Analysis
- max time kernel
76s - max time network
132s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
- submitted
15/09/2022, 05:41
General
- Target SecuriteInfo.com.Win32.PWSX-gen.18674.exe
- Size 1.2MB
- Sample220915-gde39scae2
- SHA256 da37c66e5cc323386f9637b402df14fc02cd76eb9abc6853a458d266db163088
Malware Config
Extracted
-
formbook
-
e7nb
-
PsTzh30CVEdk
-
lubNs/ediiAunBs=
-
508fP8IdRzd/
-
U549ZBc72VO65OOIBgw=
-
Zrhzpl05MNXVsnltXG7VJcZMaQ==
-
PHkdSJEyEOSxOwb6W0mv9ciuW+ybmQMt
-
uirizUluo2S80tubABs=
-
NSBqCst2TQsoCuPQCWrVJcZMaQ==
-
XgULikLb6PkeOubi
-
5YBDKpVGIrvCFbOc3Q==
-
8DbiHNWtmTAyw1YsjH/lL8TpimUu8ygl
-
nxj1I6Op1IGJVRbN7gpx
-
0KvxaFuA6cBryzDH1Lni7s9W
-
1rS3Dk9oxD/fRA==
-
eMFF9fHMPRZFILKx5WCRng==
-
pMxC7OGKd0jbCYRVMHnbFur1N+DU
-
nZzNQDhdyK5hEL2QkPhrtYVHz7k62Y0=
-
siXP5iXuAcxnhZBayg==
-
dP6jOfGxmFQDW+zPoDtnpnY=
-
MidVv6GxFvuwx5R5/w4=
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.18674.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.18674.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.18674.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.18674.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1820-139-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1820-142-0x0000000000401000-0x000000000042F000-memory.dmp
memory/1820-141-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1820-143-0x0000000001680000-0x00000000019CA000-memory.dmp
memory/4748-132-0x0000000000FA0000-0x00000000010DE000-memory.dmp
memory/4748-133-0x0000000006010000-0x00000000065B4000-memory.dmp
memory/4748-134-0x0000000005B00000-0x0000000005B92000-memory.dmp
memory/4748-135-0x0000000005A90000-0x0000000005A9A000-memory.dmp
memory/4748-136-0x00000000082F0000-0x000000000838C000-memory.dmp
memory/4748-137-0x0000000008390000-0x00000000083F6000-memory.dmp