-0x000000007344F000-memory.dmp
memory/1720-65-0x00000000716B0000-0x00000000720C0000-memory.dmp
memory/1720-66-0x0000000073CF0000-0x0000000073E84000-memory.dmp
memory/1720-67-0x0000000070990000-0x00000000716AD000-memory.dmp
memory/1720-54-0x0000000001190000-0x0000000001236000-memory.dmp
memory/1720-68-0x000000006F760000-0x000000006F931000-memory.dmp
memory/1720-60-0x00000000701B0000-0x0000000070990000-memory.dmp
memory/1720-59-0x0000000070990000-0x00000000716AD000-memory.dmp
memory/1720-58-0x0000000073CF0000-0x0000000073E84000-memory.dmp
memory/1720-57-0x00000000716B0000-0x00000000720C0000-memory.dmp
memory/1720-56-0x00000000720C0000-0x000000007344F000-memory.dmp
memory/1720-76-0x00000000720C0000-0x000000007344F000-memory.dmp
memory/1720-77-0x00000000716B0000-0x00000000720C0000-memory.dmp
memory/1720-78-0x0000000073CF0000-0x0000000073E84000-memory.dmp
memory/1720-79-0x0000000070990000-0x00000000716AD000-memory.dmp
memory/1720-80-0x000000006F760000-0x000000006F931000-memory.dmp
memory/1720-55-0x0000000075711000-0x0000000075713000-memory.dmp
memory/1720-82-0x000000006F630000-0x000000006F753000-memory.dmp