Analysis
- max time kernel
99s - max time network
130s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
29/06/2022, 16:11
General
- Target b3c05919b9c5211ba45fb127e9ad619b.exe
- Size 516KB
- Sample220629-tmx2nacfb6
- SHA256 18d20fd91591afb27d3f5fc50ce02f574e8dd871cd94572f4aae29928e55646e
Malware Config
Extracted
-
formbook
-
4.1
-
j1a4
-
wwwontgiveupsigns.com
-
serviceproweb.com
-
ace-101.com
-
cfxzp.com
-
bicycycling.com
-
localstlapple.com
-
jslwoodworks.com
-
oropendolashop.com
-
westfield-hk.com
-
luyando.net
-
xn--72c5ab3bfb6a2q6a.com
-
rccgdominionparish.com
-
homemromantico.com
-
3jong.com
-
activation-eyevvear.com
-
liskcreations.com
-
euritandre.com
-
mohey--r.site
-
cpattt4.top
-
reklamadinahersey.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b3c05919b9c5211ba45fb127e9ad619b.exe"C:\Users\Admin\AppData\Local\Temp\b3c05919b9c5211ba45fb127e9ad619b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b3c05919b9c5211ba45fb127e9ad619b.exe"C:\Users\Admin\AppData\Local\Temp\b3c05919b9c5211ba45fb127e9ad619b.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1876-130-0x0000000000DA0000-0x0000000000E24000-memory.dmp
memory/1876-131-0x0000000005C80000-0x0000000006224000-memory.dmp
memory/1876-132-0x00000000057B0000-0x0000000005842000-memory.dmp
memory/1876-133-0x00000000058F0000-0x000000000598C000-memory.dmp
memory/1876-134-0x0000000005870000-0x000000000587A000-memory.dmp
memory/4048-136-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4048-137-0x0000000001180000-0x00000000014CA000-memory.dmp