Analysis
- max time kernel
53s - max time network
50s - platform
windows7_x64 - resource
win7-20220414-en - submitted
08/07/2022, 04:34
General
- Target SecuriteInfo.com.W32.AIDetectNet.01.15769.exe
- Size 631KB
- Sample220708-e64afsbfd6
- SHA256 ea4ca77890daba701679e692e4ad121c665c5089082450e00eb921976dffbe04
Malware Config
Extracted
-
formbook
-
4.1
-
hw05
-
goride.xyz
-
driptailor.com
-
cpamediabusiness.com
-
blvckmd.com
-
winerpilot.xyz
-
gobet88.space
-
bagro.life
-
kwri.online
-
fcasaburiferdorador.com
-
hauntinghouse.media
-
parkcity.finance
-
citipayee.com
-
aboveallinspection.com
-
insightsoindia.com
-
2022stanleycupchampions.com
-
opciondeportes.store
-
assistantform.com
-
seto-sunday.net
-
qttcon.com
-
hattori-home.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.15769.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.15769.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.15769.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.15769.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1964-54-0x0000000000E50000-0x0000000000EF4000-memory.dmp
memory/1964-55-0x0000000075401000-0x0000000075403000-memory.dmp
memory/1964-56-0x0000000000760000-0x0000000000780000-memory.dmp
memory/1964-57-0x0000000000A10000-0x0000000000A1E000-memory.dmp
memory/1964-58-0x0000000007C40000-0x0000000007CBC000-memory.dmp
memory/1964-59-0x0000000004B90000-0x0000000004BC4000-memory.dmp
memory/2020-60-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2020-61-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2020-63-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2020-65-0x0000000000850000-0x0000000000B53000-memory.dmp