Analysis
- max time kernel
111s - max time network
126s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
18/08/2022, 07:29
General
- Target 9f4d50417d81b7f033894a84047a58f5.exe
- Size 762KB
- Sample220818-ja8yaabbfm
- SHA256 ee0f1dab4de829292b2c3d760a82741fcc742dd1bb0ffb53247cd4c9aa549732
Malware Config
Extracted
-
formbook
-
4.1
-
s46e
-
flooringcanvas.info
-
lebongou.online
-
imaizumi.tech
-
asisanat.com
-
twintwinohyeah.com
-
elevateoy.com
-
oliveapothecary.com
-
admiralx-ri.top
-
michael-brandenburg.com
-
outdoorfurniture.space
-
beinspiredtoachieve.com
-
lasso-lasso.com
-
volam2.top
-
coolnews2.space
-
fghmax.online
-
landspringy.info
-
andrewnemec.com
-
kjmbywalk.xyz
-
zl-wine.com
-
manhattanmaintenance.site
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9f4d50417d81b7f033894a84047a58f5.exe"C:\Users\Admin\AppData\Local\Temp\9f4d50417d81b7f033894a84047a58f5.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9f4d50417d81b7f033894a84047a58f5.exe"C:\Users\Admin\AppData\Local\Temp\9f4d50417d81b7f033894a84047a58f5.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\9f4d50417d81b7f033894a84047a58f5.exe"C:\Users\Admin\AppData\Local\Temp\9f4d50417d81b7f033894a84047a58f5.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1520-140-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1520-141-0x0000000001770000-0x0000000001ABA000-memory.dmp
memory/4656-132-0x0000000000A70000-0x0000000000B34000-memory.dmp
memory/4656-133-0x0000000005970000-0x0000000005F14000-memory.dmp
memory/4656-134-0x00000000053C0000-0x0000000005452000-memory.dmp
memory/4656-135-0x00000000053A0000-0x00000000053AA000-memory.dmp
memory/4656-136-0x000000000B380000-0x000000000B41C000-memory.dmp
memory/4656-137-0x000000000B490000-0x000000000B4F6000-memory.dmp