Analysis
- max time kernel
90s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
09/06/2022, 08:36
General
- Target 6b739e1d35c38dd6b26a2c17d453746e.exe
- Size 627KB
- Sample220609-khly6aheb8
- SHA256 bef4d2b112f31aa4e400f8a578eb87817ea1acda68d219f7c5d4387ceaf432cf
Malware Config
Extracted
-
formbook
-
4.1
-
e63z
-
solariefy.com
-
zw323.top
-
somei8.com
-
rukbrook.com
-
iu5w.icu
-
escrow-hk.com
-
onlinereviewmonitor.com
-
maxxaktiv.com
-
directecole.com
-
walkinmovies.com
-
zxxiangr.com
-
prvmagapromo.com
-
mozogaotaxi.com
-
paralegaltraining.life
-
hayatkulturvakifi.com
-
beltmnn.com
-
olqlovea.com
-
theupsstore881.com
-
galmfrenchbulldogsny.com
-
stphilcc.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6b739e1d35c38dd6b26a2c17d453746e.exe"C:\Users\Admin\AppData\Local\Temp\6b739e1d35c38dd6b26a2c17d453746e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6b739e1d35c38dd6b26a2c17d453746e.exe"C:\Users\Admin\AppData\Local\Temp\6b739e1d35c38dd6b26a2c17d453746e.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\6b739e1d35c38dd6b26a2c17d453746e.exe"C:\Users\Admin\AppData\Local\Temp\6b739e1d35c38dd6b26a2c17d453746e.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1460-130-0x0000000000EA0000-0x0000000000F44000-memory.dmp
memory/1460-131-0x0000000005F90000-0x0000000006534000-memory.dmp
memory/1460-132-0x00000000058F0000-0x0000000005982000-memory.dmp
memory/1460-133-0x0000000005990000-0x000000000599A000-memory.dmp
memory/1460-134-0x0000000007E50000-0x0000000007EEC000-memory.dmp
memory/1460-135-0x00000000084C0000-0x0000000008526000-memory.dmp
memory/4368-138-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4368-139-0x0000000001160000-0x00000000014AA000-memory.dmp