Analysis
- max time kernel
106s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
30/05/2022, 04:21
General
- Target 3f86ffdbdaa69708bf989c5067102721.exe
- Size 642KB
- Sample220530-eynvsshghr
- SHA256 cec1e3475be480dcec7b887edfab3389da89c696c99fc99927682f3bc99e208b
Malware Config
Extracted
-
formbook
-
4.1
-
e63z
-
solariefy.com
-
zw323.top
-
somei8.com
-
rukbrook.com
-
iu5w.icu
-
escrow-hk.com
-
onlinereviewmonitor.com
-
maxxaktiv.com
-
directecole.com
-
walkinmovies.com
-
zxxiangr.com
-
prvmagapromo.com
-
mozogaotaxi.com
-
paralegaltraining.life
-
hayatkulturvakifi.com
-
beltmnn.com
-
olqlovea.com
-
theupsstore881.com
-
galmfrenchbulldogsny.com
-
stphilcc.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f86ffdbdaa69708bf989c5067102721.exe"C:\Users\Admin\AppData\Local\Temp\3f86ffdbdaa69708bf989c5067102721.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3f86ffdbdaa69708bf989c5067102721.exe"C:\Users\Admin\AppData\Local\Temp\3f86ffdbdaa69708bf989c5067102721.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1392-137-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1392-138-0x00000000015F0000-0x000000000193A000-memory.dmp
memory/4516-130-0x0000000000B40000-0x0000000000BE6000-memory.dmp
memory/4516-131-0x0000000005A80000-0x0000000006024000-memory.dmp
memory/4516-132-0x0000000005590000-0x0000000005622000-memory.dmp
memory/4516-133-0x0000000005760000-0x000000000576A000-memory.dmp
memory/4516-134-0x0000000007630000-0x00000000076CC000-memory.dmp
memory/4516-135-0x00000000090B0000-0x0000000009116000-memory.dmp